Standard Contractual Clauses — Appendix (Module One)

This page is the Appendix to the Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914, Module One (controller to controller), as incorporated into the Firmavis Terms of Service. It comprises Annex I (parts A, B and C) and Annex II, in the form and order the Decision prescribes.

1. What this document is

Section 7 of our Terms provides that, where the conditions in section 2 below are met, the Module One Clauses are incorporated into the Terms with MB Firmavis as data exporter and you, our customer, as data importer, and that we make the completed annex schedule available before such access. This page is that schedule.

It is not a separate contract and creates no obligations of its own beyond the Clauses; where it mentions an obligation that comes from our Terms rather than from the Clauses, it says so. It records the information the Decision requires the parties to specify so that the Clauses are complete and operative. The Clauses are entered into by your acceptance of the Terms — the Terms are the signed instrument, and the date of your acceptance is the date of the parties’ agreement to this Appendix. Where the Decision contemplates a signature block, that acceptance stands in its place.

Clause 8.2(c) of the Clauses requires the parties, on request, to make a copy of the Clauses, including the Appendix as completed by them, available to a data subject free of charge. We satisfy that by publishing it here, at a stable public URL that requires no account and no request.

Transparency under Clause 8.2(a). Where Clause 8.2(a) requires the data importer to inform data subjects of its identity, the categories of personal data it processes, the right to obtain a copy of the Clauses and any intended onward transfer, it does so directly. Firmavis does not transmit notices to data subjects on the importer’s behalf. Where individual notice would involve a disproportionate effort within the meaning of Clause 8.2(b), the importer shall, to the extent possible, make that information publicly available. Firmavis’s own Article 14 obligation is discharged under Article 14(5)(b) by the appropriate measures set out in section 7 of our Privacy Policy, led by the public availability of that notice and of this Appendix.

2. When it applies

This Appendix, and the Clauses it completes, apply where:

• you are established outside the European Economic Area, the United Kingdom, or another country covered by a European Commission adequacy decision; and
• you are not subject to the GDPR under Article 3 GDPR for the processing concerned.

Both conditions must be met. Where you are established outside the EEA but are caught by Article 3(2) GDPR for the processing concerned, the Clauses do not apply to you: you remain directly bound by the GDPR in respect of that processing, and the European Commission has not adopted standard contractual clauses for that situation.

We do not ask you to declare where you are established, and we do not route customers by any such declaration. The Clauses bind whoever meets the conditions above, whether or not we know it — so an inaccurate declaration could not remove the safeguard. Where we hold the Clauses to apply and they in fact do not, nothing is lost: they simply add protections alongside the obligations you already owe.

The trigger is not export alone. Under our Terms, viewing, access to and export of personal data from the Service each constitute a transfer under Chapter V GDPR. A free account can view and access personal data (and export the companies it has revealed) — for example the name and role of a listed contact person, shown to signed-in accounts, or the contacts it reveals — so this Appendix is engaged from your first such access, not only when you download a file.

Whether the Clauses apply depends on where you are established, not on where the individuals in the records are located. A record about a person at a company in a non-EEA country that is disclosed to a customer inside the EEA is not a restricted transfer; a record about a person at an EEA company disclosed to a customer outside the EEA is.

3. Annex I.A — List of parties

Data exporter

• Name: MB Firmavis, a Lithuanian small partnership, company code 307941710
• Address: Laisvės al. 85E-5, LT-44297 Kaunas, Lithuania
• Contact person: Privacy Lead — [email protected]. (We have assessed that we are not currently required to designate a data protection officer under Article 37(1) GDPR and have not designated one; we keep that assessment under review. The Privacy Lead is the contact point for all data-protection correspondence.)
• Activities relevant to the data transferred: compiling and maintaining a database of European companies and the business contact details of named role-holders at those companies, and operating a subscription service through which customers search that database and, on request, have individual records disclosed to them.
• Role: controller.
• Signature and date: as recorded by your acceptance of the Terms of Service (see section 1).

Data importer

• Name: the customer — the legal person, sole trader or self-employed professional for whom the Firmavis account is held, being the name associated with that account (where the customer is a natural person, that person’s own name).
• Address: the address or other contact details associated with the Firmavis account, or as otherwise notified to us.
• Contact person: the account owner, or the data-protection contact the customer has notified to us in writing.
• Activities relevant to the data transferred: using business contact records obtained from the Service for the customer’s own business purposes — in particular business-to-business sales and outreach, and verification of counterparties, suppliers and customers — in each case as an independent controller and subject to the restrictions in our Terms.
• Role: controller.
• Signature and date: the customer’s acceptance of the Terms of Service. Every account accepts the Terms of Service and the Privacy Policy at sign-up, and the date and time of that acceptance are recorded against the account; the version accepted is the one in force on that date.

A customer to whom this Appendix applies shall, on request, provide us with its current name, country of establishment and data-protection contact, by notice to [email protected]. We will furnish this Appendix as completed for a given transfer, together with the version in force at the time, to that customer or to a data subject on request, redacting personal data where Clause 8.2(c) permits.

4. Annex I.B — Description of the transfer

Categories of data subjects

• Named role-holders at European companies — individuals whose professional role is published in an official register or by the company itself, including officers, directors and named business contacts, in their professional capacity only.
• Owners of one-owner businesses that are legal persons (for example a Lithuanian or Latvian individual enterprise, or a Latvian farm), where the company record identifies its owner; and the persons concerned by a small residue of records scheduled for removal (estates of deceased persons, and Ukrainian records whose registration code is a personal tax number). Sole traders and self-employed people registered as such are not included.

No other category is transferred. Account holders, site visitors and people who contact us are not part of the transfer described here; we do not disclose them to customers.

Categories of personal data

• Name of the role-holder;
• role or job title;
• business email address (up to three per company record);
• business telephone numbers — mobile and other numbers (up to three of each per company record);
• the business address, city, region, postal code and country of the company at which the person holds the role;
• when contacts are viewed in the interface, where available, an indicator of the validation status of each business email address.

The remaining fields in a record — registered name, registration and VAT numbers, activity classification, incorporation date, legal form, corporate website, employee and revenue figures, published financial results, and where a national source publishes them the average salary and vehicle counts — are information about a legal entity and are not personal data, except where the record identifies a natural person (the owner of a one-owner legal person, or a residual record described above), in which case they relate to that person.

No date-of-birth field, no location or behavioural data, and no browsing or usage profile is transferred. Addresses and contact details are those published for the company; the registered address of a one-owner business can nonetheless be its owner’s home address, and the registration code of a residual Ukrainian record can be a personal tax number, which encodes a date of birth.

Sensitive data

None. We do not intentionally collect or use special categories of personal data (Article 9 GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR), no field in the database is designed to record them, and we do not classify, filter or disclose records by reference to any such characteristic. Because we index professional roles, a record could in principle indirectly suggest such information — for example, a role at a political, religious or trade-union organisation. Where we become aware that a record reveals special-category data, we remove that data. No additional restrictions or safeguards under Clause 8.6 are therefore stipulated, because no sensitive data is transferred.

Frequency of the transfer

Continuous, on demand, and record by record. There is no bulk feed and no scheduled push. Company records — including the name and role of a listed contact person — become visible to the customer when it runs a search or opens a company page. Contact details (business email addresses and telephone numbers) are disclosed only on a deliberate reveal or export action by the customer, and are limited to the records covered by that action. That volume is bounded by the customer’s plan: free accounts are capped at a small number of reveals per day, and paid accounts consume one credit per company revealed.

Nature of the processing

Disclosure by transmission: making the personal data described above available to the data importer through the Service’s user interface and through file exports generated on the importer’s request. Following disclosure, the importer stores and uses the data in its own systems under its own control.

Purpose(s) of the transfer and further processing

Stated separately for each party, because each acts as an independent controller:

• Data exporter. To make business-contact records available to the customer for the three purposes for which the database is maintained — facilitating cross-border B2B commerce, enabling corporate due diligence and counterparty verification, and supporting compliant B2B direct outreach — on the basis of Article 6(1)(f) GDPR (legitimate interests), as set out in sections 5 and 6 of our Privacy Policy; and to meter each disclosure and retain the record of it needed to answer Article 15(1)(c) requests and make Article 19 communications.
• Data importer. To carry out its own business-to-business activities using the records — business development and outreach to the companies concerned, and verification of counterparties, suppliers and customers — subject to the restrictions in our Terms, which prohibit resale or redistribution of the records, prohibit their use to train, fine-tune or evaluate any artificial-intelligence or machine-learning model, prohibit their use in decisions producing legal or similarly significant effects concerning a natural person within the meaning of Article 22 GDPR, and require compliance with the marketing and electronic-communications law applicable to the recipient.

Retention period

Exporter side. Records remain in the database for as long as the underlying public source remains accessible and the business email addresses continue to pass periodic deliverability validation; addresses that no longer validate are dropped at the next rebuild. Deliverability is a floor, not the only test: we also remove or correct records we learn are stale or inaccurate, and we remove data that is no longer necessary for the purposes above. Export files generated for a customer are deleted from our systems 7 days after they are produced. Our general retention schedule is in the Retention periods section of our Privacy Policy.

Importer side. The criterion is that of Clause 8.4: the importer retains a record no longer than is necessary for the purposes stated above, and shall review the records it has received at intervals of no more than 24 months and erase those no longer necessary, including copies held in backups. Two further limits apply under our Terms. First, where we notify the customer, or make available to the customer a list showing, that a record has been removed or suppressed, the customer must stop using that record, delete it from its systems within 30 days of the notice, and not re-import it into any Firmavis workspace — unless it has established its own independent legal basis to retain it. Second, data retained after termination of the Terms remains subject to the same restrictions.

Transfers to (sub-)processors

Not applicable to this transfer. This is a controller-to-controller transfer; the importer does not receive the data as a processor and engages no sub-processor on our behalf. Our own sub-processors are listed at /legal/subprocessors and are engaged under Article 28 GDPR agreements — a separate channel from this one, with its own transfer mechanisms.

5. Annex I.C — Competent supervisory authority

Identified in accordance with Clause 13 of the Clauses. The data exporter is established in Lithuania, so the competent supervisory authority is the supervisory authority of the exporter’s Member State of establishment:

This authority acts as supervisory authority for the purposes of the Clauses, including Clause 13 and Clause 15. Nothing here affects a data subject’s right to lodge a complaint with the supervisory authority of their own habitual residence or place of work.

6. Annex II — Technical and organisational measures

Attributed to the party that owes each measure. Under Clause 8.5 the importer owes security for the data once it holds it, and both parties owe security in transmission.

Measures of the data exporter

• Encryption of data in transmission. All access to the Service, and all delivery of exported files, is over HTTPS; our origin servers accept only TLS 1.2 or higher.
• Pseudonymisation. Where an individual has asked to be suppressed, the identifier is held in plaintext only until the request is decided, and thereafter only as a one-way hash of the canonicalised value; the plaintext is destroyed once suppression is confirmed, so the suppression list cannot be read back as a list of people.
• User identification and authorisation. Contact data is never included in a page’s initial HTML; it is served masked. Disclosure of the real contact details of a record requires an authenticated account and a deliberate reveal or export action. Administrative access to production systems is limited to the operator. We are a very small team and do not operate separate administrative role tiers. The name and role of a listed contact person are likewise shown only to an authenticated account.
• Protection of data during storage. The application and database run on dedicated servers in an access-controlled EU data centre in Helsinki, Finland, operated by an ISO/IEC 27001-certified provider. The database does not accept connections from general internet traffic: access is restricted at the host firewall to the application itself and to a small allow-list of operator addresses, and every connection requires password authentication (SCRAM-SHA-256). Administrative access to these servers is possible only by key-based authentication over a private network; no administrative port is exposed to the public internet.
• Physical security. Provided by the data-centre operator: controlled access to the facility, video surveillance, and environmental and power redundancy.
• Availability, resilience and restoration. Production storage is mirrored across redundant drives, and the operational database tables are backed up daily, so data can be restored after a hardware or technical failure. We review the measures in this Annex at least annually and after any material change to the Service or any personal data breach.
• Incident and breach response. We maintain a documented breach-response procedure. Where a personal data breach affects transferred data, we notify the affected customer without undue delay and, where Article 33 GDPR requires it, the Lithuanian State Data Protection Inspectorate through its electronic channel.
• Event logging. The first disclosure of a company’s contact details to an account — by reveal or by export — is recorded with the acting account, the company record and the time. Subsequent access by the same account to a record it has already been given is not separately recorded. Company records are also visible in search results and on company pages without a reveal, and the name and role of a listed contact person only to a signed-in account; that access is rate-limited but is not recorded record by record. Server access logs are retained for 14 days routinely, up to 90 days for a security or incident investigation, and up to 12 months for a documented fraud investigation only.
• Data minimisation. Only business-capacity contact data is held. We do not enrich records with private, sensitive or behavioural attributes, we do not collect personal data from personal social networks, and we do not buy consumer data from list brokers.
• Data quality. Business email addresses are checked for deliverability before entry and re-checked periodically. An address that fails a check is dropped from the dataset at the next rebuild. When contacts are revealed in the interface, each address carries, where available, an indicator of its validation status, so the importer can judge how far to rely on it. Exported files contain the addresses without that indicator.
• Limited retention and erasure. Removal requests are accepted from anyone through a public self-service form at our data-removal form, without an account and without requiring a reason. A confirmed email removal is recorded on a suppression list that is applied automatically to every subsequent rebuild of the dataset, so the address is not re-added. An approved telephone removal is recorded on a separate suppression list that is applied in the same way, so the number is not re-added either. Requests concerning other identifiers, including a name, should be sent to [email protected] and are handled by us individually.
• Certification and assurance. We hold no security certification of our own. Our hosting provider, identified in our sub-processor list, holds ISO/IEC 27001 certification covering the facilities we use.
• Accountability. We maintain a documented legitimate interests assessment and a data protection impact assessment for the database.
• Transfers onward from us. Every sub-processor we engage is engaged under a written Article 28 GDPR agreement and is listed at /legal/subprocessors, which we update before a new sub-processor takes effect.

Measures of the data importer

The importer shall, as a minimum:

• (i) retrieve data from the Service only over the encrypted channels the Service provides, and not circumvent or downgrade them;
• (ii) encrypt the received data at rest using AES-256 or an equivalent industry standard, and hold it only on managed devices and systems — never on unmanaged personal devices or personal cloud accounts;
• (iii) require multi-factor authentication on every account with access to the received data, under individual named credentials, withdrawn within 5 working days of a person no longer needing access, and review the access list at least every 12 months keeping a record of that review;
• (iv) bind every person authorised to process the received data to a written confidentiality obligation or an appropriate statutory obligation of confidentiality;
• (v) not publish, resell or make the data available to third parties, as our Terms require;
• (vi) delete a record within 30 days of being notified, or of a list being made available showing, that it has been removed or suppressed, unless it has established its own independent legal basis to retain it, and be able to locate and delete all copies of a specific record, including backups;
• (vii) notify the exporter at [email protected] without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting the received data, and comply with its own obligations under Clause 8.5(d)–(g);
• (viii) make an onward transfer only where Clause 8.7 permits it, and maintain a record of onward disclosures sufficient to answer a Clause 10 request;
• (ix) review these measures at regular intervals and at least annually; and
• (x) on the exporter’s written request, describe these measures and provide evidence of them within 30 days.

7. Governing law and choice of forum (Clauses 17 and 18)

For the purposes of Clause 17 of the Clauses, the Parties agree that the Clauses are governed by the law of the Republic of Lithuania, which allows for third-party beneficiary rights. For the purposes of Clause 18(b), the Parties agree that any dispute arising from the Clauses shall be resolved by the courts of the Republic of Lithuania. This is without prejudice to Clause 18(c), under which a data subject may also bring proceedings against either party before the courts of the Member State in which they have their habitual residence.

These elections complete Clauses 17 and 18 for the incorporated Clauses. Section 7 of our Terms provides that the Clauses prevail over any conflicting term of the Terms, including §11 (Limitation of liability), §17 (Disputes) and §18 (General).

8. Annex III — Not applicable

Annex III of the Decision is the list of sub-processors, and it applies only to Module Two and Module Three, where the importer is a processor and Clause 9 requires authorisation of sub-processors. Module One contains no Clause 9, so no Annex III is required here and none is provided. Onward transfers by the importer are governed by Clause 8.7, not by an authorised-sub-processor list.

9. Changes to this Appendix

We may update this Appendix to keep it accurate — for example when the fields in a record change, or when a security measure changes. Any update is published on this page with a revised “Last updated” date. Where a change is material, it takes effect no earlier than 30 days after it is posted here. Section 15 of our Terms applies to any change to this Appendix that materially expands your obligations, and any update to the Appendix takes effect for an existing subscriber from its next renewal. An update to this Appendix cannot reduce the protection the Clauses themselves give data subjects: the Clauses prevail over any conflicting term, and nothing here limits the rights they confer on data subjects as third-party beneficiaries.

Questions about this Appendix, or a request for a copy of the Clauses: [email protected].

This document is published in English. Translations into other supported languages may be published at a corresponding translated URL under /legal. In the event of any discrepancy between the English version and any translation, the English version prevails to the extent permitted by applicable law.

Back to top