# APAC Cross-Border Transfers — Compliance Template

## Organisation

| Field | Value |
|-------|-------|
| Organisation | Athena Global Logistics GmbH |
| APAC Entities | Japan KK, Hong Kong Ltd, Singapore Pte Ltd, India Pvt Ltd |
| Assessment Date | March 2025 |

## APAC Transfer Register

| Transfer ID | Source Entity | Source Country | Destination Entity | Dest Country | Mechanism | Law | Status |
|------------|-------------|---------------|-------------------|-------------|-----------|-----|--------|
| APAC-001 | Athena GmbH | Germany (EU) | Athena Japan KK | Japan | EU adequacy (Decision 2019/419) | GDPR Art. 45 | Compliant |
| APAC-002 | Athena Japan KK | Japan | Athena GmbH | Germany | PPC adequate country | APPI Art. 28 | Compliant |
| APAC-003 | Athena Japan KK | Japan | TransPacific HK | Hong Kong SAR | Consent + equivalent measures | APPI Art. 28 | Compliant |
| APAC-004 | Athena GmbH | Germany (EU) | Athena HK Ltd | Hong Kong SAR | EU SCCs Module 1 | GDPR Art. 46(2)(c) | Compliant |
| APAC-005 | Athena GmbH | Germany (EU) | CloudVault SG | Singapore | EU SCCs Module 3 | GDPR Art. 46(2)(c) | Compliant |
| APAC-006 | CloudVault SG | Singapore | Athena GmbH | Germany | PDPA contractual arrangement | PDPA S.26 | Compliant |
| APAC-007 | Athena GmbH | Germany (EU) | Athena India | India | EU SCCs Module 1 | GDPR Art. 46(2)(c) | Compliant |
| APAC-008 | Athena GmbH | Germany (EU) | Pinnacle TH | Thailand | EU SCCs Module 3 | GDPR Art. 46(2)(c) | Compliant |
| APAC-009 | TransPacific HK | Hong Kong | Pinnacle TH | Thailand | Contractual safeguards | PDPO (contractual) / PDPA S.28 | Compliant |

## Multi-Mechanism Summary by Route

| Route | EU/GDPR Mechanism | Source Country Mechanism | Dest Country Mechanism |
|-------|-------------------|------------------------|----------------------|
| EU → Japan | EU adequacy decision | N/A (receiving) | PPC supplementary rules apply |
| EU → Hong Kong | SCCs Module 1/2 + TIA | N/A (receiving) | PDPO contractual (S.33 not in force) |
| EU → Singapore | SCCs Module 3 + TIA | N/A (receiving) | PDPA S.26 contractual |
| EU → Thailand | SCCs Module 3 + TIA | N/A (receiving) | PDPA S.28 contractual |
| EU → India | SCCs Module 1 + TIA | N/A (receiving) | DPDP Act (no restrictions yet) |
| Japan → Hong Kong | N/A | APPI Art. 28 consent | PDPO contractual |
| Singapore → EU | N/A | PDPA S.26 contractual | N/A (adequate under SG law) |

## CBPR Certification Status

| Entity | CBPR Certified | Accountability Agent | Certification Date | Expiry |
|--------|---------------|---------------------|-------------------|--------|
| CloudVault Asia Pte Ltd | Yes | IMDA (Singapore) | 1 June 2024 | 31 May 2025 |
| Athena Logistics Japan KK | No (under consideration) | JIPDEC | N/A | N/A |

## Gaps and Actions

| Gap | Jurisdiction | Action | Owner | Target |
|-----|-------------|--------|-------|--------|
| Thailand PDPC adequate country list not yet published | Thailand | Monitor PDPC announcements; maintain contractual safeguards | Privacy Counsel | Ongoing |
| Hong Kong PDPO Section 33 not commenced | Hong Kong | Monitor for commencement; maintain contractual arrangements | Privacy Counsel | Ongoing |
| CBPR renewal for CloudVault due May 2025 | Singapore | Initiate renewal with IMDA | CloudVault CPO | April 2025 |