# Binding Corporate Rules — Application and Compliance Template

## BCR Application Summary

| Field | Value |
|-------|-------|
| Applicant (BCR Lead) | Athena Global Logistics GmbH |
| BCR Type | BCR-C (Controller) per WP256 rev.01 |
| Lead Supervisory Authority | Berliner Beauftragte fuer Datenschutz und Informationsfreiheit (BlnBDI) |
| Application Date | 1 April 2025 |
| DPO Contact | Elisa Brandt, elisa.brandt@athenalogistics.eu, +49 30 1234 5678 |
| Number of Bound Entities | 47 entities across 31 jurisdictions |

## Annex A — Bound Entities (Excerpt)

| Entity Name | Jurisdiction | Role | IGA Signed |
|------------|-------------|------|-----------|
| Athena Global Logistics GmbH | Germany | BCR Lead / Controller | Yes |
| Athena Logistics France SAS | France | Controller | Yes |
| Athena Logistics (UK) Ltd | United Kingdom | Controller | Yes |
| Athena Logistics (Hong Kong) Ltd | Hong Kong SAR | Controller | Yes |
| TransPacific Freight Solutions Ltd | Hong Kong SAR | Processor | Yes |
| Athena Freight Services India Pvt Ltd | India | Controller | Yes |
| Athena Logistics Japan KK | Japan | Controller | Yes |
| Athena Logistics Singapore Pte Ltd | Singapore | Controller | Yes |
| Athena Logistics Australia Pty Ltd | Australia | Controller | Yes |
| Athena Logistics do Brasil Ltda | Brazil | Controller | Yes |
| Athena Logistics USA Inc | United States | Controller | Yes |
| Athena Freight Middle East FZE | United Arab Emirates | Controller | Yes |

## Annex B — Transfer Scope Summary

| Transfer Category | Data Subjects | Data Categories | Purposes | Destination Countries |
|------------------|--------------|-----------------|----------|----------------------|
| HR Operations | Employees, contractors | Name, employee ID, salary, benefits, performance reviews, tax identifiers | Employment administration, payroll, benefits management, performance management | All Annex A jurisdictions |
| Customer Operations | Consignors, consignees, customs contacts | Name, business email, phone, shipping address, customs IDs, consignment data | Freight forwarding, customs clearance, delivery tracking, billing | All Annex A jurisdictions |
| Supplier Management | Supplier contacts | Name, business email, phone, company, banking details | Procurement, contract management, payment processing | All Annex A jurisdictions |
| IT Operations | All group employees | Username, email, access logs, device identifiers | IT support, system administration, security monitoring | Germany (primary DC), Singapore (DR site), USA (cloud provider) |

## Annex C — Minimum Security Standards Summary

| Control Domain | Minimum Standard |
|---------------|-----------------|
| Access Control | RBAC with least-privilege; MFA for privileged and remote access; quarterly access reviews |
| Encryption | TLS 1.3 for data in transit; AES-256 for data at rest; HSM-managed keys |
| Network Security | Segmented networks; WAF and IPS/IDS; monthly vulnerability scanning |
| Endpoint Protection | EDR on all endpoints; centralised patch management within 30 days of critical patches |
| Logging and Monitoring | Centralised SIEM; 12-month log retention; 24/7 SOC for critical systems |
| Physical Security | ISO 27001-certified data centres; biometric access; 24/7 CCTV |
| Incident Response | Documented IRP; 24-hour initial triage SLA; annual tabletop exercise |
| Business Continuity | RPO 4 hours / RTO 8 hours; geo-separated DR; annual DR testing |
| Staff Measures | Background checks; confidentiality agreements; mandatory annual security training |

## Approval Process Tracker

| Phase | Status | Start Date | Target End | Actual End | Notes |
|-------|--------|-----------|------------|-----------|-------|
| 1. Preparation and Drafting | Completed | 1 January 2025 | 15 April 2025 | 10 April 2025 | All annexes finalised, board approved |
| 2. Lead SA Submission and Review | In Progress | 1 May 2025 | 30 September 2025 | -- | First round questions received 1 June 2025 |
| 3. Cooperation Procedure | Not Started | -- | December 2025 | -- | -- |
| 4. EDPB and Formal Approval | Not Started | -- | March 2026 | -- | -- |
| 5. Rollout and Implementation | Not Started | -- | May 2026 | -- | -- |

## Compliance Self-Assessment Template (Per Entity)

| Assessment Item | Compliant | Evidence Reference | Gap Description | Remediation Target |
|----------------|-----------|-------------------|-----------------|-------------------|
| IGA signed and on file | Yes/No | IGA execution record | -- | -- |
| BCR training completed (all staff) | Yes/No | LMS completion report | -- | -- |
| Minimum security standards met | Yes/No | ISO 27001 certificate or internal audit | -- | -- |
| Complaint procedure operational | Yes/No | Procedure document and test record | -- | -- |
| Data subject rights procedures in place | Yes/No | Procedure documents for each right | -- | -- |
| Retention schedules implemented | Yes/No | Retention policy and deletion logs | -- | -- |
| Local law assessment submitted | Yes/No | Outside counsel report | -- | -- |
| Incident reporting procedure active | Yes/No | IRP document and drill record | -- | -- |

## Audit Programme Schedule

| Entity | Audit Year | Planned Date | Audit Type | Status |
|--------|-----------|-------------|------------|--------|
| Athena Global Logistics GmbH | Year 1 | Q2 2026 | Full BCR compliance | Scheduled |
| Athena Logistics (Hong Kong) Ltd | Year 1 | Q3 2026 | Full BCR compliance | Scheduled |
| Athena Logistics USA Inc | Year 1 | Q4 2026 | Full BCR compliance | Scheduled |
| Athena Freight Services India Pvt Ltd | Year 2 | Q1 2027 | Full BCR compliance | Planned |
| Athena Logistics Japan KK | Year 2 | Q2 2027 | Full BCR compliance | Planned |
| Athena Logistics Singapore Pte Ltd | Year 2 | Q3 2027 | Full BCR compliance | Planned |
| Athena Logistics France SAS | Year 3 | Q1 2028 | Full BCR compliance | Planned |
| Athena Logistics (UK) Ltd | Year 3 | Q2 2028 | Full BCR compliance | Planned |