# EU-US Data Privacy Framework — Verification and Compliance Template

## DPF Transfer Verification Record

| Field | Value |
|-------|-------|
| Verification Date | 14 March 2025 |
| Verified By | Elisa Brandt, Head of Data Protection, Athena Global Logistics GmbH |

## Data Importer Details

| Field | Value |
|-------|-------|
| Organisation Name | Meridian Cloud Services Inc |
| Address | 2100 Pennsylvania Avenue NW, Suite 400, Washington, DC 20037, United States |
| DPF List URL | dataprivacyframework.gov/participant/XXXX |
| Certification Status | Active |
| Initial Certification Date | 15 September 2024 |
| Re-certification Due Date | 15 September 2025 |
| Data Categories Covered | Non-HR Data |
| Regulatory Jurisdiction | Federal Trade Commission (FTC) |
| Independent Recourse Mechanism | JAMS International Mediation Centre |
| Privacy Policy URL | meridiancloud.com/privacy |

## Transfer Details

| Field | Value |
|-------|-------|
| Data Exporter | Athena Global Logistics GmbH (Berlin, Germany) |
| Transfer Purpose | Cloud-based transport management system hosting and analytics |
| Data Subject Categories | Shipping customers, consignees, warehouse workers |
| Personal Data Categories | Full name, business email, phone number, shipping address, consignment references, delivery preferences |
| Sensitive Data | None |
| Transfer Frequency | Continuous (real-time API synchronisation) |
| Transfer Mechanism | EU-US DPF Adequacy Decision (EU) 2023/1795 |

## DPF Principles Compliance Verification

| Principle | Verified | Notes |
|-----------|----------|-------|
| Notice | Yes | Privacy policy discloses all required information including data types, purposes, third parties, and recourse mechanism |
| Choice | Yes | Opt-out mechanism available via online preference centre; no sensitive data processed |
| Accountability for Onward Transfer | Yes | Sub-processor agreements reviewed; all sub-processors subject to equivalent contractual obligations |
| Security | Yes | SOC 2 Type II report dated August 2024; ISO 27001:2022 certified |
| Data Integrity and Purpose Limitation | Yes | Data minimisation controls confirmed; retention policy limits storage to 36 months |
| Access | Yes | Data subject access portal operational at meridiancloud.com/dsar |
| Recourse, Enforcement, Liability | Yes | JAMS engaged as IRM; annual self-assessment completed; FTC jurisdiction confirmed |

## Backup Transfer Mechanism

| Field | Value |
|-------|-------|
| Backup Mechanism | SCCs Module 2 (C2P) executed 15 September 2024 |
| SCC Status | Executed and held in reserve; to be activated if DPF adequacy decision is suspended or invalidated |
| TIA for SCC Backup | Completed 10 September 2024 — TIA-2024-US-003 |
| Activation Trigger | Suspension or invalidation of adequacy decision, or loss of DPF certification by the importer |

## Monitoring Schedule

| Action | Frequency | Next Due |
|--------|-----------|----------|
| Verify active DPF certification status | Quarterly | 15 June 2025 |
| Review importer privacy policy for DPF compliance | Annual | 15 September 2025 |
| Monitor EC annual DPF review outcomes | Annual | October 2025 |
| Monitor FISA Section 702 reauthorisation | Upon legislative event | April 2026 |
| Monitor CJEU DPF challenge proceedings | Ongoing | Continuous |
| Re-verify backup SCC TIA currency | Annual | 10 September 2025 |

## Risk Assessment

| Risk Factor | Assessment | Mitigation |
|------------|-----------|-----------|
| DPF adequacy invalidation (CJEU challenge) | Medium — legal challenge likely but timeline uncertain | Backup SCCs executed and maintained |
| Importer loss of DPF certification | Low — importer has strong compliance history | Quarterly verification; contractual termination clause |
| FISA Section 702 changes | Medium — reauthorisation in April 2026 | Monitoring programme in place; SCC fallback available |
| Change in US executive policy | Low-Medium — EO 14086 could be modified by future administration | Monitoring; contractual commitment to DPF principles survives certification |

## Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Data Protection Officer | Elisa Brandt | 14 March 2025 | _________________ |
| IT Security Manager | Thomas Richter | 14 March 2025 | _________________ |
| Head of Procurement | Katharina Meier | 14 March 2025 | _________________ |