1. In short

• Our editors work in Indonesia. They are employed by PT Starianti Administrative Center, our editing team in Mataram, Lombok. When they edit your footage, personal data is transferred from the European Economic Area (EEA) to Indonesia.

• That transfer relies on the EU Standard Contractual Clauses (SCCs), a transfer impact assessment and supplementary measures.

• A few providers we use may process data outside the EU, for example in the United States. For those, we rely on the EU-US Data Privacy Framework or on the SCCs, whichever applies to the provider.

• You can limit what leaves your organisation by choosing the cloud workflow, in which your originals stay with you, or the Mac mini option, in which your footage never leaves your building.

This page explains these transfers in more detail. The binding terms are in article 10 of our Data Processing Agreement (the “DPA”).

2. What leaves the EEA and why

Our editing team in Indonesia

Editing your footage is the service you buy from us, and our editors do that work from Lombok. What they receive depends on the workflow you choose for a project:

• Cloud workflow: you create a project library in your own Blackmagic Cloud account and invite us. With the sync mode set to Proxy Only, your original footage stays on your own storage and only lightweight proxy files sync to our editors.

• Upload workflow: you upload your source footage through our upload link, up to 20 GB per project. Our editors work with that footage, and we delete it after delivery.

• Mac mini option: your footage stays on a Mac mini at your office. Our editors connect to it remotely and render the finals from the originals into a folder for you. What they see on screen is processed from Indonesia.

In every workflow, the editing team also processes your briefs, feedback, chat messages and the names and contact details of your project contacts.

Providers that may process data outside the EU

• Google (Google Ireland Ltd): calendar and Google Meet video calls for intro and sales calls. Google may process data in other countries, including the United States. This concerns our own business data, not your footage.

• Framer B.V. (Amsterdam): hosting of our website and its cookieless, aggregate analytics. Framer’s infrastructure is also located outside the EU, so technical data of website visitors, such as IP addresses, may be processed there.

• DigitalOcean: object storage in its Amsterdam region for files of some of our tools and for our backups, which are encrypted before they leave our servers. DigitalOcean is a company based in the United States.

• External AI services: we only use these on your material when you have agreed to it for a specific project. Any such service is listed on our sub-processors page, with its location and transfer mechanism, before we use it.

Blackmagic Cloud is your own service. Where your project library is hosted, and on what terms, follows from your own agreement with Blackmagic Design.

3. Legal mechanisms

Indonesia: Standard Contractual Clauses, Module Three

The European Commission has not adopted an adequacy decision for Indonesia. MediaTuig B.V., as data exporter, and PT Starianti, as data importer, have therefore concluded the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Three (processor to processor), as part of a data processing and transfer agreement. The signed agreement expressly includes processing for New Way Work clients.

Under that agreement, PT Starianti must, among other things:

• process your data only on our documented instructions;

• keep it confidential and secure;

• notify us of a personal data breach within 24 hours after becoming aware of it;

• delete local working copies of footage after delivery;

• not engage sub-processors of its own without our specific prior written authorisation;

• notify us of any legally binding request from a public authority for access to your data, where it is allowed to do so, and challenge such a request where there are reasonable grounds to consider it unlawful; and

• allow for and contribute to audits.

The agreement is governed by Dutch law, and the Autoriteit Persoonsgegevens (Dutch Data Protection Authority) is the competent supervisory authority. The people whose data is transferred can enforce certain clauses directly as third-party beneficiaries.

Providers in the United States

The transfer mechanism depends on the service, recipient and applicable account terms. It may be an adequacy decision, including the EU-US Data Privacy Framework for a certified recipient, or Standard Contractual Clauses with the necessary supplementary measures. We identify the relevant provider and terms on our sub-processors page. We do not assume that an EU office or EU storage region excludes all access from outside the EEA, or that Google Workspace terms apply to accounts that are not Workspace accounts.

4. Transfer impact assessment for Indonesia: summary

Before relying on the SCCs, we assessed whether the law and practice in Indonesia could prevent PT Starianti from complying with them, taking into account the circumstances of the transfer. This is a summary of that assessment.

Nature of the data

The data consists mainly of video and audio material in which people can be identified: images, voices and what people say, along with names, job titles and business contact details. Much of it is recorded for videos that are meant to be published, such as social content, brand films and event recaps, but some footage is internal or confidential. Footage can reveal special categories of personal data, such as health information. We process such data only as part of the footage you provide and as you instruct.

Data minimisation

• In the cloud workflow, only proxies reach our editors. Your originals stay on your own storage.

• Uploads are capped at 20 GB per project. Larger productions use the cloud workflow.

• With the Mac mini option, the footage never leaves your building.

• Source footage, proxies and working files are deleted after delivery, as described in our Data Retention Policy.

Security

• Our services use TLS (HTTPS). Remote access to render machines runs over an encrypted relay (RustDesk with forced encryption) or a private network (Tailscale).

• Our internal tools use single sign-on. Multi-factor authentication is available and is being rolled out as mandatory; it is not yet enforced for all users.

• Editors use non-admin accounts on their workstations and render machines.

• All team members are bound by confidentiality through their contracts.

More detail is on our Information Security page.

Access by public authorities

As in many countries, Indonesian law gives public authorities powers to request access to data, for example in criminal investigations. We assessed these powers in general terms, together with the nature of the data and the circumstances of the transfer: the data is commercial video material and project communication, and PT Starianti processes it only to edit video for us. Clause 15 of the SCCs requires PT Starianti to notify us of access requests where it is allowed to, to review their legality, to challenge them where there are reasonable grounds, and to disclose no more data than necessary.

Indonesian data protection law

Indonesia adopted a general data protection law in 2022: Law No. 27 of 2022 on Personal Data Protection (UU PDP). It sets out principles for processing personal data, rights for the people concerned, and obligations for organisations that process personal data. The protection of your data does not depend on that law alone: it relies on the SCCs and the measures described on this page.

Conclusion and review

On the basis of this assessment, we concluded that the transfer can take place under the SCCs together with the supplementary measures described above. We review the assessment when relevant circumstances change, for example a change in Indonesian law or a request from a public authority. If PT Starianti can no longer comply with the SCCs, we take appropriate measures or suspend the transfer, and we inform you.

5. Your options to limit transfers

• Choose the cloud workflow. Your originals stay on your own storage, and only proxies reach our editors. Proxies are still personal data, so the safeguards on this page apply to them.

• Choose the Mac mini option. Your originals never leave your building. The remote view of your footage is still processed from Indonesia.

• Share only what we need. Leave out footage that is not needed for the edit, and tell us in the brief about sensitive or confidential content.

• Keep AI services out. We do not use external AI services on your material unless you agree to it for a specific project.

Our editors work in Indonesia, so we do not offer editing without any processing from Indonesia. The options above limit what is transferred and keep your originals under your control.

6. Copies and questions

On request, we send you a copy of the SCCs as concluded with PT Starianti and a summary of our transfer impact assessment. Email info@newwaywork.nl. We may redact commercial details before sharing them. People whose data is transferred can also ask us for a copy of the SCCs.

For our wider assessment of risks, see our Risk Assessment. For questions about international transfers, email info@newwaywork.nl.