Transfer Impact Assessment

International transfers of personal data under the GDPR and the UK GDPR

VENDI AI LTD, doing business as Obert · Ibn Gabirol 72, Tel Aviv, Israel

Version 1.0 · Effective 25 October 2026 · privacy@obert.io

This is the Transfer Impact Assessment of VENDI AI LTD, doing business as Obert, published at https://obert.io/transfer-impact-assessment. It is made for Clause 14 of the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) and follows the European Data Protection Board's Recommendations 01/2020 on measures that supplement transfer tools. It tests the United States against the European Essential Guarantees in Recommendations 02/2020.

1. Conclusion

Obert may continue the transfers described in this assessment.

A customer in the EEA or the United Kingdom that sends personal data to Obert sends it to a company established in Israel, and the production database that holds it is in Frankfurt, Germany. Israel is covered by an adequacy decision. Germany is in the EEA. That leg does not depend on the Standard Contractual Clauses.

Onward transfers from Obert follow one of three tools. They stay inside the EEA. They go to a United States organization that is certified under the EU-US Data Privacy Framework, including the UK Extension and, where the listing says so, the Swiss-US Data Privacy Framework. Or they go to a United States organization under the European Commission's 2021 Standard Contractual Clauses and the UK International Data Transfer Addendum, which are incorporated in Obert's Data Processing Agreement.

For the organizations that are not certified under the Data Privacy Framework, this assessment finds no reason to believe that the law and practice of the United States prevent the importer from fulfilling its obligations under those clauses. The finding is limited to the data, the recipients, and the measures described below. It does not treat the Data Privacy Framework adequacy decision as if it covered a company that is not certified.

Two facts are stated here because they are easy to miss in the Data Processing Agreement. The production Gemini client calls Google's global Vertex AI endpoint, so those prompts are not confined to Frankfurt. Google LLC is certified under the Data Privacy Framework, and that certification is the transfer tool for those prompts. Six sub-processors had no active Data Privacy Framework listing when the public list was checked on 25 October 2026. Their transfers rely on the Standard Contractual Clauses.

2. Scope

This assessment covers personal data that Obert processes as a processor for a customer, and business contact data that Obert processes as a controller. It covers transfers from the EEA and the United Kingdom. Where a recipient's Swiss-US Data Privacy Framework certification is active, the same map is the tool for a transfer from Switzerland to that recipient.

The facts are taken from the production configuration on 25 October 2026, from the Data Processing Agreement and security measures published at obert.io/dpa and obert.io/security, and from the public participant list at dataprivacyframework.gov checked the same day. Certifications lapse and are renewed. A listing recorded here as active was active on that date.

Customer-directed integrations that the customer connects with its own credentials, including a CRM, Slack, GitHub, or an export destination, are the customer's own transfers. They are outside this assessment. The Data Processing Agreement says the same.

3. Roles and the data

VENDI AI LTD is a company incorporated in Israel. Its registered office is Ibn Gabirol 72, Tel Aviv. For personal data a customer submits to the service, the customer is the controller, or a processor for its own customer, and Obert is the processor. For business contact data that Obert maintains in its own right, Obert is an independent controller. The Data Processing Agreement does not apply to that controller activity. The onward transfers of both sets of data use the same sub-processors and the same tools, so one assessment covers both.

Customer data that can be transferred includes the categories in Schedule 1 of the Data Processing Agreement. In short: account users (name, business email, job title, company, authentication identifiers, billing contact details); leads and prospects (name, email, phone, public professional profile data, engagement such as posts and website visits, message content, and, if the customer uses the dialer, call metadata, recordings, and transcripts); notes and scores the customer adds; and tokens for connected sending accounts, which are stored encrypted. Obert does not intentionally collect special-category data. Payment card numbers are processed by Stripe and are not stored by Obert.

The production database, backups, application, and workers run on Render in Frankfurt. Backups stay in the EU. On workspace deletion or the end of the contract, production data is removed within 7 days and encrypted backups roll off within 35 days. Error and trace telemetry is kept for 90 days. Product analytics are kept for 12 months.

4. The transfers and the tool for each

4.1 Transfers that stay in an adequate destination

These do not use the Standard Contractual Clauses.

Transfer What moves Tool
Customer to Obert in Israel Access from Israel to personal data held for the service EU adequacy decision for Israel (Commission Decision 2011/61/EU), confirmed in the Commission's January 2024 review. The UK likewise treats Israel as adequate.
Production storage The customer database and backups Frankfurt, Germany, inside the EEA. Render Services, Inc. is the host and is also certified under the Data Privacy Framework. See section 4.2.
Unipile SAS LinkedIn and email communications infrastructure. Obert stores an opaque account reference. The platform credentials are held by Unipile. France, inside the EEA.
Snowlight Ventures OÜ (Mailpool) Email infrastructure European Union.
FullEnrich Corp Contact enrichment European Union.

4.2 United States recipients certified under the Data Privacy Framework

The transfer tool is the adequacy decision for the EU-US Data Privacy Framework (Commission Implementing Decision of 10 July 2023), the UK Extension, and the Swiss-US Data Privacy Framework where the row says so. A separate local-law assessment is not required for a transfer that relies on that decision. The rows are recorded so the map is complete. Each listing was active on 25 October 2026.

Recipient Personal data it receives Listing checked Frameworks active
Render Services, Inc. Hosts the Frankfurt database, application, and backups. This is the full customer store, held in Germany. Participant 9348 EU, UK, Swiss. Non-HR data.
Google LLC Gemini prompts and outputs for scoring, drafting, classification, and similar inference. The production Vertex client uses the global endpoint, so processing is not pinned to Frankfurt. An API-key path, where used, also does not pin a region. The published DPA describes this sub-processor as Frankfurt. This assessment follows the configuration. Google is instructed not to train on customer Gmail data. Participant 5780 EU, UK, Swiss. HR and non-HR.
Functional Software, Inc. (Sentry) Error reports. The production client can attach the signed-in user's id, email, and name. Access-key material is filtered before send. Traces are not sampled to Sentry. Participant 5869 EU, UK, Swiss. Non-HR data.
PostHog, Inc. Product analytics. The production host is us.i.posthog.com. Events can identify a customer user. They are not a bulk export of the lead database. Participant 2915 EU, UK, Swiss. HR and non-HR.
Twilio Inc. If the customer uses the dialer: phone numbers, call metadata, recordings, and transcripts. Participant 5394 EU, UK, Swiss. Non-HR data.
Stripe, LLC Billing contact and subscription metadata. Card numbers stay at Stripe. Participant 10014 EU, UK, Swiss. HR and non-HR.
ZenLeads Inc. (Apollo.io) Enrichment inputs (name, company, professional profile, email) and the phone numbers and related business contact data returned. Participant 5934 EU, UK, Swiss. HR and non-HR.
Plus Five Five, Inc. (Resend) Transactional email to customer users, including the recipient address and the message. Participant 8907 EU and UK are active, with recertification under review. Non-HR data. If the listing ceases to be active, the Standard Contractual Clauses in the DPA are the tool.

Temporal Technologies Inc. runs application workflow infrastructure. The Data Processing Agreement places it in Frankfurt. No Data Privacy Framework participant record was found for Temporal on 25 October 2026. While the data remains in Frankfurt there is no transfer to a third country. Any access by Temporal from the United States is treated under the Standard Contractual Clauses, together with the recipients in section 4.3.

4.3 United States recipients assessed under the Standard Contractual Clauses

No active Data Privacy Framework participant record was found on 25 October 2026 for these legal or trading names. The tool is the 2021 Standard Contractual Clauses (Module Two, controller to processor, and Module Three, processor to processor, as applicable) and the UK International Data Transfer Addendum, as incorporated in Schedule 3 of the Data Processing Agreement. Clause 9, option 2, matches Obert's general authorization for sub-processors. The clauses are governed by Irish law, with the courts of Dublin, for EU transfers, and by the law of England and Wales for UK transfers.

Recipient Personal data it receives Why it is in this table
Descope Technologies Israel (2022) Ltd. Authentication. Name, email, and session identifiers of customer users. The contracting entity is Israeli. The DPA lists the processing location as the United States, and this table follows that listing. The production identity project uses Descope's EU endpoint (euc1). Any processing that stays in the EEA needs no clause. Processing in the United States uses the clauses.
Pydantic Services, Inc. (Logfire) Application traces and logs used to operate the service. A trace can contain identifiers and fragments of a request. No Data Privacy Framework record found. Telemetry retention is 90 days.
Nokia of America Corporation (Rapid) Business contact and company data sent for enrichment, and the data returned. No Data Privacy Framework record found for this entity. A group listing under another Nokia name was not identified.
SerpApi, LLC Search queries for public web retrieval, which can include a name or a public profile, and the public pages returned. No Data Privacy Framework record found.
SideGuide Technologies, Inc. (Firecrawl) Public web pages retrieved for research. A page can contain personal data that was already public. No Data Privacy Framework record found.
GetEmails, LLC (RB2B) Website-visitor identification. A visitor's business email and related professional details can be returned. No Data Privacy Framework record found.

5. The law and practice of the United States

The destination that is not adequate, for the transfers in section 4.3 and for any United States access to data held in Frankfurt, is the United States. The laws considered are Section 702 of the Foreign Intelligence Surveillance Act, Executive Order 12333, the CLOUD Act, and the Stored Communications Act, as limited by Executive Order 14086 of 7 October 2022 and as assessed by the European Commission in its Data Privacy Framework decision of 10 July 2023.

5.1 Signals intelligence

Section 702 can require an electronic communications service provider to assist in the targeting of a non-US person who is reasonably believed to be outside the United States, for foreign intelligence purposes. Executive Order 12333 covers collection outside the United States. Before 2022, the Court of Justice of the European Union held in C-311/18 (Schrems II) that the earlier US framework did not provide essentially equivalent protection, in particular because of bulk collection and the absence of a redress mechanism available to people in the EU.

Executive Order 14086 now binds US signals intelligence. It requires collection to be necessary and proportionate, it limits bulk collection to specified objectives, it provides for oversight by the Privacy and Civil Liberties Oversight Board and a Civil Liberties Protection Officer, and it creates a redress path through that officer and the Data Protection Review Court. The European Commission relied on those safeguards when it adopted the Data Privacy Framework adequacy decision. The safeguards in the order apply to US signals intelligence activities as such. They are not limited to companies that have certified under the framework. The adequacy decision itself covers only certified organizations. This assessment uses the order as a description of US law. It does not stretch the adequacy decision to the recipients in section 4.3.

5.2 Law-enforcement access, including data stored in the EU

The CLOUD Act and the Stored Communications Act allow a US legal process to compel a US provider to produce data in its possession, custody, or control, including data stored outside the United States. Render, as a US company, hosts the Frankfurt database. Google, as a US company, processes Gemini prompts. An order directed at either of them can reach that data. Encryption at rest does not stand in the way of such an order where the provider or Obert can decrypt the data. The application-level encryption on tokens and mailbox credentials uses keys held in the hosting environment, so it has the same limit against an order directed at Obert or Render.

That access is targeted legal process. It is a different regime from bulk signals intelligence. Clause 15 of the Standard Contractual Clauses requires the importer to notify the exporter of a government access request where the law allows it, and to challenge a request where there are grounds to do so. Obert's privacy policy states that personal data is disclosed to public authorities where the law requires it. Obert discloses only what the order compels, challenges an order where there is a reasonable ground and the law permits a challenge, and tells the affected customer where the law allows the customer to be told.

5.3 The European Essential Guarantees, applied to these transfers

Processing by public authorities has to rest on clear rules, be necessary and proportionate, be subject to independent oversight, and be open to an effective remedy. For signals intelligence, Executive Order 14086 and the Data Protection Review Court are the current US answer to those four guarantees, and the Commission has accepted that answer for certified organizations. For the non-certified recipients, the same rules of US law apply to any signals-intelligence demand, and the clauses add the notice and challenge duties in Clause 15.

The circumstances of these particular transfers narrow the practical exposure. The data is business contact data, account data, telemetry, and, where the customer uses the dialer, call content. It is not special-category data. The lead database is not replicated to the recipients in section 4.3. Each of them receives the slice required for its function: an authentication record, a trace, an enrichment query, a public-web query, or a website-visitor identification. Sentry, PostHog, Twilio, Apollo, Stripe, Resend, Render, and Google are on the Data Privacy Framework list, so their transfers are not in the Clause 14 population.

On those facts, Obert has no reason to believe that US law and practice prevent the section 4.3 importers from fulfilling the Standard Contractual Clauses. The residual risk is a lawful, individualized order. That risk is accepted. It does not, in these circumstances, impinge on the essence of the data subjects' rights in a way that would require the transfer to stop.

6. Supplementary measures

These measures are in place. They are described on the security page and in the Data Processing Agreement. They support the clauses. They are not a substitute for a missing transfer tool.

Obert previously held a SOC 2 attestation. It lapsed in June 2026. A renewal audit is in progress. This assessment does not rely on a current SOC 2 report.

7. Decision

The transfers may continue.

The transfer from an EEA or UK customer to Obert is covered by Israel's adequacy decision, and the store of record is in the EEA. Onward transfers to Unipile, Mailpool, and FullEnrich stay in the EEA. Onward transfers to Render, Google, Sentry, PostHog, Twilio, Stripe, Apollo, and Resend rely on those organizations' Data Privacy Framework certifications, for so long as the relevant listing stays active. Resend's EU and UK listings were active and under recertification review on the date of this assessment. Onward transfers to Descope, Logfire, Rapid, SerpApi, Firecrawl, and RB2B, and any United States access by Temporal, rely on the Standard Contractual Clauses and the UK Addendum. Section 5 is the Clause 14 assessment for that group.

No additional technical measure is required before these transfers continue. The Gemini configuration should be brought into line with the Data Processing Agreement, as set out in section 8. Until that change is made, the Data Privacy Framework certification of Google LLC is the tool that covers Gemini prompts, and the Frankfurt description in the DPA should be read together with section 4.2 of this assessment.

8. Review

Obert will review this assessment at least once a year, and sooner if any of the following happens: a sub-processor is added or changes its processing country; a Data Privacy Framework listing relied on above ceases to be active; the Gemini endpoint changes; or there is a material change in US, EU, or UK law on international transfers. The next scheduled review is 25 October 2027. The owner is privacy@obert.io.

The review will also cover one alignment item. The Data Processing Agreement describes Google Cloud and Gemini as processing in Frankfurt. The production Vertex client uses the global endpoint. Obert will either pin that processing to an EU region or amend the Data Processing Agreement so the published location matches the configuration.

9. Sources

10. Publication

This assessment is published by VENDI AI LTD and is effective on 25 October 2026. Questions about it go to privacy@obert.io.