Hi Railway team,

We're EMAVIC Global Concept (EMAVIC GLOBAL CONCEPT LTDA), a Brazilian-registered company. Our platform processes personal data of Brazilian data subjects, including minors, and is subject to Brazil's LGPD (Lei Geral de Proteção de Dados) in addition to any GDPR obligations.

We've reviewed the DPA at railway.com/legal/dpa, which covers GDPR Article 28 obligations. Before relying on Railway for hosting personal data subject to LGPD, we need three specific things confirmed:

1. Will Railway execute the ANPD-approved Standard Contractual Clauses (per Brazilian Resolution CD/ANPD No. 19/2024) as data importer, in addition to or alongside the existing DPA? These are distinct from the EU SCCs and are the specific mechanism required for lawful transfers under Brazilian law.

2. What is the guaranteed physical hosting region for our project's database and compute? We need confirmation this is exclusively US-based (or wherever it actually is), not subject to change without notice.

3. Can you provide a current sub-processor list? We need to confirm whether any sub-processors introduce additional data transfer legs beyond the primary hosting jurisdiction.

Given we're processing children's data, we need documented answers to these three points for our own compliance file, not just a general reference to the GDPR DPA. Happy to sign an NDA via the Trust Center if that's needed to get specifics.

Thanks,

Olawale.

EMAVIC Global Concept