Terms of Use

1. Initial Provisions

1.1. Agreement

This Data Processing Addendum (the "DPA"), including its annexes and the Standard Contractual Clauses (as applicable), forms part of and is incorporated by reference into the Agreement between the Provider and the Customer governing the use of the Services.

1.2. Acceptance

By entering into the Agreement, the Customer acknowledges that it has read and understood this DPA and agrees to be bound by its terms.

2. Definitions

Capitalized terms not defined in this DPA will have the meaning assigned to them in the Agreement.

“Account Data” means Personal Data related to the Customer’s relationship with the Provider, including data used to access the Customer’s account, billing details, identity verification, support, service optimization, and legal compliance.

“Applicable Data Protection Legislation” means all applicable privacy and data protection laws governing the processing of Personal Data under the Agreement, including but not limited to:
(a) the EU General Data Protection Regulation (Regulation 2016/679) (“GDPR”);
(b) the UK GDPR and Data Protection Act 2018 (“UK Data Protection Laws”);
(c) the Swiss Federal Data Protection Act and related regulations (“Swiss DPA”);
(d) the California Consumer Privacy Act and California Privacy Rights Act (collectively, “CCPA and CPRA”);
(e) the Australian Privacy Act 1988 and the Australian Privacy Principles;

in each case, as amended or replaced.

“CCPA and CPRA” means the California Consumer Privacy Act of 2018, the California Privacy Rights Act of 2020, and all applicable implementing regulations, as amended.

“Controller” means the entity that determines the purposes and means of processing Personal Data. This includes equivalents under relevant law, such as “Business” under the CCPA.

“Customer Personal Data” means any Personal Data processed by the Provider as a Processor on behalf of the Customer in the course of providing the Services.

“Europe” means the European Economic Area (EEA), the United Kingdom (UK), Switzerland, and any country recognized as providing adequate protection for personal data by the relevant regulatory body.

“GDPR” means Regulation (EU) 2016/679 of the European Parliament and Council.

“Personal Data” means any information relating to an identified or identifiable natural person, as defined under Applicable Data Protection Legislation.

“Processor” means an entity that processes Personal Data on behalf of a Controller, including equivalent terms under local legislation (e.g., “Service Provider” under the CCPA).

“Processing” means any operation performed on Personal Data, whether or not by automated means, including collection, recording, use, disclosure, storage, alteration, and destruction.

“Restricted Transfer” means:
(i) under the GDPR, a transfer of Personal Data from the EEA to a country without an adequacy decision;
(ii) under UK GDPR, a transfer from the UK to a non-adequate country;
(iii) under the Swiss DPA, a transfer to a country not deemed adequate by the Swiss FDPIC.

“Security Breach” means any accidental, unauthorized, or unlawful access to, disclosure of, or destruction of Customer Personal Data. This excludes unsuccessful attempts that do not compromise data security (e.g., failed login attempts or port scans).

“Standard Contractual Clauses” or “SCCs” means:
(i) for the GDPR, the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914;
(ii) for UK transfers, the UK Addendum or other approved clauses;
(iii) for Swiss transfers, the clauses approved by the Swiss Federal Data Protection and Information Commissioner.

These may be updated, replaced, or superseded from time to time.

“Sub-processor” means any Processor engaged by the Provider (or by a Provider affiliate) to process Customer Personal Data on its behalf. Sub-processors do not include Provider employees or contractors.

“Third Party Request” means any request from a data subject, supervisory authority, or other third party related to the processing of Customer Personal Data.

“UK Addendum” means the UK’s International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner’s Office under s.119A(1) of the Data Protection Act 2018.

3. Applicability and Scope

3.1. Applicability 

This DPA applies solely to the extent that the Provider processes Personal Data on behalf of the Customer and such processing is subject to Applicable Data Protection Legislation.

3.2. Scope 

The subject matter of the processing is the provision of the Services as described in the Agreement. The processing will continue for the duration of the Agreement. Details regarding the nature and purpose of the processing, types of Personal Data, and categories of data subjects are set forth in Schedule A (Details of Processing).

3.3. Provider as a Processor

The parties acknowledge that, with respect to Customer Personal Data, the Customer may act either as a controller or a processor, and the Provider will act solely as a processor. The Provider will process such data in accordance with the Customer’s documented instructions, as further described in this DPA.

3.4. Provider as a Controller of Account Data

The parties acknowledge that with respect to Account Data, the Customer is a controller and the Provider is an independent controller. The Provider will process Account Data:
(a) to manage its business relationship with the Customer;
(b) to carry out internal administrative and business operations;
(c) to detect, prevent, or investigate security incidents, fraud, or abuse of the Services;
(d) to perform identity verification;
(e) to comply with legal and regulatory obligations; and
(f) as otherwise permitted under Applicable Data Protection Legislation, this DPA, the Agreement, and the Provider’s Privacy Policy.

4. Provider as a Processor

4.1. Customer Instructions

The Customer appoints the Provider as a Processor to process Customer Personal Data on its behalf, solely as necessary:
(a) as set forth in the Agreement and this DPA;
(b) to provide the Services, including detecting and preventing exploits, abuse, or security incidents;
(c) to comply with applicable law, including Applicable Data Protection Legislation;
(d) as otherwise agreed in writing by the parties (together, the “Permitted Purposes”).

4.2. Lawfulness of Instructions 

The Customer shall ensure that its instructions to the Provider comply with all Applicable Data Protection Legislation. The Customer acknowledges that the Provider is not responsible for determining which laws apply to the Customer’s business or whether the Services meet those legal requirements. If the Provider believes that any instruction violates applicable law, it will notify the Customer without undue delay.

4.3. Additional Instructions

Any processing instructions not expressly authorized by this DPA or the Agreement must be agreed to in writing by both parties in advance.

4.4. Purpose Limitation

The Provider will process Customer Personal Data solely for the Permitted Purposes. Additional details, including the nature and purpose of the processing, categories of data subjects, and types of Personal Data, are set forth in Schedule A (Details of Processing).

4.5. Responding to Third Party Requests 

If the Provider receives a Third Party Request directly related to Customer Personal Data, it shall notify the Customer without undue delay and provide all relevant details, unless legally prohibited. The Provider will not respond to such requests without the Customer’s prior written consent, unless required by law or to confirm that the request pertains to the Customer.

5. Compliance

The Customer is solely responsible for ensuring the legality of the processing of Customer Personal Data under the Agreement. In particular, the Customer represents and warrants that:

(a) all necessary notices have been provided to, and all required consents and authorizations have been obtained from, data subjects as required by Applicable Data Protection Legislation to permit the Provider (and its affiliates and Sub-processors) to process Customer Personal Data as described in the Agreement and this DPA;
(b) it has complied, and will continue to comply, with all applicable laws, rules, and regulations relating to data protection and privacy, including Applicable Data Protection Legislation;
(c) it has, and will continue to have, the legal right to transfer (or provide access to) Customer Personal Data to the Provider for processing in accordance with the terms of this DPA and the Agreement.

6. Subprocessors

6.1. Authorization for Sub-processing

The Customer authorizes the Provider to engage Sub-processors, including its affiliates and third parties, to process Customer Personal Data on the Provider’s behalf as necessary to provide the Services. The current list of Sub-processors is available on the Provider’s Sub-processor Page, which may be updated from time to time. This authorization is subject to the following conditions:
(a) The Provider will ensure that any Sub-processor only accesses Customer Personal Data as necessary to perform its obligations and is prohibited from using such data for any other purpose.
(b) The Provider will impose data protection terms on each Sub-processor that are no less protective than those set out in this DPA, including obligations regarding appropriate technical and organizational measures.
(c) The Provider will remain fully liable for any breach of this DPA caused by the acts or omissions of its Sub-processors.

6.2. Current Sub-processors

The Customer acknowledges that the provision of the Services may require the processing of Customer Personal Data by Provider affiliates and Sub-processors located outside Europe, including in the United States. The Customer hereby authorizes such transfers, subject to the Provider’s compliance with the terms of this DPA, including Schedule C (List of Sub-processors).

6.3. Notification of Sub-processor Changes

The Provider will notify the Customer of any intended additions or replacements to the Sub-processor Page at least ten (10) days in advance, either through the Services or via email. If the Customer has a reasonable objection to the proposed change based on data protection concerns, it must notify the Provider in writing within thirty (30) calendar days of the notice. The Provider will then work in good faith to address the Customer’s concerns. If no resolution is reached, the Customer may terminate the Agreement without penalty.

7. Impact Assessments and Consultations

To the extent required by Applicable Data Protection Legislation, the Provider will provide the Customer with reasonable assistance—at the Customer’s cost and expense—for the performance of data protection impact assessments or prior consultations with supervisory authorities, in each case solely in relation to the Provider’s processing of Customer Personal Data under the Agreement and this DPA.

8. Security

8.1. Security Measures

The Provider will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against Security Breaches. These measures will, at a minimum, comply with applicable law and include those described in Schedule B (Technical and Organizational Security Measures). The Customer acknowledges that such measures may evolve over time due to technical progress, and the Provider may update them as necessary—provided that any updates do not materially reduce the overall level of protection for Customer Personal Data.

8.2. Personnel Confidentiality

The Provider will ensure that any individual authorized to process Customer Personal Data (including employees, agents, and subcontractors) is subject to a binding duty of confidentiality with respect to that data.

8.3. Security Breach Notification

In the event of a Security Breach involving Customer Personal Data, the Provider will notify the Customer without undue delay after becoming aware of the breach. The Provider will provide the Customer with reasonable information related to the breach to assist in meeting any legal or regulatory reporting obligations. Notification of or response to a Security Breach by the Provider does not constitute an admission of fault or liability.

8.4. Customer Responsibilities

The Customer is solely responsible for:
(a) configuring and using the Services in a manner that ensures an appropriate level of security based on the nature of the Customer Personal Data;
(b) securing all credentials, systems, and devices used to access the Services;
(c) backing up Customer Personal Data where appropriate.

9. Return or Deletion of Customer Personal Data

Upon termination or expiration of the Agreement, the Provider will, at the Customer’s election, either delete or return all Customer Personal Data (including any copies) in its possession or control as soon as reasonably practicable, and in any event within thirty (30) days. This obligation will not apply to the extent the Provider is required by applicable law to retain some or all of the Customer Personal Data, or to data archived on back-up systems. In such cases, the Provider will securely isolate and protect such data from further processing, except as required by applicable law.

10. Audits

10.1. Acknowledgment

The parties acknowledge that, where the Provider is acting as a Processor on behalf of the Customer, the Customer must be able to assess the Provider’s compliance with its obligations under Applicable Data Protection Legislation and this DPA.

10.2. Audit Reports and Certifications

Upon written request and at no additional cost to the Customer, the Provider will make available to the Customer (or the Customer’s designated, appropriately qualified third-party representative) documentation reasonably necessary to demonstrate compliance with this DPA. This may include summaries of relevant audit reports or industry-standard certifications, to the extent such information is available and applicable.

10.3. Customer-Initiated Audit

If the Customer requires a direct audit of the Provider’s data processing practices, the Provider will allow such audit subject to the following terms:
(a) The audit must be requested in writing and conducted at the Customer’s cost, including any internal costs incurred by the Provider.
(b) The scope, duration, and timing of the audit must be mutually agreed upon in advance, and the audit must be conducted in a manner that minimizes disruption to the Provider’s business.
(c) Any audit must be limited to one occurrence per twelve (12) month period, unless otherwise required by a competent supervisory authority or in the event of a Security Breach.
(d) The audit may only access information relevant to the Customer.
(e) The Customer may use a third-party auditor, provided such auditor is not a direct competitor of the Provider and is subject to confidentiality obligations. The Provider may reject an auditor on reasonable grounds and require the Customer to appoint another.

For clarity, the exercise of audit rights under the Standard Contractual Clauses will be carried out in accordance with this Section 10.3.

11. Transfers

11.1. Location of Processing

The Customer acknowledges that the Provider and its Sub-processors may process and transfer Customer Personal Data to the United States and other jurisdictions in which the Provider, its affiliates, or Sub-processors operate, as further detailed on the Sub-processor Page. The Provider will ensure that such transfers comply with Applicable Data Protection Legislation and this DPA.

11.2. Transfer Mechanism

When a transfer of Customer Personal Data from the Customer (as “data exporter”) to the Provider (as “data importer”) constitutes a Restricted Transfer, the parties agree that such transfer will be subject to an appropriate safeguard as required under Applicable Data Protection Legislation. Unless otherwise agreed, the parties will rely on:

• The Provider’s certification under the EU-U.S. Data Privacy Framework, the UK-U.S. Data Bridge, and the Swiss-U.S. Data Privacy Framework (collectively, the “DPF”) administered by the U.S. Department of Commerce.

• If the DPF is invalidated or deemed insufficient, the parties will use the applicable Standard Contractual Clauses (SCCs), incorporated into and forming part of this DPA.

The SCCs shall apply as follows:

(a) Transfers under the GDPR (Customer Personal Data):

• Module Two or Three (as applicable) of the EU SCCs will apply.

• Clause 7: The optional docking clause applies.

• Clause 9: Option 2 applies, with the notice period for changes to Sub-processors set out in Section 6.3 of this DPA.

• Clause 11: The optional language does not apply.

• Clause 17: Option 1 applies; Irish law governs if no Member State law applies.

• Clause 18(b): Disputes shall be resolved in the EU Member State of the data exporter, or Ireland by default.

• Annexes I and II of the SCCs are completed as set out in Schedules A and B of this DPA.

(b) Transfers under the GDPR (Account Data under Section 3.4):

• Module One of the EU SCCs will apply.

• Clause 7: Optional docking clause applies.

• Clause 11: Optional language does not apply.

• Clause 17: Irish law applies.

• Clause 18(b): Disputes shall be resolved in Ireland.

• Annexes I and II are completed as set out in Schedules A and B.

(c) Transfers under the UK GDPR and Swiss DPA:

• References to GDPR are interpreted under UK Privacy Laws or the Swiss DPA.

• References to the EU, Union, or Member States are interpreted as UK or Switzerland.

• Clause 13(a) and Annex I.C do not apply.

• Supervisory authorities and courts are the UK Information Commissioner or Swiss FDPIC and the courts of England and Wales or Switzerland, as applicable.

• Clause 17: Governed by English law or Swiss law.

• Clause 18: Adjusted per UK or Swiss law as outlined above.

(d) UK Addendum (where applicable):

Where SCCs under paragraph (a) cannot lawfully be used for UK Restricted Transfers, the UK SCCs shall apply, completed using the information in Schedules A and B. Table 4 of the UK Addendum shall indicate "neither party" may make changes unilaterally.

11.3. SCC Conflict

If any provision in this DPA or the Agreement conflicts with the Standard Contractual Clauses, the SCCs shall prevail.

11.4. Alternative Transfer Mechanism

If the Provider adopts another lawful transfer mechanism (e.g. an updated version of the SCCs or DPF), such mechanism will apply in place of those specified above upon notice to the Customer, provided the mechanism complies with applicable data transfer requirements.

12. Cooperation and Data Subject Rights

12.1. Data Subject Rights

The Provider offers the Customer self-service tools within the Services to assist in meeting obligations under Applicable Data Protection Legislation. These features may include, without limitation, tools to delete, access, or restrict the use of Customer Personal Data. The Customer may use such features at no additional cost to respond to Third Party Requests, such as data subject access or deletion requests.

Upon written request from the Customer, and to the extent the Customer cannot reasonably fulfill its obligations using the available tools, the Provider will provide reasonable assistance—taking into account the nature of the processing and the information available to the Provider—to support the Customer in responding to data subject rights requests under Applicable Data Protection Legislation. Such assistance may be subject to a reasonable, documented fee.

If the Provider receives a data subject request directly and can reasonably identify the Customer as the Controller, the Provider will notify the Customer without undue delay and will not respond to the request except to confirm receipt and refer the requestor to the Customer, unless otherwise required by law. The Customer will be solely responsible for responding to and fulfilling such requests.

12.2. Cooperation

If either party receives (a) a request from a data subject to exercise any rights under Applicable Data Protection Legislation, or (b) a Third Party Request relating to the other party’s data processing activities under this DPA, that party will promptly notify the other in writing (to the extent legally permitted). Both parties will cooperate in good faith to respond to and resolve such requests in a timely and compliant manner.

13. No Sale or Sharing

To the extent the processing of Customer Personal Data is subject to U.S. data protection laws (including but not limited to the CCPA and CPRA), the Provider certifies and agrees that it shall not:

• Sell Customer Personal Data or otherwise make it available to any third party for monetary or other valuable consideration;

• Share Customer Personal Data with any third party for purposes of cross-context behavioral advertising or targeted advertising;

• Retain, use, or disclose Customer Personal Data for any purpose other than as necessary to perform the business purposes specified in this DPA or as otherwise permitted under applicable U.S. data protection laws;

• Retain, use, or disclose Customer Personal Data outside of the direct business relationship between the Customer and the Provider; or

• Combine Customer Personal Data with personal data that the Provider receives from or on behalf of another person or entity, or collects independently, except as permitted under applicable U.S. data protection laws.

The Provider will promptly notify the Customer if it determines that it can no longer meet its obligations under applicable U.S. data protection laws.

14. Miscellaneous

14.1. Precedence

In the event of any conflict or inconsistency between this DPA and the Agreement, the terms of this DPA shall prevail. The order of precedence shall be: (a) this DPA; (b) the Agreement; and (c) the Provider’s Privacy Policy. In the event of a conflict between the Standard Contractual Clauses and any other terms in this DPA, the Agreement, or the Privacy Policy, the Standard Contractual Clauses shall control to the extent of the conflict.

14.2. Replacement

This DPA supersedes and replaces any prior data processing agreements or addenda previously entered into between the parties in connection with the Services.

14.3. Claims

Any claims arising in connection with this DPA shall be subject to the terms, conditions, limitations, and exclusions of liability set forth in the Agreement.

14.4. Data Subject Rights

Nothing in this DPA shall be construed to restrict or limit the rights of any data subject or any competent supervisory authority under Applicable Data Protection Legislation.

14.5. Compliance with Higher Standards 

In the event of an actual or perceived conflict among Applicable Data Protection Legislation, the parties agree to comply with the more stringent standard, which shall be determined solely by the Provider in the event of a dispute.

14.6. Updates

Notwithstanding anything to the contrary in the Agreement, the Provider reserves the right to modify this DPA as necessary to comply with changes to Applicable Data Protection Legislation. The Provider will notify the Customer of any material updates.

14.7. No Consideration

The parties acknowledge that access to Customer Personal Data by the Provider does not form part of the consideration under the Agreement or any related order form.

14.8. No Third-Party Rights

This DPA does not confer any rights or remedies upon any third party, including any Third-Party Controller, except as expressly provided under Data Protection Laws (including rights for Data Subjects under the DPF or SCCs).

Schedule A

Schedule A(1) List of Parties:

Data Exporter

Data Importer

Name: Customer, as identified in the Order Form

Name: Provider, as identified in the Agreement

Address: As identified in the Order Form

Address: As identified in the Agreement

Contact details: As identified in the Order Form

Contact details: As identified in the Agreement

Activities relevant to the transfer: See Schedule A(2) below

Activities relevant to the transfer: See Schedule A(2) below

Role: Controller

Role: Processor

Schedule A(2): Description of Transfer

Categories of data subjects:

• Permitted Users – any of Customer's employees or other personnel, suppliers, and other third parties authorized under the Agreement to use the Services.

• Third Parties – employees, contractors, business partners, customers, or other individuals whose Personal Data is stored, transmitted to, made available to, accessed, or otherwise processed by Provider.

Categories of personal data:

• Permitted Users – contact data.

• Third Parties – contact data.

Sensitive data (special categories of personal data):

The Provider does not require any special categories of data to provide the Services and does not intentionally collect or process such data in connection with the provision of the Services.

Frequency of the transfer: Continuous

Nature and subject matter of the processing:

The Personal Data may be subject to the following processing activities:

• Storage (hosting) and other processing necessary to provide, maintain, and improve the Services provided to the Customer under the Agreement;

• Technical support provided to the Customer on a case-by-case basis;

• Disclosures in accordance with the Agreement and this DPA, as compelled by law;

• Collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
  
  
  

Duration of the processing:

Processing Term (i.e., for the duration of the Agreement unless otherwise required by law)

Purpose(s) of the data transfer and further processing:

(i) To provide, maintain, support, and improve the Services provided to the Customer in accordance with the Agreement;
(ii) Processing initiated by Permitted Users in their use of the Services;
(iii) Processing to comply with other documented, reasonable instructions provided by the Customer (e.g., via email), where such instructions are consistent with the terms of the Agreement (including this DPA)

Retention period (or criteria used to determine it):

Processing Term, unless otherwise required by applicable law

Schedule A(3): Competent Supervisory Authority

With respect to EU Data, the competent supervisory authority is:
The Office of the Information Commissioner of Ireland (the “Supervisory Authority”)

Schedule B

Technical and Organizational Measures

The technical and organizational measures implemented by the Provider to ensure an appropriate level of security, taking into account the nature, scope, context, and purposes of the processing, and the risks to the rights and freedoms of natural persons, include the following:

• Infrastructure: Provider’s platform is built and hosted on Amazon Web Services (AWS), benefiting from the robust security infrastructure and protocols maintained by AWS.

• Security certifications: AWS maintains industry-recognized certifications such as ISO 27001, SOC 1/2/3, and PCI-DSS, which extend to the underlying infrastructure used by the Provider.

• Best practices: Provider follows AWS-recommended security best practices for secure configuration, access control, encryption, and monitoring.

• Access controls: Role-based access controls (RBAC), least privilege principles, and multi-factor authentication are enforced internally to limit access to Customer Personal Data.

• Data protection: Customer Personal Data is encrypted both in transit (TLS 1.2 or higher) and at rest (AES-256).

• Monitoring & incident response: The Provider maintains automated monitoring and alerting systems. In the event of a suspected security incident, the Provider follows a documented incident response procedure to mitigate, respond to, and notify affected parties in accordance with this DPA.

• Employee training & confidentiality: Employees with access to Customer Personal Data undergo regular security awareness training and are bound by confidentiality agreements.

• Vendor & sub-processor controls: All sub-processors and service providers are subject to due diligence and contractual obligations consistent with the security commitments outlined in this Schedule B.

More details on the security and compliance standards applicable to AWS infrastructure can be found at: https://aws.amazon.com/compliance

Schedule C

Approved Sub-processors

As of the Effective Date, the following Sub-processor is authorized by the Customer for use by the Provider in accordance with Section 6 (Subprocessors) of this DPA:

• Sub-processor: Amazon Web Services, Inc.

• Address: 410 Terry Avenue North, Seattle, WA 98109-5210, United States

• Purpose: Hosting services for the Provider’s Platform

• Location of Processing: United States (primary region)

The Provider may update this list in accordance with the notification and objection procedures set forth in Section 6.3 of this DPA. An up-to-date list of Sub-processors is maintained by the Provider and made available to the Customer upon request or through the Provider’s Platform.

Schedule D

UK Addendum to the EU Commission Standard Contractual Clauses

Effective Date

This Addendum becomes effective on the same date as the Data Processing Addendum (DPA).

Background

The UK Information Commissioner considers this Addendum to provide appropriate safeguards under Article 46 of the UK GDPR for transfers of personal data to third countries or international organizations, including transfers from controllers to processors or between processors.

Definitions

For purposes of this Addendum:

• “This Addendum” refers to the UK Addendum to the Clauses.

• “The Annex” refers to the Standard Contractual Clauses annexed to the European Commission’s Implementing Decision (EU) 2021/914 of 4 June 2021.

• “UK Data Protection Laws” refers to all data protection, privacy, and electronic communications laws in force in the UK from time to time, including the UK GDPR and the Data Protection Act 2018.

• “UK GDPR” means the General Data Protection Regulation as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018.

• “UK” means the United Kingdom of Great Britain and Northern Ireland.
  
  
  

Interpretation

This Addendum shall be interpreted:

• In accordance with UK Data Protection Laws.

• To ensure it provides the appropriate safeguards required by Article 46 of the UK GDPR.

• To avoid conflict with the rights and obligations set forth in UK Data Protection Laws.

• To account for legislative changes over time, including any re-enactments or replacements of cited laws.

Hierarchy

In the event of conflict between this Addendum and the Clauses or any related agreements, the provision offering the greatest protection to data subjects will prevail.

Incorporation and Application of the Clauses

This Addendum incorporates the Clauses, which are deemed amended as necessary to operate under UK Data Protection Laws and to provide appropriate safeguards, including:

• Transfers from the data exporter to the data importer, where UK Data Protection Laws apply.

• Transfers requiring appropriate safeguards under Article 46 of the UK GDPR.
  
  

Required Amendments to the Clauses

The Clauses are amended as follows:

• References to “the Clauses” shall be interpreted to mean this Addendum including the incorporated Clauses.

• Clause 6 is replaced with: “The details of the transfer(s) are those specified in Annex I.B where UK Data Protection Laws apply.”

• References to “Regulation (EU) 2016/679” are replaced with “UK Data Protection Laws”; specific articles are adjusted accordingly.

• References to Regulation (EU) 2018/1725 are removed.

• “Union”, “EU”, and “EU Member State” are replaced with “UK”.

• Clause 13(a) and Part C of Annex II are not used; the competent supervisory authority is the UK Information Commissioner.

• Clause 17 is replaced with: “These Clauses are governed by the laws of England and Wales.”

• Clause 18 is replaced with: “Any dispute shall be resolved by the courts of England and Wales. A data subject may also bring proceedings in any UK jurisdiction. The parties agree to submit to the jurisdiction of such courts.”

• All footnotes to the Clauses are excluded from this Addendum.
  
  
  

Amendments to this Addendum

The parties may:

• Modify Clauses 17 and 18 to refer to the laws and courts of Scotland or Northern Ireland.

• Agree to amendments to this Addendum that maintain appropriate safeguards under Article 46 of the UK GDPR.
  
  

Execution of the Addendum

The Addendum may be executed in any legally binding manner, including:

• Attaching this Addendum as a schedule to the DPA.

• Incorporating signature language in Annex 1A such as:

  • “By signing, we agree to be bound by the UK Addendum to the EU Commission Standard Contractual Clauses dated [insert date].”

• Executing the Clauses as amended in accordance with this Addendum.