.article_rich-text > h2, .article_rich-text > h3{counter-reset:dcaN}.article_rich-text > ol{list-style:none!important;display:block!important;margin:1rem 0 1.25rem!important;padding-left:0!important}.article_rich-text > ol > li{counter-increment:dcaN!important;position:relative!important;padding-left:2rem!important;margin:.4rem 0!important;list-style:none!important}.article_rich-text > ol > li::before{content:counter(dcaN) "."!important;position:absolute!important;left:.25rem!important;top:0!important;font:inherit!important;color:inherit!important}.article_rich-text > ol > li > ol{list-style:none!important;display:block!important;counter-reset:dcaA;margin:.45rem 0!important;padding-left:0!important}.article_rich-text > ol > li > ol > li{counter-increment:dcaA!important;position:relative!important;padding-left:2rem!important;margin:.35rem 0!important;list-style:none!important}.article_rich-text > ol > li > ol > li::before{content:counter(dcaA, lower-alpha) "."!important;position:absolute!important;left:.25rem!important;top:0!important;font:inherit!important;color:inherit!important}.article_rich-text blockquote{background:none!important;min-height:0!important;margin:.5rem 0 .6rem 1rem!important;padding:0 0 0 .9rem!important;border-left:3px solid #d0d5dd!important;font-size:inherit!important;line-height:inherit!important;color:#333!important}.article_rich-text blockquote::before{display:none!important;content:none!important}.article_rich-text blockquote p{margin:0!important;color:inherit!important;font-size:inherit!important;line-height:inherit!important}

.article_rich-text{font-family:inherit;color:inherit}
.article_rich-text h2{margin:2.25rem 0 1rem;font-size:1.6rem;line-height:1.25}
.article_rich-text h3{margin:1.75rem 0 .75rem;font-size:1.2rem;line-height:1.3}
.article_rich-text p,.article_rich-text li{line-height:1.55}
.article_rich-text p{margin:.75rem 0}
.article_rich-text ul,.article_rich-text ol{margin:.75rem 0 1rem 1.5rem;padding-left:1.25rem}
.article_rich-text li{margin:.4rem 0;padding-left:.2rem}
.article_rich-text .dpa-definition{margin-left:1.25rem}
.article_rich-text blockquote{margin:1rem 1.5rem;padding-left:1rem;border-left:3px solid #d9d9d9;font-size:inherit;line-height:inherit}
.article_rich-text table{width:100%;border-collapse:collapse;margin:1.25rem 0 1.5rem;font-size:.95rem}
.article_rich-text th,.article_rich-text td{border:1px solid #d9d9d9;padding:.65rem .7rem;vertical-align:top;text-align:left}
.article_rich-text th{background:#34495e;color:#fff;font-weight:700}
.article_rich-text tr:nth-child(even) td{background:#f7f9fb}
.article_rich-text .dpa-table-0 td:first-child,.article_rich-text .dpa-table-5 td:first-child{background:#eef2f5;color:#111;font-weight:700}

This Pindrop Pulse® for Calls Data Protection Agreement ("DPA") forms part of, and is incorporated into, the Pindrop Pulse® for Calls Terms of Service or such other written agreement between Pindrop and Company governing Company's access to and use of the Product (as applicable, the "main Terms") between Pindrop Security, Inc. ("Pindrop") and the entity identified as "Company" in the applicable Order ("Company"). References in this DPA to the "Terms" mean the main Terms together with this DPA and the other documents incorporated into the main Terms, and the Terms and each applicable Order are collectively referred to as the "Agreement." This DPA governs Pindrop's Processing of Personal Data on behalf of Company in connection with the Product known as Pindrop Pulse® for Calls and related services. To the extent of any conflict between this DPA and the main Terms with respect to the Processing of Personal Data, this DPA shall control. This DPA is not a standalone agreement and may not be terminated independently of the main Terms. Except as expressly modified by this DPA, the provisions of the main Terms (including, by way of example only, those relating to confidentiality, limitation of liability, indemnification, governing law, dispute resolution and general terms) apply to this DPA with the same force and effect as if this DPA were included as an annex in the main Terms. Capitalized terms used but not defined in this DPA have the meanings given to them in the main Terms.

This DPA includes, as an attachment, the Standard Contractual Clauses for International Data Transfers (the "Standard Contractual Clauses"), which incorporate the EU Standard Contractual Clauses (Module 2: controller to processor) approved by the European Commission under Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum issued by the UK Information Commissioner and adaptations for transfers governed by the Swiss Federal Act on Data Protection. The Standard Contractual Clauses apply to the extent that Pindrop's provision of the Product and Services involves the transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction that does not benefit from an adequacy decision under applicable Data Protection Laws, and are intended to provide an appropriate legal basis for such transfers in accordance with the requirements of those laws.

1. Definitions.

In the event of a conflict between a definition in this DPA and the definition of an applicable term under relevant Data Protection Law (defined below), the definition under the relevant Data Protection Law shall govern.

(a) “Aggregate Data” means information that relates to a group or category of individuals, from which individual identities have been removed, that is not linked or reasonably linkable to any individual or household, including via a device.

(b) “Data Protection Law(s)” means any applicable national, state or federal Laws for the protection, privacy, and/or processing of Personal Data, including any amendment or re-enactment of the foregoing, to which Company or Pindrop are subject.

(c) “Deidentified Data” means information that cannot reasonably identify, be related to, describe, be capable of being associated with, or linked, directly or indirectly, to a particular individual, and “Deidentified” shall refer to the process to make any information Deidentified Data.

(d) "EU Standard Contractual Clauses" means the standard contractual clauses set out in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended or replaced from time to time by a competent authority under the relevant Data Protection Laws.

(e) “ISP” means the Pindrop Pulse® for Calls Information Security Program incorporated into the main Terms.

(f) “Personal Data” means information that: (i) identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device; and (ii) is made available to Pindrop by or on behalf of Company in connection with the Product and Services, and that Data Protection Laws define as “personal data,” “personal information,” “personally identifiable information” or similar term.

(g) "Personal Data Breach" means (i) a Security Breach (as defined in the ISP) with respect to Personal Data transmitted, stored or processed by the Product; and/or (ii) an accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, such Personal Data, as applicable.

(h) “Process”, “Processing”, or “Processed” means any operation or set of operations performed on Personal Data or on sets of Personal Data, whether automated or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

(i) “Processing Purpose” means the purpose for which Pindrop is Processing Personal Data as set forth in Section 2(c) of this DPA and shall also be deemed to mean a Business Purpose.

(j) “Processor” means an entity that Processes Personal Data on behalf of another entity. “Processor” includes similar terms under Data Protection Laws, such as the term “Service Provider,” as context requires.

(k) "Supervisory Authority" means: (i) in the United Kingdom, the Information Commissioner's Office (ICO) or any replacement body; (ii) an independent public authority which is established by a Member State pursuant to Article 51 GDPR; and (iii) any similar regulatory authority responsible for the enforcement of Data Protection Laws.

(l)"UK Standard Contractual Clauses" means: as applicable: (i) the EU Standard Contractual Clauses as amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (“UK Addendum”); or (ii) the International Data Transfer Agreement issued by the UK Information Commissioner, as amended or replaced from time to time ("UK IDTA"), in each case as amended or replaced from time to time.

(m) The terms “Business”, “Business Purpose”, “Controller", "sell” (and its cognates), “share” (and its cognates) and “Third Party” will have the meaning as ascribed to them or to similar terms under applicable Data Protection Laws.

2. Processing Description.

With respect to Pindrop’s provision of the Product and Services to Company pursuant to the Agreement:

(a) As between Pindrop and Company, Pindrop is a Service Provider and Processor with respect to any Personal Data that Pindrop Processes on behalf of Company (as a Business and Controller) pursuant to the Agreement.

(b) All Personal Data provided by or on behalf of Company to Pindrop is owned or licensed by Company. Unless otherwise expressly provided herein, nothing herein confers any rights or ownership in such Personal Data to Pindrop.

(c) Company has disclosed Personal Data to Pindrop and its subsidiaries for the following Processing Purposes: (1) detecting security incidents and/or the use in a Call of synthetic, modulated or other AI-generated or AI-manipulated speech or audio, detecting and classifying such activity, populating and using the Synthetic Call Database, and protecting against malicious, deceptive, fraudulent or other illegal or unauthorized activity; (2) as is reasonably necessary to support any other valid Processing Purposes that are part of the Product and Services so long as they are contemplated and authorized by the parties in the Agreement; and (3) analyzing Company Call Data to generate insights, identify trends, detect patterns, and improve business outcomes and Product performance for Company's benefit;

(d) Pindrop and Company acknowledge and confirm any disclosure of Personal Data pursuant to the Agreement is exclusively for the provision of the Product and Services under the Agreement and that Pindrop does not receive any Personal Data as monetary or other valuable consideration for the Product, any Services or other items provided under the Agreement;

(e) Company hereby instructs and authorizes Pindrop to Process Personal Data (including to transfer it internationally) in connection with Pindrop’s performance and exercise of its obligations and rights under the Agreement. Any additional or alternate instructions must be mutually agreed upon in writing; and

(f) The Personal Data to be Processed by Pindrop for the Processing Purposes are:

(i) Caller Data, including audio recordings, voice scans, and related metadata, and other data reasonably necessary to provide the Product functionality enabled by Company;

(ii) User Data: account details for Users, including name, work email address, user IDs and account creation date; and

(iii) Company Employee Data: business contact information for Company employees involved in Product implementation and operation (e.g., name, work email address, and telephone number).

This data relates to the following categories of data subjects: callers to Company's contact centers, Users, and Company employees involved in Product implementation and operation. An individual may fall into more than one category, and the Personal Data Processed will be determined by each applicable category.

3. Permitted Use and International Transfers.

(a) Pindrop will only collect, use, retain, disclose and otherwise Process Personal Data solely: (1) for the Processing Purposes described above and its performance of the Agreement, including in support of Pindrop’s and its subsidiaries' internal operations as necessary to the provision of the Product and Services for Company; (2) on Company’s behalf and in accordance with Company’s documented, written instructions; (3) for its internal use to build or improve the quality of the Product and Services, including through analysis of Company Call Data using AI Tools to generate insights and recommendations and through the Synthetic Call Database, provided that such use is authorized in the Agreement and Pindrop will not use the Personal Data to perform services on behalf of another person; or (4) as otherwise necessary for compliance with applicable Laws. Pindrop will not: (i) sell or share Personal Data; (ii) retain, use, or disclose Personal Data outside the direct business relationship between Pindrop and Company; or (iii) retain, use, or disclose Personal Data for any unauthorized commercial purpose. Pindrop will not combine Personal Data received from Company with personal data received from another person or collected through Pindrop's own interactions with an individual, except to the extent permitted by applicable Data Protection Laws and reasonably necessary to provide the Product and Services, detect data security incidents, or protect against fraudulent or illegal activity. Pindrop's rights to Process data for authorized Product Optimization Purposes under the main Terms are subject to and limited by the restrictions in this Section 3(a). Pindrop certifies that it understands and will comply with the restrictions set forth in this Section 3(a). If Pindrop determines that it can no longer comply with these restrictions, Pindrop will promptly notify Company, and Company may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data. For clarity, Pindrop may retain, use, or otherwise Process certain Personal Data (and combine it with Personal Data from other clients) as reasonably necessary to detect data security incidents, detect human versus machine speech, populate or use the Synthetic Call Database, or protect against fraudulent or illegal activity. Where Pindrop is required to Process any new Company Call Data which is also Personal Data for compliance with applicable Laws after the effective date of the Agreement, it will notify the Company of such obligation before commencing Processing, unless prohibited by such Law.

(b) To the extent Pindrop's provision of the Product and Services involves the transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction that does not benefit from an adequacy decision under the applicable Data Protection Laws, the following transfer mechanisms apply: (i) for transfers subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679), the EU Standard Contractual Clauses (Module 2: controller to processor) as set forth in the Standard Contractual Clauses; (ii) for transfers subject to UK Data Protection Laws (as defined in the UK Addendum), the EU Standard Contractual Clauses as supplemented by the UK Addendum, as set forth in the Standard Contractual Clauses; and (iii) for transfers subject to the Swiss Federal Act on Data Protection ("Swiss FADP"), the EU Standard Contractual Clauses as adapted in accordance with the guidance of the Swiss Federal Data Protection and Information Commissioner ("FDPIC"), as set forth in the Standard Contractual Clauses. The Company entity identified in the applicable Order is deemed the data exporter, and Pindrop Security, Inc. is the data importer. The effective date of the applicable transfer mechanism is the effective date of the applicable Order. In the event of any conflict between the terms of this DPA and the Standard Contractual Clauses with respect to the transfer of Personal Data, the Standard Contractual Clauses shall prevail to the extent of such conflict. Pindrop shall not otherwise transfer Personal Data outside of the European Economic Area, the United Kingdom, or Switzerland except where permitted under the Agreement and provided that such international transfer is carried out in accordance with applicable Data Protection Laws (including, where required, implementing an appropriate lawful transfer mechanism such as the EU Standard Contractual Clauses, UK Standard Contractual Clauses, or other recognized safeguard).

4. Confidentiality.

Pindrop will ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data and are subject to a duty of confidentiality with respect to Personal Data.

5. Subprocessors.

(a) Company agrees to and authorizes Pindrop to disclose Personal Data to, and permit the Processing (including the international transfer) of, Personal Data by, those subprocessors used to deliver and perform its obligations under the Agreement (the subprocessors as of the effective date of the Agreement being the "Approved Subprocessors"). A copy of Pindrop’s current subprocessors is available upon request.

(b) Pindrop will provide Company with a minimum of 30 days prior notice (which may be provided by email) of the addition or replacement of an In-Scope Subprocessor (defined below). Within such 30-day period, Company may object to the engagement of such In-Scope Subprocessor on reasonable, documented grounds relating to data protection, information security, or a legal or regulatory requirement applicable to Company. If Company timely objects, the parties will work in good faith to resolve the objection, including by considering commercially reasonable alternatives such as avoiding use of the new subprocessor for the affected service. If the parties are unable to reach a mutually agreed solution, Company’s sole and exclusive remedy is to terminate the affected Product, service, or applicable Order pursuant to which the new In-Scope Subprocessor would Process Company’s Personal Data, without penalty. Any In-Scope Subprocessor not objected to by Company within such 30-day period shall be deemed an Approved Subprocessor for purposes of this DPA. Pindrop shall enter into a written agreement with each In-Scope Subprocessor that Processes Personal Data that is no more permissive on the Processing of Personal Data than the limitations and restrictions imposed on Pindrop under the Agreement. Pindrop will be responsible and liable for the performance and actions of its In-Scope Subprocessors that, if performed by Pindrop, would be deemed a breach of this DPA. For purposes of this Section, “In-Scope Subprocessor” means a subprocessor engaged by Pindrop to deliver component(s) of the Products to Company that will have access to, process, or store Company’s Personal Data.

6. Deidentified Data and Aggregate Data.

Pindrop and its subsidiaries may use Deidentified Data and Aggregate Data derived from the Product and Services for the purposes of providing the Product and Services, Product Optimization Purposes and the Synthetic Call Database. Pindrop and its subsidiaries may also, during and after any expiration or termination of the Agreement, use, maintain, and disclose Deidentified Data for its and their own product improvement and general purposes. Pindrop agrees it will not identify Company or otherwise disclose Company as the source of any such Deidentified Data or Aggregate Data in connection with any general use purposes. Pindrop further agrees it will not make any attempt to (a) re-identify the Deidentified Data; or (b) otherwise attempt to create or derive any Personal Data from such Deidentified Data or Aggregate Data, in each case without Company’s express written permission.

7. Duration of Processing; Data Return and Deletion.

Pindrop will only Process Personal Data for the duration of the Agreement and as otherwise allowed under the Agreement or permitted under applicable Law. Upon expiration or termination of the Agreement or an applicable Order for any reason, Company may, within 30 days following the effective date of such expiration or termination, request the return or export of Company Call Data and Company’s Personal Data. Pindrop will make such data available through the Product's then-current standard export functionality or another commercially reasonable format agreed by the parties. After the expiration of the 30-day return period, or earlier at Company's written election, and unless retention of Personal Data is otherwise permitted under the Agreement or required under applicable Law, Pindrop will securely destroy all Personal Data as soon as practicable, but no later than 90 days from the end of such return period. Data stored in backups, archives, or other comparable systems maintained under Pindrop's ordinary retention processes will be destroyed in accordance with those processes. For clarity, the foregoing does not require Pindrop to delete Synthetic Call Data retained in the Synthetic Call Database as authorized by the Agreement. Upon request, Pindrop will provide written confirmation of deletion. If Pindrop is obliged to retain Personal Data after termination or expiration of the Agreement to comply with a legal obligation to which it is subject, Pindrop will: (a) inform Company thereof; (b) protect the confidentiality of the Personal Data in its possession; and (c) no longer actively Process Personal Data other than as required by the applicable legal obligation.

8. Data Subject Requests.

If Pindrop receives a complaint, dispute, or request from or on behalf of a data subject to exercise such data subject’s rights under Data Protection Laws, and Pindrop is able to confirm that such request relates to Company, Pindrop will promptly notify Company of such data subject request, and in any event within 5 business days, or as soon as commercially reasonable, following Pindrop’s confirmation. Taking into account the nature of Pindrop’s Processing of Personal Data, Pindrop shall provide reasonable assistance to Company in responding to data subject requests as required by Data Protection Laws. Unless required by applicable Law, Pindrop will not respond to or take any action to comply with a data subject request without Company’s approval.

9. Assistance.

Taking into account the nature of Pindrop’s Processing of Personal Data and the information available to Pindrop, Pindrop shall, on request from Company, reasonably assist Company with its obligations to complete data protection impact assessments or similar risk assessments mandated by Data Protection Laws (and, where necessary, to consult with the Supervisory Authority regarding the same).

10. Personal Data Breach.

In the event of a Personal Data Breach affecting Personal Data Processed by Pindrop on behalf of the Company, the process in Section 6 (Security Incident Response) of the ISP shall apply.

11. Audits.

Pindrop's independent security audit reports (such as SOC 2 Type II) and certifications shall constitute the primary means of verifying Pindrop's compliance with its security obligations. If required by Data Protection Laws, Company may audit Pindrop's relevant controls upon a minimum of 30 days' notice, once annually, using an independent auditor acceptable to Pindrop, at Company's expense. Any audit shall be limited in scope to documentation and information reasonably necessary to verify Pindrop's compliance with its obligations under this DPA and shall be subject to Pindrop's security and confidentiality policies and conducted in a manner that does not disrupt operations. In addition to the annual audit right, Company may conduct an additional, focused audit when: (a) there has been a material Personal Data Breach affecting Company; (b) a competent Supervisory Authority requires or directs the audit; or (c) the EU Standard Contractual Clauses, UK Addendum, or applicable Data Protection Laws require additional verification. Before requesting an on-site audit under this paragraph, Company will first review available certifications, reports, and written responses from Pindrop, unless the circumstances make such prior review impracticable. An event-driven audit under this paragraph is subject to the same requirements for an independent auditor acceptable to Pindrop, confidentiality, reasonable scope, and non-disruption. The 30-day notice requirement applies where reasonably practicable, but shorter notice is permitted where required by a regulator, applicable Laws, or an urgent security event. An event-driven audit does not count against the ordinary annual audit limitation.

Standard Contractual Clauses for International Data Transfers

Part 1: EU Standard Contractual Clauses (EEA Transfers)

This Part 1 incorporates the EU Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("Approved EU SCCs"), Module 2 (controller to processor), with the following selections and appendix information completed by cross-reference. These Approved EU SCCs apply to the extent Personal Data is transferred from the European Economic Area to a jurisdiction that does not benefit from an adequacy decision under Regulation (EU) 2016/679.

Clause 7 (Docking Clause): Not used.
Clause 9(a) (Subprocessor Authorization): General authorization. The time period for prior notice of subprocessor changes is 30 days, as set forth in Section 5(b) of this DPA.
Clause 11 (Option): The optional redress language in Clause 11(a) is not used.
Clause 13(a) (Competent Supervisory Authority): The supervisory authority of the EU Member State in which the data exporter is established, or, where the data exporter is not established in the EU, the supervisory authority of the EU Member State in which the data exporter's EU representative is established, or, where neither applies, the supervisory authority agreed by the parties in the applicable Order.
Clause 17 (Governing Law): The laws of Ireland.
Clause 18 (Choice of Forum and Jurisdiction): The courts of Ireland.
Annex I.A (List of Parties): The data exporter is the Company entity identified in the applicable Order. The data importer is Pindrop Security, Inc., 1115 Howell Mill Rd, Ste 700, Atlanta, GA 30318, United States; contact: Pindrop Privacy Team, [email protected].
Annex I.B (Description of Transfer): As described in Section 2 of this DPA.
Annex II (Technical and Organisational Measures): As described in the ISP.
Annex III (List of Subprocessors): As set out in Pindrop's current subprocessor list, available upon request pursuant to Section 5 of this DPA.

Part 2: UK International Data Transfer Addendum

Table 1: Parties (UK Addendum)

Start date: The effective date of the applicable Order.The effective date of the applicable Order.The PartiesExporter (who sends the Restricted Transfer)Importer (who receives the Restricted Transfer)Parties’ detailsFull legal name: The Company entity identified in the applicable Order.Trading name (if different): As set forth in the applicable Order (if applicable).Main address (if a company registered address): As set forth in the applicable Order.Full legal name: Pindrop Security, Inc.Trading name (if different): N/AMain address (if a company registered address): 1115 Howell Mill Rd, Ste 700, Atlanta, GA 30318, United StatesKey ContactFull Name (optional): As designated in the applicable Order.Job Title: As designated in the applicable Order.Contact details including email: As designated in the applicable Order.Full Name (optional): Pindrop Privacy TeamJob Title: Pindrop Privacy TeamContact details including email: [email protected]Signature (if required for the purposes of Section 2)N/AN/A

Table 2: Selected SCCs, Modules and Selected Clauses (UK Addendum)

Addendum EU SCCs: the Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum:

ModuleModule in operation Clause 7 (Docking Clause)Clause 11 (Option)Clause 9a (Prior Authorisation or General Authorisation)Clause 9a (Time period)Is personal data received from the Importer combined with personal data collected by the Exporter?1 2YesNot usedNot usedGeneral Authorisation30 daysN/A3 4

Table 3: Appendix Information (UK Addendum)

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A: List of Parties: As set out in Table 1 above.Annex 1B: Description of Transfer: As described in Section 2 of this DPA.Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data: As described in the ISP.Annex III: List of Sub processors (Modules 2 and 3 only): As set out in Pindrop's current subprocessor list, available upon request pursuant to Section 5 of this DPA.

Table 4: Ending this Addendum when the Approved Addendum Changes (UK Addendum)

Ending this Addendum when the Approved Addendum changesWhich Parties may end this Addendum:☒ Importer☒ Exporterneither Party

Part 3: Mandatory Clauses

Entering into this Addendum

Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

AddendumThis International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs.Addendum EU SCCsThe version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information.Appendix InformationAs set out in Table 3.Appropriate SafeguardsThe standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR.Approved AddendumThe template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18.Approved EU SCCsThe Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.ICOThe Information Commissioner.Restricted TransferA transfer which is covered by Chapter V of the UK GDPR.UKThe United Kingdom of Great Britain and Northern Ireland.UK Data Protection LawsAll laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.UK GDPRAs defined in section 3 of the Data Protection Act 2018.

This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

Hierarchy

Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.
Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs

This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:
1. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;
2. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
3. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.
Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.
The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:
1. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;
2. In Clause 2, delete the words:
3. Clause 6 (Description of the transfer(s)) is replaced with:
4. Clause 8.7(i) of Module 1 is replaced with:
5. Clause 8.8(i) of Modules 2 and 3 is replaced with:
6. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;
7. References to Regulation (EU) 2018/1725 are removed;
8. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;
9. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;
10. Clause 13(a) and Part C of Annex I are not used;
11. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;
12. In Clause 16(e), subsection (i) is replaced with:
13. Clause 17 is replaced with:
14. Clause 18 is replaced with:
15. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum

The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
From time to time, the ICO may issue a revised Approved Addendum which:
1. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or
2. reflects changes to UK Data Protection Laws;
The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.
If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:
1. its direct costs of performing its obligations under the Addendum; and/or
2. its risk under the Addendum,
and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.

The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.

Part 4: Swiss Adaptations

To the extent Personal Data is transferred from Switzerland to a jurisdiction that does not benefit from an adequacy decision under the Swiss Federal Act on Data Protection ("Swiss FADP"), the Approved EU SCCs as incorporated in Part 1 of these Standard Contractual Clauses apply with the following adaptations:

References to "Regulation (EU) 2016/679" or "that Regulation" are replaced by references to the Swiss FADP. References to specific articles of the GDPR are replaced with the equivalent provisions of the Swiss FADP.
References to "EU", "Union", "Member State", and "EU Member State" are replaced with "Switzerland", and references to the "competent supervisory authority" and "competent courts" are replaced with the Swiss Federal Data Protection and Information Commissioner ("FDPIC") and the competent courts of Switzerland, respectively.
Clause 13(a) (Competent Supervisory Authority): The FDPIC is the competent supervisory authority.
Clause 17 (Governing Law): Swiss law, to the extent the data transfer is governed exclusively by the Swiss FADP.
Clause 18 (Choice of Forum and Jurisdiction): The competent courts of Switzerland. A data subject may also bring legal proceedings before the competent courts of Switzerland in which the data subject has habitual residence.
Where the Swiss FADP applies to a transfer together with the GDPR, the Approved EU SCCs apply in their unadapted form for the GDPR-governed portion; these Swiss adaptations apply only to the Swiss FADP-governed portion.

Archived versions

No items found.