Pulse Meetings DPA

This Pulse for Meetings Data Protection Agreement ("DPA") forms part of, and is incorporated into, the Pulse for Meetings Terms of Service (the "Terms") between Pindrop Security, Inc. ("Pindrop") and the entity identified as "Company" in the applicable Order ("Company"). The Terms and this DPA are collectively referred to as the "Agreement." This DPA govern Pindrop's Processing of Personal Data on behalf of Company in connection with the Pulse for Meetings product and related services. To the extent of any conflict between this DPA and the Terms with respect to the Processing of Personal Data, this DPA shall control. This DPA is not a standalone agreement and may not be terminated independently of the Terms. Except as expressly modified by this DPA, the provisions of the Terms (including, by way of example only, those relating to confidentiality, limitation of liability, indemnification, governing law, dispute resolution and general terms) apply to this DPA with the same force and effect as if this DPA were included as an annex in the Terms. Capitalized terms used but not defined in this DPA have the meanings given to them in the Terms.

This DPA includes, as an attachment, the Standard Contractual Clauses for International Data Transfers, which incorporate the EU Standard Contractual Clauses (Module 2: controller to processor) approved by the European Commission under Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum issued by the UK Information Commissioner and adaptations for transfers governed by the Swiss Federal Act on Data Protection. Those Standard Contractual Clauses apply to the extent that Pindrop's provision of the Product and Services involves the transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction that does not benefit from an adequacy decision under applicable Data Protection Laws, and are intended to provide an appropriate legal basis for such transfers in accordance with the requirements of those laws.

1. Definitions

In the event of a conflict between this definition and the definition of an applicable term under relevant Data Protection Law (defined below), the definition under the relevant Data Protection Law shall govern.

(a) “Aggregate Data” means information that relates to a group or category of individuals, from which individual identities have been removed, that is not linked or reasonably linkable to any individual or household, including via a device and “Aggregated” shall refer to the process to make any data Aggregated Data.

(b) “Data Protection Law(s)” means any applicable national, state or federal Laws for the protection, privacy, and/or processing of Personal Data, including any amendment or re-enactment of the foregoing, to which Company or Pindrop are subject.

(c) “Deidentified Data” means information that cannot reasonably identify, be related to, describe, be capable of being associated with, or linked, directly or indirectly, to a particular individual, and “Deidentified” shall refer to the process to make any information Deidentified Data.

(d) "EU Standard Contractual Clauses" means the standard contractual clauses set out in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, as amended or replaced from time to time by a competent authority under the relevant Data Protection Laws;

(e) “ISP” means the Pulse for Meetings Information Security Program.

(f) “Personal Data” means information that: (i) identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device; or (ii) is made available to Pindrop by or on behalf of Company in connection with the Product and Services, and that Data Protection Laws define as “personal data,” “personal information,” “personally identifiable information” or similar term.

(g) "Personal Data Breach" means (i) a Security Breach with respect to Personal Data transmitted, stored or processed by the Product; and/or (ii) an accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, such Personal Data, as applicable.

(h) “Process”, “Processing”, or “Processed” means any operation or set of operations performed on Personal Data or on sets of Personal Data, whether automated or not, such as, collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

(i) “Processing Purpose” means the purpose for which Pindrop is Processing Personal Data as set forth in Section 2(c) of this DPA and shall also be deemed to mean a Business Purpose.

(j) “Processor” means an entity that Processes Personal Data on behalf of another entity. “Processor” includes similar terms under Data Protection Laws, such as the term “Service Provider,” as context requires.

(k) "Supervisory Authority" means: (i) in the United Kingdom, the Information Commissioner's Office (ICO) or any replacement body; (ii) an independent public authority which is established by a Member State pursuant to Article 51 GDPR; and (iii) any similar regulatory authority responsible for the enforcement of Data Protection Laws.

(l) "UK Standard Contractual Clauses" means: as applicable: (i) the EU Standard Contractual Clauses as amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (“UK Addendum”); or (ii) the International Data Transfer Agreement issued by the UK Information Commissioner, as amended or replaced from time to time ("UK IDTA"), in each case as amended or replaced from time to time.

(m) The terms “Business”, “Business Purpose”, “sell” (and its cognates), “share” (and its cognates) and “Third Party” will have the meaning as ascribed to it or to a similar term under applicable Data Protection Laws.

2. Processing Description

With respect to Pindrop’s provision of the Product and Services to Company pursuant to these Terms:

(a) As between Pindrop and Company, Pindrop is a Service Provider and Processor with respect to any Personal Data that Pindrop Processes on behalf of Company (as a Business and Controller) pursuant to these Terms.

(b) All Personal Data provided by or on behalf of Company to Pindrop is owned or licensed by Company. Unless otherwise expressly provided herein, nothing herein confers any rights or ownership in such Personal Data to Pindrop.

(c) Company has disclosed Personal Data to Pindrop and its subsidiaries for the following Processing Purposes: (1) detecting security incidents and/or utilization by a Meeting Participant of a non-human voice, and protecting against malicious, deceptive, fraudulent or illegal activity; (2) assisting in the authentication of Meeting Participants for Company; (3) as well as is reasonably necessary to support any other valid Processing Purposes that are part of the Product and Services so long as they are contemplated by the parties in these Terms; and (4) analyzing Company Data to generate insights, identify trends, detect patterns, and improve business outcomes and Product performance for Company's benefit;

(d) Pindrop and Company acknowledge and confirm any disclosure of Personal Data pursuant to these Terms is exclusively for the provision of the Product and Services under these Terms and that Pindrop does not receive any Personal Data as monetary or other valuable consideration for the Product, any Services or other items provided under these Terms; and

(e) Company hereby instructs and authorizes Pindrop to Process Personal Data (including to transfer it internationally) in connection with Pindrop’s performance and exercise of its obligations and rights under these Terms. Any additional or alternate instructions must be mutually agreed upon in writing.

(f) The Personal Data to be Processed by Pindrop for the Processing Purposes are:

(i) Consenting Meeting Participant Data, including: audio and video recordings, voice scans and face scans, display names, email addresses (where applicable), and connectivity data (such as IP address, VPN usage status, and time zone), and other data reasonably necessary to provide the Product functionality enabled by Company;

(ii) All Meeting Participant Data: display names and consent status for all Meeting Participants, collected as necessary to track and document consent;

(iii) User Data: account details for Users, including name, work email address, account creation date, and usage credits;

(iv) Meeting Host Data: account information for the Meeting host (such as name, email address, and account details); and

(v) Company Employee Data: business contact information for Company employees involved in Product implementation and operation (e.g., name, work email address, and telephone number).

This data relates to the following categories of data subjects: Meeting Participants, Users, Meeting hosts, and Company employees involved in Product implementation and operation. An individual may fall into more than one category, and the Personal Data processed will be determined by each applicable category.

3. Permitted Use and International Transfers

(a) Pindrop will only collect, use, retain, disclose and otherwise Process Personal Data solely: (a) for the Processing Purposes described above and its performance of these Terms, including in support of Pindrop’s and its subsidiaries internal operations as necessary to the provision of the Product and Services for Company; (b) on Company’s behalf and in accordance with Company’s documented, written instructions; (c) for its internal use to build or improve the quality of the Product and Services, including through analysis of Company Data using AI Tools to generate insights and recommendations, provided that such use is authorized in these Terms and Pindrop will not use the Personal Data to perform services on behalf of another person; or (d) as otherwise necessary for compliance with applicable Laws. Pindrop will not: (i) sell or share Personal Data; (ii) retain, use, or disclose Personal Data outside the direct business relationship between Pindrop and Company; or (iii) retain, use, or disclose Personal Data for any unauthorized commercial purpose. Pindrop will not combine Personal Data received from Company with personal data received from another person or collected through Pindrop's own interactions with an individual, except to the extent permitted by applicable Data Protection Laws and reasonably necessary to provide the Product and Services, detect data security incidents, or protect against fraudulent or illegal activity. Pindrop's rights to Process data for authorized Product Optimization Purposes under Section 4(b)(ii)(B)(2) of the main Terms are subject to and limited by the restrictions in this Section 3(a). Pindrop certifies that it understands and will comply with the restrictions set forth in this Section 3(a). If Pindrop determines that it can no longer comply with these restrictions, Pindrop will promptly notify Company, and Company may take reasonable and appropriate steps to stop and remediate any unauthorized use of Personal Data. Pindrop will ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data and are subject to a duty of confidentiality with respect to Personal Data. Where Pindrop is required to process any new Company Data which is also Personal Data for compliance with applicable Laws after the effective date of these Terms, it will notify the Company of such obligation before commencing Processing, unless prohibited by such Law.

(b) To the extent Pindrop's provision of the Product and Services involves the transfer of Personal Data from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction that does not benefit from an adequacy decision under the applicable Data Protection Laws, the following transfer mechanisms apply: (i) for transfers subject to the EU General Data Protection Regulation (Regulation (EU) 2016/679), the EU Standard Contractual Clauses (Module 2: controller to processor) as set forth in the Standard Contractual Clauses; (ii) for transfers subject to UK Data Protection Laws, the EU Standard Contractual Clauses as supplemented by the UK Addendum, as set forth in the Standard Contractual Clauses; and (iii) for transfers subject to the Swiss Federal Act on Data Protection ("Swiss FADP"), the EU Standard Contractual Clauses as adapted in accordance with the guidance of the Swiss Federal Data Protection and Information Commissioner ("FDPIC"), as set forth in the Standard Contractual Clauses. The Company entity identified in the applicable Order is deemed the data exporter, and Pindrop Security, Inc. is the data importer. The effective date of the applicable transfer mechanism is the effective date of the applicable Order. In the event of any conflict between the terms of this DPA and the Standard Contractual Clauses with respect to the transfer of Personal Data, the Standard Contractual Clauses shall prevail to the extent of such conflict. Pindrop shall not otherwise transfer Personal Data outside of the European Economic Area, the United Kingdom, or Switzerland except where permitted under these Terms and provided that such international transfer is carried out in accordance with applicable Data Protection Laws (including, where required, implementing an appropriate lawful transfer mechanism such as the EU Standard Contractual Clauses, UK Standard Contractual Clauses, or other recognized safeguard).

4. Confidentiality

. Pindrop will ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data and are subject to a duty of confidentiality with respect to Personal Data.

5. Subprocessors

(a) Company agrees and authorizes Pindrop to disclose Personal Data to, and permit the Processing (including the international transfer) of, Personal Data by, those subprocessors used to deliver and perform its obligations under these Terms (the subprocessors as of the effective date of these Terms being the "Approved Subprocessors"). A copy of Pindrop’s current subprocessors is available upon request.

(b) Pindrop will provide Company with a minimum of 30 days prior notice of the addition or replacement of an In-Scope Subprocessor (defined below). Within such 30-day period, Company may object to the engagement of such In-Scope Subprocessor on reasonable, documented grounds relating to data protection, information security, or a legal or regulatory requirement applicable to Company. If Company timely objects, the parties will work in good faith to resolve the objection, including by considering commercially reasonable alternatives such as avoiding use of the new subprocessor for the affected service. If the parties are unable to reach a mutually agreed solution, Company’s sole and exclusive remedy is to terminate the affected Product, service, or applicable Order pursuant to which the new In-Scope Subprocessor would Process Company’s Personal Data, without penalty. Any In-Scope Subprocessor not objected to by Company within such 30-day period shall be deemed an Approved Subprocessor for purposes of these Terms. For purposes of this Section, “In-Scope Subprocessor” means a subprocessor engaged by Pindrop to deliver component(s) of the Products to Company that will have access to, process, or store Company’s Personal Data.

6. Deidentified Data and Aggregate Data

Pindrop and its subsidiaries may use Deidentified Data and Aggregate Data derived from the Product and Services, for the purposes of providing the Product and Services, and general Product Optimization Purposes. Pindrop and its subsidiaries may also, during and after any expiration or termination of these Terms, use, maintain, and disclose Deidentified Data for its own product improvement and general purposes. Pindrop agrees it will not identify Company or otherwise disclose Company as the source of any such Deidentified Data or Aggregate Data in connection with any general use purposes. Pindrop further agrees it will not make any attempt to (a) re-identify the Deidentified Data; or (b) otherwise attempt to create or derive any Personal Data from such Deidentified Data or Aggregate Data, in each case without Company’s express written permission.

7. Duration of Processing; Data Return and Deletion

Pindrop will only Process Personal Data for the duration of these Terms and as otherwise allowed under these Terms or permitted under applicable Law. Upon expiration or termination of these Terms or an applicable Order for any reason, Company may, within 30 days following the effective date of such expiration or termination, request the return or export of Company Data, Personal Data, and Customer Results. Pindrop will make such data available through the Product's then-current standard export functionality or another commercially reasonable format agreed by the parties. For clarity, the export obligation does not include Pindrop Property, Proprietary Prints, Technical Analysis Data, Models, scoring methodologies, algorithms, AI Tools, or other underlying Pindrop technology. After the expiration of the 30-day return period, or earlier at Company's written election, and unless retention of Personal Data is otherwise permitted under these Terms or required under applicable Law, Pindrop will securely destroy all Personal Data as soon as practicable, but no later than 90 days from such date. Data stored in backups, archives, or other comparable systems maintained under Pindrop's ordinary retention processes will be destroyed in accordance with those processes. Upon request, Pindrop will provide written confirmation of deletion. If Pindrop is obliged to retain Personal Data after termination or expiration of these Terms to comply with a legal obligation to which it is subject, Pindrop will: (a) inform Company thereof; (b) protect the confidentiality of the Personal Data in its possession; and (c) no longer actively Process Personal Data other than as required by the applicable legal obligation.

8. Data Subject Requests

If Pindrop receives a complaint, dispute, or request from or on behalf of a data subject to exercise such data subject’s rights under Data Protection Laws, and Pindrop is able to confirm that such request relates to Company, Pindrop will promptly notify Company of such data subject request, and in any event within 5 business days, or as soon as commercially reasonable, following Pindrop’s confirmation. Taking into account the nature of Pindrop’s Processing of Personal Data, Pindrop shall provide reasonable assistance to Company in responding to data subject requests as required by Data Protection Laws. Unless required by applicable Law, Pindrop will not respond to or take any action to comply with a data subject request without Company’s approval.

9. Assistance

Taking into account the nature of Pindrop’s Processing of Personal Data and the information available to Pindrop, Pindrop shall, on request from Company, reasonably assist Company with its obligations to complete data protection impact assessments or similar risk assessments mandated by Data Protection Laws (and, where necessary, to consult with the Supervisory Authority regarding the same).

10. Personal Data Breach

In the event of a Personal Data Breach affecting Personal Data Processed by Pindrop on behalf of the Company, the process in Section 6 (Security Incident Response) of the ISP shall apply.

11. Audits

Pindrop's independent security audit reports (such as SOC 2 Type II) and certifications shall constitute the primary means of verifying Pindrop's security obligations. If required by Data Protection Laws, Company may audit Pindrop's relevant controls upon a minimum of 30 days' notice, once annually, using an independent auditor acceptable to Pindrop, at Company's expense. Any audit shall be limited in scope to documentation and information reasonably necessary to verify Pindrop's compliance with its obligations under this DPA and shall be subject to Pindrop's security and confidentiality policies and conducted in a manner that does not disrupt operations. In addition to the annual audit right, Company may conduct an additional, focused audit when: (a) there has been a material Personal Data Breach affecting Company; (b) a competent Supervisory Authority requires or directs the audit; or (c) the EU Standard Contractual Clauses, UK Addendum, or applicable Data Protection Laws require additional verification. Before requesting an on-site audit under this paragraph, Company will first review available certifications, reports, and written responses from Pindrop, unless the circumstances make such prior review impracticable. An event-driven audit under this paragraph is subject to the same requirements for an independent auditor acceptable to Pindrop, confidentiality, reasonable scope, and non-disruption. The 30-day notice requirement applies where reasonably practicable, but shorter notice is permitted where required by a regulator, applicable law, or an urgent security event. An event-driven audit does not count against the ordinary annual audit limitation.

Standard Contractual Clauses for International Data Transfers

Part 1: EU Standard Contractual Clauses (EEA Transfers)

This Part 1 incorporates the EU Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("Approved EU SCCs"), Module 2 (controller to processor), with the following selections and appendix information completed by cross-reference. These Approved EU SCCs apply to the extent Personal Data is transferred from the European Economic Area to a jurisdiction that does not benefit from an adequacy decision under Regulation (EU) 2016/679.

• Clause 7 (Docking Clause): Not used.

• Clause 9(a) (Subprocessor Authorization): General authorization. The time period for prior notice of subprocessor changes is 30 days, as set forth in Section 5(b) of the Pulse for Meetings Data Protection Agreement.

• Clause 11 (Option): The optional redress language in Clause 11(a) is not used.

• Clause 13(a) (Competent Supervisory Authority): The supervisory authority of the EU Member State in which the data exporter is established, or, where the data exporter is not established in the EU, the supervisory authority of the EU Member State in which the data exporter's EU representative is established, or, where neither applies, the supervisory authority agreed by the parties in the applicable Order.

• Clause 17 (Governing Law): The laws of Ireland.

• Clause 18 (Choice of Forum and Jurisdiction): The courts of Ireland.

Annex I.A (List of Parties): The data exporter is the Company entity identified in the applicable Order. The data importer is Pindrop Security, Inc., 1115 Howell Mill Rd, Ste 700, Atlanta, GA 30318, United States; contact: Pindrop Privacy Team, [email protected].

Annex I.B (Description of Transfer): As described in Section 2 of the Pulse for Meetings Data Protection Agreement.

Annex II (Technical and Organisational Measures): As described in the Pulse for Meetings Information Security Program.

Annex III (List of Subprocessors): As set out in Pindrop's current subprocessor list, available upon request pursuant to Section 5 of the Pulse for Meetings Data Protection Agreement.

Part 2: UK International Data Transfer Addendum

Table 1: Parties (UK Addendum)

Table 2: Selected SCCs, Modules and Selected Clauses (UK Addendum)

Table 3: Appendix Information (UK Addendum)

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Table 4: Ending this Addendum when the Approved Addendum Changes (UK Addendum)

Part 3: Mandatory Clauses

Entering into this Addendum

1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

1. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

2. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
3. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
4. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
5. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
6. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

Hierarchy

1. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section ‎10 will prevail.
2. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
3. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs

1. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:
   1. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;
   2. Sections ‎9 to ‎11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
   3. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.
2. Unless the Parties have agreed alternative amendments which meet the requirements of Section ‎12, the provisions of Section ‎15 will apply.
3. No amendments to the Approved EU SCCs other than to meet the requirements of Section ‎12 may be made.
4. The following amendments to the Addendum EU SCCs (for the purpose of Section ‎12) are made:
   1. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;
   2. In Clause 2, delete the words:

      “and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;

   3. Clause 6 (Description of the transfer(s)) is replaced with:

      “The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;

   4. Clause 8.7(i) of Module 1 is replaced with:

      “it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;

   5. Clause 8.8(i) of Modules 2 and 3 is replaced with:

      “the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”

   6. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;
   7. References to Regulation (EU) 2018/1725 are removed;
   8. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;
   9. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;
   10. Clause 13(a) and Part C of Annex I are not used;
   11. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;
   12. In Clause 16(e), subsection (i) is replaced with:

       “the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;

   13. Clause 17 is replaced with:

       “These Clauses are governed by the laws of England and Wales.”;

   14. Clause 18 is replaced with:

       “Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and

   15. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum

1. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
2. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
3. From time to time, the ICO may issue a revised Approved Addendum which:
   1. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or
   2. reflects changes to UK Data Protection Laws;

   The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.

4. If the ICO issues a revised Approved Addendum under Section ‎18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:
   1. its direct costs of performing its obligations under the Addendum; and/or
   2. its risk under the Addendum,

   and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.

The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.

Part 4: Swiss Adaptations

To the extent Personal Data is transferred from Switzerland to a jurisdiction that does not benefit from an adequacy decision under the Swiss Federal Act on Data Protection ("Swiss FADP"), the Approved EU SCCs as incorporated in Part 1 of these Standard Contractual Clauses apply with the following adaptations:

1. References to "Regulation (EU) 2016/679" or "that Regulation" are replaced by references to the Swiss FADP. References to specific articles of the GDPR are replaced with the equivalent provisions of the Swiss FADP.
2. References to "EU", "Union", "Member State", and "EU Member State" are replaced with "Switzerland," and references to the "competent supervisory authority" and "competent courts" are replaced with the Swiss Federal Data Protection and Information Commissioner ("FDPIC") and the competent courts of Switzerland, respectively.
3. Clause 13(a) (Competent Supervisory Authority): The FDPIC is the competent supervisory authority.
4. Clause 17 (Governing Law): Swiss law, to the extent the data transfer is governed exclusively by the Swiss FADP.
5. Clause 18 (Choice of Forum and Jurisdiction): The competent courts of Switzerland. A data subject may also bring legal proceedings before the competent courts of Switzerland in which the data subject has habitual residence.
6. Where the Swiss FADP applies to a transfer together with the GDPR, the Approved EU SCCs apply in their unadapted form for the GDPR-governed portion; these Swiss adaptations apply only to the Swiss FADP-governed portion.