Snapshot 209875
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Crazy Ant Labs Customer Data Processing Addendum
Effective as of December 22nd, 2025
This Customer Data Protection Addendum (“Addendum”) forms part of the Terms of Use (“Terms of Use”) between: (i) Crazy Ant Labs Ltd. And/or Crazy Ant Labs LLC – the applicable entity providing you with the Services (as defined below) (each separately and collectively, “Crazy Ant Labs”, or "Company") and the entity purchasing the Services and engaging with Crazy Ant Labs under the Terms of Use to which this Addendum is appended, including any of its Affiliates (“Customer”). Customer is acting on his own behalf and as agent for each Customer Affiliate (as defined hereunder).
The terms used in this Addendum shall have the meanings set forth in this Addendum. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Terms of Use. Except as modified below, the terms of the Terms of Use shall remain in full force and effect.
In consideration of the mutual obligations set out herein, the parties hereby agree that the terms and conditions set out below shall be added as an Addendum to the Terms of Use to govern processing by Crazy Ant Labs of any Customer Personal Information (as defined below) that is processed by Crazy Ant Labs as a Processor. Except where the context requires otherwise, references in this Addendum to the Terms of Use are to the Terms of Use as amended by, and including, this Addendum.
1. Definitions. In this Addendum, the following terms shall have the meanings set out below and cognate terms shall be construed accordingly:
1.1. “Customer Affiliate” means an entity that owns or controls, is owned or controlled by or is under common control or ownership with Customer, where control is defined as the possession, directly or indirectly, of the power to direct or cause the direction of the management and policies of an entity, whether through ownership of voting securities, by contract or otherwise;
1.2. “Customer Personal Information” means any Customer Data, Customer Metadata and Account Data (all as defined in our Privacy Policy), Processed by Crazy Ant Labs on behalf of a Customer, Customer Affiliates, agents, or customers, pursuant to or in connection with the Terms of Use.
1.3. “EU Customer Personal Information” means any Customer Personal Information, where such Personal Information originates from the EEA, UK or Switzerland
1.4. “EEA” means the European Economic Area.
1.5. “Data Protection Laws” means all data protection and privacy laws, their implementing regulations, regulatory guidance, and secondary legislation, each as updated or replaced from time to time, as applicable to the Processing subject matter of this Addendum, including without limitation: (i) the General Data Protection Regulation ((EU) 2016/679) (the “GDPR”) and any applicable national implementing laws; (ii) the UK General Data Protection Regulation ("UK GDPR") and the UK Data Protection Act 2018; (iii) the Privacy and Electronic Communications Directive (2002/58/EC) and any applicable national implementing laws including, as far as applicable, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2003/2426) or any amended or reinstated versions thereof or any replacing acts; (iv) U.S. Federal and state legislation (e.g., the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”)); and (v) any other laws that may be applicable.
1.6. “Processing” has the meaning given to it in the Data Protection Laws, and “process”, “processes” and “processed” will be interpreted accordingly.
1.7. “Services” means the services provided under the Terms of Use.
1.8. “Standard Contractual Clauses” means the contractual clauses adopted by the EU Commission pursuant to the European Commission Decision of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, with the elections and details set out in Exhibit A, attached hereto and forming part of this DPA; or any updated or revised version thereof or any replacing instrument or substitute instrument as may be approved by the EU Commission from time to time for the purpose of serving as safeguards for transfer of Personal Data outside of the EEA under GDPR or other applicable EU Data Protection Laws.
1.9. “Sub-processor” means any person (including any third party, but excluding an employee of Crazy Ant Labs) appointed by or on behalf of Crazy Ant Labs to Process Personal Data on behalf of any Customer and/or their customers in connection with the Terms of Use; and
1.10. The terms, “Commission”, “Controller”, “Data Subject”, “Member State”, “Personal Information/Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” shall have the same meaning as in the applicable Data Protection Laws, and their cognate, alternative and interchangeable terms by their meaning shall be construed accordingly.
1.11. "UK SCC" - means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses as issued by the UK Commissioner under S119A(1) of the Data Protection Act 2018, including the elections and details set out in Exhibit B hereto, including any amended, extended, re-enacted or consolidated version in force from time to time.
2. Processing of Customer Personal Information
2.1. Crazy Ant Labs shall not Process Personal Data other than on the relevant Customer documented instructions unless Processing is required by EEA or Member State law or other applicable Data Protection Law to which Crazy Ant Labs is subject, in which case Crazy Ant Labs shall inform the relevant Customer of that legal requirement before the relevant Processing of that Customer Personal Information unless that law prohibits such disclosure.
2.2. Customer instructs Crazy Ant Labs (and authorizes Crazy Ant Labs to instruct each Sub-processor) to Process Customer Personal Information; and in particular, transfer Customer Personal Information to any country or territory for the provision of the Services and consistent with the Terms of Use and this DPA (the "Documented Instructions"). The Documented Instructions include any instructions provided by Customer within the administered console of its Crazy Ant Labs account.
2.3. Customer warrants and represents that it is and will at all relevant times remain duly and effectively authorized to give the Documented Instructions including on behalf of each relevant Customer Affiliate or in case Customer carries out the processing on behalf of another Controller then on behalf of the applicable Controller.
2.4. Description of processing. Exhibit A to this Addendum sets out certain information regarding the Crazy Ant Labs’ Processing of the Customer Personal Information.
2.5. Customer represents and warrants as follows:
2.5.1. Customer represents and warrants to Crazy Ant Labs that: (1) it has the right and the authority to process the Customer Personal Information including the use thereof with the Services, including transfers thereof outside the EEA, UK and/or Switzerland, as stipulated herein; (2) It has provided any required notices and to the extent required, has obtained any required consents from individuals as required by Data Protection Laws to collect and process their Personal Data, including, through the Services; (3) It is fully and solely responsible for the confidentiality, integrity and availability, of the Customer Personal Information it collects and provides to Crazy Ant Labs through the Services (except when and as processed by Crazy Ant Labs); (4) the processing of the Customer Personal Information including the provision thereof to Crazy Ant Labs as part of the fulfillment of the Services will not violate any Data Protection Laws and/or any other applicable laws.
2.5.2. Customer acknowledges that Crazy Ant Labs does not have any knowledge of the content and nature of the Customer Personal Information processed through the Services and hence Customer shall ensure to the extent it transfers any sensitive or special category personal data or any other Personal Information or other data subject to specific Data Protection Laws, to properly encrypt such personal data and implement any other measures Customer deems fit in order to duly protect such information. Crazy Ant Labs does not access and/or review any of the Customer personal Information transferred to it except to the extent specifically instructed by Customer and only for the purpose of providing Customer support.
3. Crazy Ant Labs Personnel
3.1. Crazy Ant Labs shall ensure that access is limited to those individuals who need to know / access the relevant Customer Personal Information, as necessary for the purposes of the Terms of Use, and to comply with applicable Data Protection Laws. It shall also ensure that all such individuals are subject to confidentiality undertakings or appropriate statutory obligations of confidentiality.
4. Security
4.1. Crazy Ant Labs will provide the technological safeguards that are described in its Security Page.
4.2. Customer has reviewed the Crazy Ant Labs technical and organizational measures to ensure they are appropriate to the categories of Customer Personal Information processed using the Service. Because Crazy Ant Labs does not know what categories of Customer Data will be stored using the service, this obligation must be fulfilled by Customer.
5. Sub-processing
5.1. Customer authorizes Crazy Ant Labs to appoint (and permit each Sub-processor appointed in accordance with this section 5 to appoint) Sub-processors.
5.2. Crazy Ant Labs may continue to use those Sub-processors already engaged by Crazy Ant Labs as at the date of this Addendum.
5.3. Customer generally authorizes Crazy Ant Labs to use any other third parties as sub-processors. Crazy Ant Labs shall give Customer prior written notice of the appointment of any new Sub-processor, including details of the Processing to be undertaken by the Sub-processor, at https://sftptogo.com/privacy/gdpr. If, within seven (7) days of receipt of that notice, Customer notifies Crazy Ant Labs in writing of any objections (on reasonable grounds) to the proposed appointment:
5.3.1. Crazy Ant Labs shall not disclose any Customer Personal Information to that proposed Sub-processor until reasonable steps have been taken to address the objections raised by any Customer and Customer has been provided with a reasonable written explanation of the steps taken.
5.3.2. If Crazy Ant Labs determines it is not commercially reasonable to provide the Services without the use of the proposed Sub-processor, Crazy Ant Labs may terminate the Customer Account upon thirty (30) days’ notice, and refund any payment made for services not fully rendered as of the termination date. Except as modified by this section such termination shall otherwise occur pursuant to Section “Termination” of the Terms of Service.
5.4. With respect to each Sub-processor, Crazy Ant Labs shall:
5.4.1. ensure that the arrangement between Crazy Ant Labs and the relevant Sub-processor is governed by a written contract including terms which offer at least the same level of protection for Customer Personal Information as those set out in this Addendum.
5.4.2. Ensure that any onward transfer to the Sub-processor shall be made pursuant to appropriate safeguards as required under Data Protection Laws, including, as appropriate, by execution of Standard Contractual Clauses and/or UK SCC.
5.4.3. Restrict the Sub-processor’s access to Customer Personal Information only to what is necessary to maintain the Services or to provide the Services to Customer and prohibit the Sub-processor from processing Customer Personal Information for any other purpose.
6. Data Subject Rights. Crazy Ant Labs shall:
6.1. Promptly notify Customer if Crazy Ant Labs receives a request from a Customer's Data Subject under any applicable Data Protection Law in respect of Customer Personal Information; and
6.2. Not respond to that request except to verify the identity of the applicable Controller and/or to acknowledge to the requestor that it has been received and forwarded to Customer as the relevant data controller; additional response shall only be on the Documented Instructions of Customer or as required by applicable Data Protection Laws to which Crazy Ant Labs is subject, in which case Crazy Ant Labs shall, to the extent permitted by applicable Data Protection Laws, inform Customer of that legal requirement before Crazy Ant Labs responds to the request.
7. Personal Data Breach
7.1. Crazy Ant Labs shall notify Customer without undue delay upon Crazy Ant Labs becoming aware of a Personal Data Breach affecting Customer Personal Information, providing Customer with reasonably sufficient information describing the Personal Data Breach.
7.2. Crazy Ant Labs shall cooperate with Customer and take such commercially reasonable steps requested by Customer to assist in the containment, investigation, mitigation and remediation of such Personal Data Breach.
7.3. Nothing in this section 7 alters the parties’ financial responsibilities for the indemnities set forth in the Terms of Service; in particular Customer may be liable for Crazy Ant Labs expenses in mitigating a Personal Data Breach to the extent such breach was caused by an action or inaction of Customer.
8. Data Protection Impact Assessment and Prior Consultation
8.1. Crazy Ant Labs shall provide reasonable assistance to Customer with any data protection impact assessments, and prior consultations with Supervising Authorities or other competent data privacy authorities, which Customer reasonably considers to be required pursuant to articles 35 or 36 of the GDPR or equivalent provisions of any applicable EU Data Protection Law, in each case solely in relation to Processing of EU Customer Personal Information by Crazy Ant Labs, and taking into account the nature of the Processing and information available to Crazy Ant Labs. Crazy Ant Labs may charge Customer a commercially reasonable fee for such assistance.
9. Deletion or return of Customer Personal Information
9.1. The date of the termination of the Customer Account pursuant to Section “Termination” of the Terms of Service is the “Cessation Date”. Subject to sections 9.2 and 9.3, Crazy Ant Labs shall promptly and in any event within thirty (30) days after the Cessation Date, delete and procure the deletion of all copies of Customer Personal Information.
9.2. Prior to the Cessation Date, Customer may use the Crazy Ant Labs user interface to download all Customer Data by secure file transfer.
9.3. Crazy Ant Labs may retain Customer Personal Information to the extent required by applicable Data Protection Laws, provided that Crazy Ant Labs shall ensure such Customer Personal Information is only Processed as necessary for the purpose(s) specified in the applicable Data Protection Laws, including other applicable laws and regulations referred to by the applicable Data Protection Laws, requiring its storage and for no other purpose and provided that the security of such Customer Personal Information is maintained in accordance with this Addendum.
10. Audit rights
10.1. Subject to the limitations of sections 10.2 to 10.6, Crazy Ant Labs shall make available to Customer on request the information necessary to demonstrate compliance with this Addendum, and shall allow for and contribute to audits, including inspections, by Customer or an auditor mandated by Customer in relation to the Processing of the Customer Personal Information by Crazy Ant Labs. For the avoidance of doubt, inspections shall not include systems of Crazy Ant Labs that contain any data of other customers of Crazy Ant Labs, and any inspection of Crazy Ant Labs premises shall be restricted to the public areas of its offices. No inspection access shall be granted to any server room or facility.
10.2. Information and audit rights of the Customer only arise under section 10.1 to the extent that the Terms of Service do not otherwise give them information and audit rights meeting the relevant requirements of Data Protection Law (including, where applicable, article 28(3)(h) of the GDPR).
10.3. Following receipt by Crazy Ant Labs of a request from Customer for an audit or inspection pursuant to section 10.1, Crazy Ant Labs and Customer will discuss and agree in advance on its reasonable start date, scope and duration of and security and confidentiality controls applicable to the audit/inspection.
10.4. Crazy Ant Labs shall have the right to refuse access to any auditor, where Crazy Ant Labs can specify a reasonable basis, such as affiliation with a Crazy Ant Labs competitor or lack of proper qualification.
10.5. Customer shall pay the fees and expenses of the auditor/inspector. Crazy Ant Labs may charge Customer a reasonable fee for Crazy Ant Labs cooperation with the audit/inspection. Crazy Ant Labs may require that the auditor sign any reasonable legal documentation to ensure the confidentiality of Crazy Ant Labs trade secrets and confidential information including any personal data.
10.6. Crazy Ant Labs shall not be required to submit to more than one audit in any given calendar year, except for any additional audits or inspections which are requested by Customer following the occurrence of a Personal Data Breach.
11. Data transfers outside EEA, Switzerland or UK.
11.1. With respect to any transfer (and any subsequent onward transfer) of EU Customer Personal Information by Crazy Ant Labs from any EEA Member State, or from Switzerland, or from the UK, to a country, territory or organization other than such that were approved as granting an adequate level of protection to personal data (either by the EU Commission, or the Swiss Federal Data Protection Authority, or by the UK Information Commissioner (as applicable) (each, an "Approved Jurisdiction"), the Parties hereto hereby agree to incorporate into this Addendum the Standard Contractual Clauses including Exhibit A attached hereto and/or the UK SCC set forth in Exhibit B attached hereto, as applicable, including any elections and supplements as included in the applicable Exhibits or referenced Appendices.
11.2. If the authorized governmental authorities subsequently amend the Standard Contractual Clauses and/or the UK SCCs at a date later than the Effective Date of this Addendum, such amended terms will automatically supersede and replace any Standard Contractual Clauses and/or UK SCC executed between the parties, with the required modifications in order to keep its original intention.
11.3. Alternative Data Export Solution. The parties agree that the data export solutions identified in this Section may not apply if and to the extent that Crazy Ant Labs adopts an alternative data export solution for the lawful transfer of personal data (as recognized under the applicable Data Protection Laws) from the EEA, Switzerland or UK, as applicable, in which event, Crazy Ant Labs shall notify Customer of such alternative data export solution and it shall apply instead.
12. Obligations under the CCPA
12.1. To the extent that Crazy Ant Labs processes Customer Personal Information of Californian residents and its Processing activities fall under the scope of the CCPA:
12.1.1. Crazy Ant Labs shall not sell Personal Data (as the term "sell" is defined under the CCPA). Crazy Ant Labs is also prohibited from retaining, using or disclosing such Personal Data for a commercial purpose other than providing the Service to the Customer under the Terms of Use, and from retaining, using or disclosing such Personal Data outside of the scope of the Services and Terms of Use.
12.1.2. Crazy Ant Labs acknowledges and understands its obligations under this clause and will comply with them.
13. General Terms
13.1. Governing law and jurisdiction. Without prejudice to clauses 7 (Mediation and Jurisdiction) and 9 (Governing Law) of the Standard Contractual Clauses:
13.1.1. The parties to this Addendum hereby submit to the choice of jurisdiction stipulated in the Terms of Use with respect to any disputes or claims arising under this Addendum, including disputes regarding its existence, validity or termination or the consequences of its nullity; and
13.1.2. This Addendum and all non-contractual or other obligations arising out of or in connection with it are governed by the laws of the country or territory stipulated for this purpose in the Terms of Use.
13.1.3. If an obligation under the Standard Contractual Clauses, or other legal obligation, requires that the parties submit to a jurisdiction and/or use the laws of a nation within the EU, the parties choose the courts and law of Ireland, or as otherwise stipulated in the SCC or the UK SCC as applicable.
13.2. Priority of Documents. In the event of any conflict or inconsistency between this Addendum and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail. Except where explicitly agreed otherwise in writing, signed on behalf of the parties, in the event of inconsistencies between the provisions of this Addendum and any other agreements between the parties, including the Terms of Use and including agreements entered into or purported to be entered into after the date of this Addendum, the provisions of this Addendum shall prevail.
13.3. Severance. Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
13.4. Assumption of Obligations. Either party may transfer and assign its benefits and obligations pursuant to this Addendum to a successor entity in a merger or acquisition, or to a third party in a sale of all or substantially all the Party’s assets.
Exhibit A: Details of Processing of Customer Personal Information
This Exhibit A includes certain details of the Processing of Customer Personal Information under this DPA.
LIST OF PARTIES
Data exporter(s):
Name: as per provided upon signing up for the Services
Address: as per provided upon sign up for the Services
Contact person’s name, position and contact details: as per contacts provided upon signing up for the Services
Activities relevant to the data transferred under these Clauses: as detailed below in description of transfer
Signature and date: as per log of click through of purchase of Services
Role (controller/processor): Controller
EU representative contact details: As shall be advised by Customer
Data importer(s):
Name: Crazy Ant Labs Ltd. in case the subscription is through Heroku, or Crazy Ant Labs LLC, in all other sign-up cases, as per sign up for the Services.
Address: 38 Dam HaMaccabim, Modi'in-Maccabim-Re'ut
Contact person’s name, position and contact details: Saggi Neumann, CEO privacy@crazyantlabs.com.
Activities relevant to the data transferred under these Clauses: as detailed below in description of transfer
Signature and date: as per log of click through of purchase of Services
Role (controller/processor): Processor
Data Protection Officer contact details: NA
EU representative contact details: As per provided in Data Importer's website Privacy Policy
UK representative contact details: As per provided in Data Importer's website Privacy Policy
DESCRIPTION OF TRANSFER
1. Subject matter and duration of the Processing
The subject matter and duration of the Processing of the Personal Data are set out in the Terms of Use and this Addendum.
2. The nature and purpose of the Processing
Crazy Ant Labs provides data storage and file transfer services. Crazy Ant Labs does not access, control, or review the data uploaded by Customer.
3. The types of Personal Data to be Processed
Crazy Ant Labs will store the data that is uploaded by Customer to the Service. Crazy Ant Labs will not access (except in response to a Customer request, e.g. a support request) or control the data uploaded.
4. The categories of Data Subject
Data relating to individuals provided to Crazy Ant Labs via the Services, by (or at the direction of) Customer or by Customer’s end users. This could include (but not limited to) Customer's authorized users (whether employees or otherwise acting on behalf of or for the Customer), Customer's end users or consumers, Customers' channels or partners contacts, Customer's prospect leads, Customer's customers data that may relate to the latter's employees, users, consumers, or other categories - as Customer elects and depending on Customer's purposes of use of the Service.
5. The obligations and rights of Customer and Customer Affiliates
The obligations and rights of Customer and Customer Affiliates are set out in the Terms of Use and this Addendum.
6. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.
Data importer does not have any knowledge of the nature of the Customer Personal Information processed through the Services and hence data exporter shall ensure to the extent it transfers any sensitive or special category personal data to properly encrypt such data and implement any other measures data exporter deems fit in order to duly protect the data. Data importer does not access and/or review any of the Customer personal Information transferred to it.
7. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis).
On occasion, at the will and need of data exporter from time to time
8. The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period
Until erased by data exporter or until the lapse of the Services period
9. For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing
Transfers to sub processors are as detailed in https://sftptogo.com/privacy/gdpr.
COMPETENT SUPERVISORY AUTHORITY
Identify the competent supervisory authority/ies in accordance with Clause 13 of the SCC
For the controller:
As shall be advised by Data Exporter
For the processor:
The Supervisory Authority of Ireland
Exhibit B
The Terms of the EU Standard Contractual Clauses shall be incorporated by reference to this DPA as follows:
1. With regards to clauses 8 to 18 of the Standard Contractual Clauses, Module Two will apply. The Parties agree to include the optional Clause 7 (Docking clause) in the Standard Contractual Clauses incorporated into this Addendum. For the purpose of Clause 9 (a) Option 2: General Written Authorization shall apply. In Clause 11, data subjects shall not be able to lodge a complaint with an independent dispute resolution body. In Clause 17, Option 1 shall apply.
2. Annex I to the EU SCC Shall have the details set in Exhibit A of the DPA.
3. Annex II to the EU SCC shall have the details set here: https://sftptogo.com/privacy/gdpr.
4. Annex III to the EU SCC shall have the details set here: Security Page.
Exhibit C – UK SCC
International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
VERSION B1.0, in force 21 March 2022
This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.
Part 1: Tables
Table 1: Parties
Start date
The Parties Exporter (who sends the Restricted Transfer) Importer (who receives the Restricted Transfer)
Parties’ details Full legal name: as set forth in Exhibit A Trading name (if different): as set forth in Exhibit A Main address (if a company registered address): as set forth in Exhibit A Official registration number (if any) (company number or similar identifier): as set forth in Exhibit A Full legal name: as set forth in Exhibit A Trading name (if different): as set forth in Exhibit A Main address (if a company registered address): as set forth in Exhibit A Official registration number (if any) (company number or similar identifier): as set forth in Exhibit A
Key Contact Full Name (optional): as set forth in Exhibit A Job Title: as set forth in Exhibit A Contact details including email: as set forth in Exhibit A Full Name (optional): as set forth in Exhibit A Job Title: as set forth in Exhibit A Contact details including email: as set forth in Exhibit A
Signature (if required for the purposes of Section 2)
Table 2: Selected SCCs, Modules and Selected Clauses
Addendum EU SCCs The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information: Date: Effective Date as defined in the DPA Reference (if any):Exhibit B of the DPA to which these UK SCC are appended Other identifier (if any): N/A Or the Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum:
Module Module in operation Clause 7 (Docking Clause) Clause 11 (Option) Clause 9a (Prior Authorisation or General Authorisation) Clause 9a (Time period) Is personal data received from the Importer combined with personal data collected by the Exporter?
1
2
3
4
Table 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
Annex 1A: List of Parties: as set forth in Exhibit A
Annex 1B: Description of Transfer: as set forth in Exhibit A
Annex II: as set forth in Exhibit A
Annex III: List of Sub processors (Modules 2 and 3 only): as set forth in Exhibit A
Table 4: Ending this Addendum when the Approved Addendum Changes
Ending this Addendum when the Approved Addendum changes Which Parties may end this Addendum as set out in Section 19: Importer Exporter neither Party
Part 2: Mandatory Clauses
Entering into this Addendum
Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.
Interpretation of this Addendum
Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:
Addendum This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs.
Addendum EU SCCs The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information.
Appendix Information As set out in Table 3.
Appropriate Safeguards The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR.
Approved Addendum The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18.
Approved EU SCCs The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
ICO The Information Commissioner.
Restricted Transfer A transfer which is covered by Chapter V of the UK GDPR.
UK The United Kingdom of Great Britain and Northern Ireland.
UK Data Protection Laws All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.
UK GDPR As defined in section 3 of the Data Protection Act 2018.
This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.
Hierarchy
Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.
Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.
Incorporation of and changes to the EU SCCs
This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:
a. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;
b. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
c. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.
Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.
The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:
a. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;
b. In Clause 2, delete the words:
“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;
c. Clause 6 (Description of the transfer(s)) is replaced with:
“The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;
d. Clause 8.7(i) of Module 1 is replaced with:
“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;
e. Clause 8.8(i) of Modules 2 and 3 is replaced with:
“the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”
f. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;
g. References to Regulation (EU) 2018/1725 are removed;
h. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;
i. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;
j. Clause 13(a) and Part C of Annex I are not used;
k. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;
l. In Clause 16(e), subsection (i) is replaced with:
“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;
m. Clause 17 is replaced with:
“These Clauses are governed by the laws of England and Wales.”;
n. Clause 18 is replaced with:
“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and
o. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.
Amendments to this Addendum
The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
From time to time, the ICO may issue a revised Approved Addendum which:
a. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or
b. reflects changes to UK Data Protection Laws;
The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.
If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:
a its direct costs of performing its obligations under the Addendum; and/or
b its risk under the Addendum,
and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.
The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.