This Data Processing Addendum including its Schedules (鈥凄笔础鈥�) is agreed between 91导航 and Customer pursuant to the terms of the 91导航 Master Services Agreement (鈥淎驳谤别别尘别苍迟鈥�) under which Customer has agreed to procure and 91导航 has agreed to provide certain Services (as defined in the Agreement). This is version v1202609 which is effective from September 15, 2026.
This DPA is incorporated into the Agreement by reference, and forms part of the Agreement. It sets out the terms that apply when 91导航 Processes Personal Data (as defined in this DPA) on behalf of Customer under the terms of the Agreement. Its purpose is to ensure that such Processing is conducted in accordance with the written instructions of the Customer, as set out in this DPA, and all applicable laws, and with due respect for the rights and freedoms of individuals whose Personal Data are Processed.
Definitions
Capitalized terms used but not defined in this DPA have the same meanings as set out in the Agreement.
For the purposes of this DPA the following words and phrases shall have the following meanings:
“Addendum” means the UK International Transfer Addendum to the EU SCCs, as provided at Schedule 3;
鈥淐颁笔础鈥� means the California Consumer Privacy Act, Cal. Civ. Code 搂 1798.100 et seq., and its implementing regulations, as amended by the California Rights Act;
鈥�Consumer Health Data鈥� means Personal Data that is linked or reasonably linkable to a Data Subject and that identifies the Data Subject鈥檚 past, present, or future physical or mental health status.
鈥淐辞苍迟谤辞濒濒别谤鈥� shall mean the entity which, alone or jointly with others, determines the purposes and means of the Processing of the Personal Data;
鈥淒ata Protection Laws and Regulations鈥� means all laws and regulations from time to time of the United Kingdom, the European Union and the EEA and their member states, Switzerland, and the United States and its states, applicable to the Processing of Personal Data under this DPA including the UK GDPR; the Data Protection Act 2018 (“DPA 2018“); the GDPR; the Privacy and Electronic Communications Directive 2002/58/EC (as updated by Directive 2009/136/EC); the Privacy and Electronic Communications Regulations 2003 (SI 2003/2426) as amended; the U.S. State Privacy Laws; and any other legislation and regulatory requirements in force from time to time which apply to a party relating to the use of Personal Data;
鈥淒ata Subject鈥� means the identified or identifiable person to whom Personal Data relates;
“Data Transfer Provisions” means, the EU SCCs and the Addendum;
鈥淓贰础” means the European Economic Area, which constitutes the member states of the European Union, Norway, Iceland and Liechtenstein;
“EU SCCs” means the standard contractual clauses for the transfer of personal data to third countries pursuant to the GDPR, adopted by the European Commission under Commission Decision (EU) 2021/914 2021;
鈥淕顿笔搁鈥� means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (as amended, replaced or superseded);
鈥淕别补谤蝉别迟鈥� means 91导航 Limited, a company registered in England with company number 10345423 and whose registered office is at 26 Science Park Milton Road, Cambridge, England, CB4 0FP;
鈥淧谤辞肠别蝉蝉颈苍驳鈥� means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
鈥淧谤辞肠别蝉蝉辞谤鈥� shall mean an entity which processes Personal Data on behalf of the Controller, including as applicable any 鈥渟ervice provider鈥� as that term is defined by the CCPA;
鈥淧ersonal Data鈥� means: (a) any data or information relating to (i) an identified or identifiable natural person and/or, (ii) an identified or identifiable legal entity (where such information is protected similarly as personal data or personally identifiable information under applicable Data Protection Laws and Regulations); or (b) any other personal data, personal information or other similar term as may be defined by law (including, without limitation, Consumer Health Data), where for each of (a) or (b), such data is Customer Data (as defined in the Agreement);
鈥淪ecurity, Privacy and Architecture Documentation鈥� means the Security, Privacy and Architecture Documentation applicable to the Services purchased by Customer, as updated from time to time, and accessible via 91导航鈥檚 security webpage at /security or as otherwise made reasonably available by 91导航;
鈥沦耻产-辫谤辞肠别蝉蝉辞谤鈥� means any third party data processor engaged by a Processor who has or will have access to or process Personal Data from a Controller; and
鈥�UK GDPR鈥� means the GDPR as defined in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.
鈥�U.S. State Privacy Laws鈥� means (i) the CCPA, (ii) the Virginia Consumer Data Protection Act, Va. Code Ann. 搂 59.1-575 et seq.; (iii) the Colorado Privacy Act, Colo. Rev. Stat. 搂 6-1-1301 et seq., together with all implementing regulations; (iv) the Connecticut Act Concerning Data Privacy and Online Monitoring, Conn. Gen. Stat. 搂 42-515, et seq.; (v) the Utah Consumer Privacy Act, Utah Code Ann. 搂 13-61-101 et seq., (vi) the Washington My Health My Data Act, Wash. Rev. Code 搂 19.373.010 et seq., and (vii) similar state privacy laws and regulations that may take effect from time to time.
Processing of Personal Data
Roles of the Parties. The parties acknowledge and agree that with regard to the Processing of Personal Data as is necessary for providing the Services, Customer may be the Controller or a Processor. Where the Customer is a Controller, 91导航 will be a Processor. Where the Customer is itself a Processor, 91导航 will be the Customer’s Sub-Processor. In either case, the parties acknowledge and agree that 91导航 will engage Sub-processors pursuant to the requirements set forth in clause 5 below.
The Customer acknowledges that 91导航 is a controller with regard to the personal data collected by 91导航 as part of the sale and/or management of the Subscription (as defined in the Agreement) and/or Services and/or the provision of the Services to Customer, including (but not exclusively) any Operational Data (as defined in the Agreement). For the avoidance of doubt, this DPA only applies to Customer Data and does not apply to personal data for which 91导航 is the controller.
Customer鈥檚 Processing of Personal Data. Customer: (i) is responsible for ensuring that it has complied, and will continue to comply, with all applicable Data Protection Laws and Regulations; (ii) warrants that it has, and will continue to have, the right to Process, transfer, and/or provide access to 91导航, the Personal Data for Processing in accordance with the terms of the Agreement and this DPA; and (iii) has sole responsibility for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired Personal Data, including ensuring that there is a lawful basis for the Processing. Customer specifically acknowledges that its use of the Services will not violate the rights of any Data Subject that has opted-out from sales or other disclosures of Personal Data, to the extent applicable under the CCPA.
91导航鈥檚 Processing of Personal Data. 91导航 shall Process Personal Data on behalf of Customer as is necessary for providing the Services and only in accordance with (i) Customer鈥檚 documented instructions as set out in this DPA, and (ii) the Data Protection Laws and Regulations. 91导航 shall notify the Customer promptly if, (i) in 91导航’s opinion, the Customer’s instructions would not comply with the Data Protection Laws and Regulations, or (ii) 91导航 makes a determination that it can no longer meet its obligations under the Data Protection Laws and Regulations. Any Processing required outside of the scope of these instructions will require prior written agreement between the parties.
No Sale of Personal Data. 91导航 shall not sell for monetary or other valuable consideration, share for purposes of cross-context behavioural advertising, or otherwise disclose, Personal Data to third parties except as permitted under clause 5 below. 91导航 shall not use the Personal Data outside of the direct business relationship between 91导航 and Customer unless permitted by the Data Protection Laws and Regulations, and shall not combine Personal Data with the personal data it receives from or on behalf of another customer or collects from its own interactions with the Data Subject. 91导航 may Process Personal Data as reasonably necessary for the following business purposes: (i) providing the Services, (ii) helping to ensure security and integrity of the Software and the Services, to the extent the use of the Personal Data is reasonably necessary and proportionate for those purposes, (iii) debugging to identify and repair errors that impair existing intended functionality of the Software and the Services, (iv) undertaking internal research for technological development and demonstration, and (v) undertaking activities to verify or maintain the quality or safety of, or to improve, upgrade, or enhance, a service or device that is owned or controlled by Customer. Customer is disclosing the Personal Data to 91导航 only for the performance of the aforementioned limited and specified business purposes, and 91导航 may not retain, use, or disclose the Personal Data for any other business or commercial purpose, unless permitted by the Data Protection Laws and Regulations.
Details of the Processing. The subject-matter of Processing of Personal Data by 91导航, the duration of the Processing, the nature and purpose of the Processing, the types of Personal Data and categories of Data Subjects Processed under this DPA are further specified in Schedule 1 (Data Processing Appendix) to this DPA.
Data Protection Impact Assessments. Upon Customer鈥檚 request, 91导航 shall provide Customer with reasonable cooperation and assistance needed to fulfil Customer鈥檚 obligation under applicable Data Protection Laws and Regulations to carry out a data protection impact assessment related to Customer鈥檚 use of the Services, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to 91导航. 91导航 shall provide reasonable assistance to Customer in the cooperation or prior consultation with the applicable Supervisory Authority in the performance of its tasks relating to clause 2.4 of this DPA, to the extent required under applicable Data Protection Laws and Regulations.
Rights of Data Subjects
Data Subject Request. 91导航 shall, to the extent legally permitted, promptly notify Customer if 91导航 receives a request from a Data Subject to exercise the Data Subject鈥檚 right of access, right to rectification, restriction of Processing, erasure (‘right to be forgotten’), data portability, object to the Processing, its right not to be subject to an automated individual decision making, or any other right to which the Data Subject is entitled under the Data Protection Laws and Regulations, solely to the extent each such request is available to the Data Subject under Data Protection Laws and Regulations (each such request being a 鈥�Data Subject Request鈥�). Taking into account the nature of the Processing, 91导航 shall assist Customer by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of Customer鈥檚 obligation to respond to a Data Subject Request under Data Protection Laws and Regulations. In addition, to the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, 91导航 shall upon Customer鈥檚 request provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent 91导航 is legally permitted to do so and the response to such Data Subject Request is required under Data Protection Laws and Regulations. To the extent legally permitted, Customer shall be responsible for any costs arising from 91导航鈥檚 provision of any such assistance described in this clause 3.
91导航 Personnel
Confidentiality. 91导航 shall ensure that its personnel engaged in the Processing of Personal Data are informed of the confidential nature of the Personal Data, have received appropriate training on their responsibilities and are bound by confidentiality terms no less onerous than those set out in the Agreement. 91导航 shall ensure that such confidentiality obligations survive the termination of the personnel engagement for a reasonable period.
Limitation of Access. 91导航 shall ensure that 91导航鈥檚 access to Personal Data is limited to those personnel who have a need to access the Personal Data to facilitate the performance of the Services.
Data Protection Contact. 91导航 has personnel responsible for the protection and Processing of Personal Data. Those personnel may be reached at legal@gearset.com.
Sub-processors
Appointment of Sub-processors. Customer acknowledges and agrees that: (i) 91导航鈥檚 Affiliates may be retained as Sub-processors, and (ii) 91导航 and 91导航鈥檚 Affiliates may engage third-party Sub-processors in connection with the provision of the Services. 91导航 has entered into a written agreement with each Sub-processor containing data protection obligations no less protective than those in this Agreement with respect to the protection of Personal Data to the extent applicable to the nature of the Services provided by such Sub-processor.
List of Current Sub-processors and Notification of New Sub-processors. 91导航 shall make available to Customer (via the 91导航 Website or otherwise) the current list of Sub-processors for the Services (鈥�Sub-processor List鈥�). The Sub-processor List shall include the identities of those Sub-processors and their country of location. 91导航 shall provide notification of new Sub-processor(s) by email to Customer to the address provided by the Customer to 91导航 for such purposes (if any) at least twenty (20) Working Days in advance of a new Sub-processor(s) appointment, or if no such address is provided then by updating the Sub-processor List. For Customers that do not provide an email address for such purposes, 91导航 shall use reasonable endeavours to alert the Customer of changes to the Sub-processor List through the Software, but the Customer is advised to check the 91导航 Website periodically for communications concerning such changes.
Objection Right for New Sub-processors. Customer may object to 91导航鈥檚 use of a new Sub-processor for a commercially reasonable reason by notifying 91导航 promptly in writing within ten (10) Working Days after 91导航 updates the Sub-processor List or provides notification in accordance with clause 5.2. In the event Customer reasonably objects to a new Sub-processor, 91导航 will use reasonable efforts to make available to Customer a change in the Services or recommend a commercially reasonable change to Customer鈥檚 configuration or use of the Services to avoid Processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening Customer. If 91导航 is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, 91导航 or Customer may terminate the applicable Subscription(s) with respect to those Services which cannot be provided by 91导航 without the use of the objected-to new Sub-processor by providing written notice to the other party. 91导航 will refund Customer any prepaid fees covering the remainder of the term of such Subscription(s) following the effective date of termination with respect to such terminated Services, without imposing a penalty for such termination on Customer.
Liability. 91导航 shall be liable for the acts and omissions of its Sub-processors to the same extent 91导航 would be liable if performing the services of each Sub-processor directly under the terms of this DPA, except as otherwise set forth in the Agreement.
Security
Controls for the Protection of Personal Data. 91导航 shall maintain appropriate technical and organizational measures for protection of the security (including protection against unauthorized or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorized disclosure or access), confidentiality and integrity of Personal Data, as set forth in the Security, Privacy and Architecture Documentation. 91导航 regularly monitors compliance with these measures. Customer acknowledges that the security measures are subject to technical progress and development and that 91导航 may update or modify the security measures from time to time, provided that such updates and modifications do not result in the material degradation of the overall security of the Services purchased by the Customer.
Third-Party Audits. 91导航 engages third party auditors to verify the adequacy of its security measures. These audits (a) will be performed at least annually; (b) will be performed according to internationally recognized standards; (c) will be performed by independent third party security professionals at 91导航鈥檚 selection and expense and (d) will result in the generation of an audit report (鈥�Audit Report鈥�) which will constitute 91导航鈥檚 Confidential Information.
Access to Audit Reports. No more than once during any consecutive 12-month period, on the Customer’s written request and subject to the confidentiality obligations in the Agreement, 91导航 shall make available to a Customer that is not a competitor of 91导航 (or Customer鈥檚 independent, third-party auditor that is not a competitor of 91导航) a copy of 91导航鈥檚 then most recent Audit Report or the summary results, as appropriate. Within such request, the Customer shall be entitled to ask reasonable questions of 91导航 related to its compliance with the terms of this DPA and Data Protection Laws and Regulations, and 91导航 shall use its reasonable endeavors to respond adequately when providing the Audit Report. Upon reasonable request of Customer, 91导航 shall make available all information in its possession reasonably necessary to demonstrate its compliance with the Data Protection Laws and Regulations.
Sub-processor Audits. No more than once during any consecutive 12-month period, on the Customer’s written request, 91导航 will exercise such relevant audit rights that it may have in connection with its Sub-processors鈥� compliance with their obligations regarding their processing of Personal Data, and provide the Customer with a summary of the audit results or, in the event that 91导航 has recently exercised such rights for another customer, it shall provide to the Customer a summary of the most recent audit results.
Customer鈥檚 Right to Audit. In the event that the information provided in accordance with this clause 6 is insufficient to reasonably demonstrate compliance, 91导航 shall permit Customer to inspect or audit the technical and organizational measures of 91导航 for the purposes of monitoring compliance with 91导航鈥檚 obligations under this DPA. Any such audit or inspection shall be: (i) at Customer鈥檚 expense; (ii) limited in scope to matters specific to Customer; (iii) agreed in advance between the parties in writing, including scope, duration, and start date; (iv) conducted in a way that does not interfere with 91导航鈥檚 day-to-day business; during local business hours of 91导航 and, upon not less than twenty (20) business days advance written notice unless, in Customer鈥檚 reasonable belief an identifiable, material non-conformance has arisen; (v) limited to no more than once per any twelve (12) calendar month period, except if (a) required by instruction of a competent Regulator; or (b) in case of a Personal Data Incident; and (vi) subject to the confidentiality obligations in the Agreement or, where a third-party auditor conducts the audit, such third-party auditor must be a professional bound by a duty of confidentiality or subject to a suitable non-disclosure agreement.
Incident Management and Notification
91导航 shall notify Customer promptly and without undue delay after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data, transmitted, stored or otherwise Processed by 91导航 or its Sub-processors of which 91导航 becomes aware (a 鈥�Personal Data Incident鈥�).
91导航 shall make reasonable efforts to identify the cause of any Personal Data Incident and take those steps as 91导航 deems necessary and reasonable to remediate the cause of such a Personal Data Incident to the extent the remediation is within 91导航鈥檚 reasonable control.
The notice to be provided pursuant to clause 7.1 above shall detail, to the extent relevant and reasonably available to 91导航 at the time, and to the extent sharing of such detail is not prohibited by law enforcement:
The date and time of the Personal Data Incident;
The cause of the Personal Data Incident, if known;
The categories and approximate number of records of Personal Data affected;
The likely consequences of the Personal Data Incident;
The measures taken, or proposed to be taken, by 91导航 to address and remediate the cause of the Personal Data Incident; and
The name and contact details of the person from whom more information can be obtained.
91导航 shall keep Customer reasonably updated of any material developments to its investigation, handling and remediation of the Personal Data Incident, and Customer and 91导航 shall reasonably co-operate to mitigate the risk to each party and the affected Data Subjects.
The obligations in this clause 7 shall not apply to incidents that are caused by Customer or its Authorised Users, or by access to the Services in breach of clause 4 (Use of Services and Documentation, Customer Obligations) of the Agreement, unless and until the Customer has notified 91导航 that they constitute a Personal Data Incident in which case 91导航 shall provide the Customer with reasonable assistance (at Customer鈥檚 cost) in investigating the information set out in clause 7.3 above.
Return and Deletion of Personal Data
Upon termination or expiry of the Agreement, 91导航 shall, at Customer’s election, delete or return to Customer all relevant Personal Data (including copies) in 91导航鈥檚 possession, save to the extent that 91导航 is required by any applicable law to retain some or all of the Personal Data.
Limitation of Liability
Each party鈥檚 and all of its Affiliates鈥� liability, taken together in the aggregate, arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to clause 11 of the Agreement (Limitation of Liability).
Transfer Mechanisms
International Transfers. It is acknowledged and accepted by Customer that 91导航 provides a hosted service which can operate in data centres in various locations around the world, as selected by Customer through the Software. As such, 91导航 may transfer Personal Data outside of the UK and EEA as part of its hosting and disaster recovery processes. Customer acknowledges and consents to 91导航 transferring Personal Data outside of the UK and EEA for the purposes of providing the Services, provided that any such transfer meets the relevant requirements under the applicable Data Protection Laws and Regulations.
Data Transfer Provisions. The Data Transfer Provisions will apply, as applicable, to transfers of Personal Data outside the UK or EEA, whether directly or via onward transfer, where the transfer is: (i) to or within a country not recognized by the UK Government (in the case of transfers made pursuant to the UK GDPR) or European Commission (in the case of transfers made pursuant to the GDPR) as providing an adequate level of protection for personal data; and (ii) no other appropriate safeguard for such transfer as set out in Article 46 of the GDPR is applicable to such transfer. Agreement to this DPA will constitute agreement to the applicable the Data Transfer Provisions, which shall be incorporated into this DPA by reference. Where the Data Transfer Provisions apply pursuant to this clause 10.2, then in the event of any inconsistency (but not a direct conflict) between the terms of this DPA and the Data Transfer Provisions, the terms of this DPA will prevail. In the event of a direct conflict between the terms of this DPA and the Data Transfer Provisions, the terms of the Data Transfer Provisions will prevail.
Hosting Regions. It is acknowledged and accepted that 91导航’s cloud-based Services are provided through Amazon Web Services (鈥淎WS鈥�) data centres in specific hosting regions (each an “AWS Hosting Region”), as selected by Customer through the Software. Save as to the extent that the Additional Product and Location Specific terms apply, once the AWS Hosting Region is selected, all Personal Data Processed by 91导航 on behalf of Customer is stored in and processed through AWS data centres solely in that AWS Hosting Region. 91导航 agrees that if the AWS Hosting Region selected by Customer is changed or to be changed by 91导航, then it shall notify Customer promptly and Customer may select another AWS Hosting Region made available by 91导航. In the event that Customer does not agree to any such change, it may terminate the Agreement with immediate effect and 91导航 shall provide a pro-rata refund of any Subscription Fee paid for Services paid for but not yet rendered.
General Provisions
Except as amended by this DPA, the Agreement will remain in full force and effect.
If there is a conflict between the Agreement and this DPA, the terms of this DPA will take precedence.
Any claims brought under this DPA shall be subject to the terms and conditions, including but not limited to, the exclusions and limitations set forth in the Agreement.
This DPA will automatically terminate on the termination or expiry of the Agreement, save to the extent that 91导航 retains Personal Data in accordance with clause 8 for which this DPA shall continue to apply for as long as such Personal Data is retained.
Schedule 1: Details of the Processing
Schedule 2: EU to Third Country Transfers
Schedule 3: UK International Transfer Addendum to the EU SCCs
Data Controller/importer
Data Controller/importer is the legal entity specified as Customer in the Agreement/DPA.
Data Processor/exporter
91导航 Limited, a provider of enterprise DevOps software and cloud services.
Nature and Purpose of Processing
91导航 will Process Personal Data as necessary to perform the Services pursuant to the Agreement, and as further instructed by Customer in its use of the Services.
Duration of Processing
Subject to clause 8 of the DPA, 91导航 will Process Personal Data for the duration of the Agreement, unless otherwise agreed upon in writing.
Categories of Data Subjects
Customer may submit Personal Data to 91导航, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to Personal Data relating to the following categories of Data Subjects:
Prospects, customers, business partners and vendors of Customer (who are natural persons)
Employees or contact persons of Customer鈥檚 prospects, customers, business partners and vendors
Employees, agents, advisors, freelancers of Customer (who are natural persons)
Customer鈥檚 Users authorized by Customer to use the Services
Categories of Personal Data
Customer may submit Personal Data to 91导航, the extent of which is determined and controlled by Customer in its sole discretion, and which may include, but is not limited to the following categories of Personal Data:
First and last name
Title
Position
Employer
Contact information (company, email, phone, physical business address)
ID data
Professional life data
Personal life data
Localisation data
Sensitive Data (if appropriate)
Customer may submit special categories of data to the Services, the extent of which is determined and controlled by the Customer in its sole discretion, and which is for the sake of clarity Personal Data with information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person鈥檚 sex life or sexual orientation.
Frequency of the Transfer
Determined by Customer, in line with its use of the Software.
Sub-Processor Transfers
As set out at clause 5 of the DPA.
Competent Supervisory Authority
Except where Schedule 2 applies, The UK Information Commissioner.
Where Schedule 2 applies, The Irish Data Protection Commissioner.
Technical and Organisational Measures
As set out in the Security, Privacy and Architecture Documentation, and accessible at www.gearset.com/security or otherwise made available by 91导航. 91导航 will not materially decrease the overall security of the Services during the term of the Agreement.
Incorporation of the EU SCCs
To the extent the transfer is made pursuant to the GDPR, this Schedule 2 and the following terms shall apply:
Module 4 of the EU SCCs, and no other optional clauses unless explicitly specified, are incorporated into this Schedule 2 as if they had been set out in full in the case where the exporter is a Processor, the importer is a Controller and the transfer requires such additional protection.
Clarifications to the EU SCCs
Module 4 clarifications. For the purposes of clause 8.1(d) of the EU SCCs, at the end of the provision of the processing services the importer shall delete all Personal Data and shall certify to the exporter that it has done so, if requested to provide such certification by the exporter in writing.
Governing Law and Jurisdiction. For the purposes of clauses 17 and 18 of the EU SCCs, the laws and courts of Ireland shall apply.
Appendices and Annexures to the EU SCCs
The processing details required by the EU SCCs are set out in Schedule 1:
the details required at Annex 1.A of the EU SCCs are set out at paragraphs 1 – 2;
the details required at Annex 1.B of the EU SCCs are set out at paragraph 3 – 9;
the details required at Annex 1.C of the EU SCCs are set out a paragraph 10; and
the details required at Annex 2 of the EU SCCs is set out at paragraph 11.
Parties. As set out in Schedule 1.
Selected SCCs, Modules and Clauses
Module 4 of the EU SCCs and no other optional clauses unless explicitly specified, and as amended by the clarifications in Schedule 2, paragraph 2, but subject to any further amendments detailed in this Schedule 3.
Personal data received from the importer is not combined with personal data collected by the exporter.
Appendix Information
The processing details required by this Addendum are as set out in paragraph 3 of Schedule 1.
Termination of the Addendum
In the event the template Addendum issued by the Information Commissioner’s Office and laid before Parliament in accordance with s119A of the DPA 2018 on 2 February 2022, as it is revised under Section 18 is amended, either party may terminate this Addendum on written notice to the other in accordance with Table 4 and paragraph 19 of the UK Addendum and replace it with a mutually acceptable alternative.