This Data Processing Addendum (the “Addendum”), including its appendices, forms part of the agreement between Top Echelon Software, LLC (“TES”) and you (“You”, “Your”, or “Customer”) for the purchase or use of, or Your access to, the Services pursuant to the Terms and Conditions for Top Echelon Services (the “Agreement”). Terms capitalized but not defined herein shall have the meaning ascribed to them in the Agreement
ARTICLE 1 SCOPE
Unless otherwise stated herein, this Addendum shall only apply to the extent Data Protection Law(s) require and only with regard to that Protected Data that the specific Data Protection Law governs.
The Parties acknowledge that European Data Protection Laws apply to the Processing of Protected Data if: (i) the Processing is carried out by TES for You, and You are established in the European Economic Area (“EEA”) or the UK; and/or (ii) the Protected Data is Personal Data relating to Data Subjects located in the EEA or UK. The Parties also acknowledge that Non-European Data Protection Laws may apply to the Processing of Protected Data
ARTICLE 1 DEFINITIONS
1.1 “Controller” means the entity which determines the purposes and means of the Processing of Protected Data
1.2 “EEA Standard Contractual Clauses” mean the standard contractual clauses set out in the European Commission Implementing Decision (EU) 2021/914 (https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en) on standard contractual clauses for the transfer of Personal Data to third countries pursuant to the GDPR, as amended or replaced from time to time by a competent authority under the relevant Data Protection Law.
1.3 “Data Protection Laws” means any and all applicable international, national, provincial, federal, state, and local laws and regulations, including as they may be enacted, amended, or replaced from time to time, that relate to or govern Protected Data, the terms of this Addendum, or the Agreement, and/or the provision, performance, or ownership of the Services, and including, but not limited, the following data protection laws and frameworks: (i) the European General Data Protection Regulation (GDPR), the Federal Data Protection Act of Switzerland, and the UK GDPR (collectively referred to as “European Data Protection Laws”); (ii) The California Consumer Privacy Act (CCPA); and (iii) The Colorado Privacy Act (CPA), (iv) The Virginia Consumer Data Protection Act (CDPA), and (v) other similar and applicable data protection or privacy laws and regulations of any other jurisdiction. Those Data Protection Laws not considered European Data Protection Laws shall be considered, “Non-European Data Protection Laws”.
1.4 “Process,” “Processing,” and “Processed” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
1.5 “Processor” means the entity which Processes Protected Data on behalf of the Controller, including as applicable, any “service provider” as that term is defined by the CCPA.
1.6 “Processing Purpose” means the use of Protected Data by TES in accordance with the instructions provided by You as further set forth in this Addendum and the Agreement.
1.7 “Protected Data” means any Personal Data that is subject to Data Protection Laws that TES Processes in its capacity as a Processor on behalf of You.
1.8 “Standard Contractual Clauses” means the EEA Standard Contractual Clauses and/or the UK Standard Contractual Clauses, as applicable.
1.9 “Subprocessor” means any third party (excluding an employee of TES) appointed by or on behalf of TES to Process Protected Data on Your behalf in connection with the Agreement.
1.10 “UK GDPR” means the GDPR, as transposed into United Kingdom national law by operation of section 3 of the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019, as amended or replaced from time to time.
1.11 “UK Standard Contractual Clauses” mean the standard contractual clauses (process) set out in Commission Decision 2010/87/EC and the standard contractual clauses (controller) set out in Commission Decisions 2004/915/EC, as amended from time to time, pursuant to Article 46 of the UK GDPR
1.12 In this Addendum, references to “includes,” “including,” “including but not limited to,” “including without limitation” and words or phrases of similar import shall be deemed to have the same meaning and the words “include(s)” and “including” shall not be deemed to be terms of limitation but rather be deemed to be followed by the words “without limitation.”
ARTICLE 3 PRIVACY OF PROTECTED DATA
3.1 The Parties acknowledge and agree that with regard to the Processing of Protected Data, You are a Controller and TES is a Processor.
3.2 You shall, in Your use of the Services, comply with all requirements of Data Protection Laws, including any applicable requirement to provide notice to Data Subjects of the use of TES as a Processor. For the avoidance of doubt, Your instructions for the Processing of Protected Data shall comply with Data Protection Laws. You shall have the sole responsibility for the accuracy, quality, and legality of Protected Data and the means by which You have acquired Protected Data. You acknowledge and agree that the use of the Services will not violate the rights of any Data Subject, including those that have opted-out from sales or other disclosures of their Protected Data to the extent applicable under Data Protection Laws. The Agreement, including this Data Processing Addendum, is Your complete and final instructions as of the Effective Date. Any additional or alternate instructions must be mutually agreed to in writing.
3.3 TES and its personnel engaged in the Processing of Your Protected Data are informed of the confidential nature of the Protected Data and shall treat Protected Data as confidential information and shall Process Protected Data on behalf of and only in accordance with Your documented instructions for the following purposes: (i) Processing in accordance with the Agreement and any applicable Statement of Service; (ii) Processing initiated by users in their use of the Services; and (iii) Processing to comply with other documented reasonable instructions provided by You where such instructions are consistent with the terms of the Agreement.
3.4 Upon Your request, TES shall delete a particular individual’s Protected Data from Your records that are in TES’s direct control. In the event TES is unable to delete the Protected Data for reasons permitted under Data Protection Law, TES shall (i) inform You of the reason(s) for its refusal of the deletion request, and (ii) ensure the privacy, confidentiality, and security of such Protected Data in accordance with this Data Processing Addendum.
3.5 Upon Your request, TES shall provide reasonable assistance as necessary to permit You to respond to individual requests made pursuant to applicable Data Protection Law.
3.6 The Parties acknowledge and agree as follows:
(a) The Protected Data that You disclose to TES is provided to TES for a Processing Purpose, and You do not sell Protected Data to TES in connection with the Agreement.
(b) During the time the Protected Data is disclosed to TES, You do not have any knowledge or reason to believe that either Party is unable to comply with the provisions of this Addendum.
3.7 TES will not (i) sell Your Protected Data, and (ii) retain, use, or disclose Your Protected Data for any purpose other than for the purposes as described herein.
3.8 Protected Data Types and Processing Purposes
(a) You retain control of the Protected Data and remains responsible for its compliance obligations under the applicable Data Protection Laws, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to the TES.
(b) Appendix A describes the general Protected Data categories, nature of the Processing, and Data Subject types that TES may Process that are necessary to perform the Services under the Agreement.
ARTICLE 4 TES PERSONNEL
4.1 TES shall take reasonable steps to ensure the reliability of any employee, agent or contractor who may have access to Protected Data, ensuring in each case that access is strictly limited to those individuals who need to know/access the relevant Protected Data, as necessary for the purposes of the Agreement, and to comply with Data Protection Laws in the context of that individual’s duties to TES, ensuring that all such individuals are subject to confidentiality undertakings or professional or statutory obligations of confidentiality.
ARTICLE 5 SECURITY
5.1 TES will maintain a commercially reasonable security program in accordance with industry standards and Applicable Laws, including those measures set forth herein.
ARTICLE 6 SUBPROCESSING
6.1 You authorize TES to engage Subprocessors as needed and at TES’s sole discretion. When a new Subprocessor is engaged as it relates to TES’s Processing of Protected Data, TES will notify (including, without limitation, by email or by updating the TES website) You of the engagement. You may, within fifteen (10) days of receiving such notice, object (in good faith) to such engagement. In the event You make an objection within such time period, the Parties will work in good faith to resolve the objection. If after fifteen (10) days, the Parties are not able to come to a mutually agreed to solution, TES can go forward with the engagement and Your only remedy is to terminate the applicable Service to the extent affected by the new Subprocessor.
ARTICLE 7 DATA BREACH
7.1 TES shall, unless prohibited by Applicable Law, notify You without undue delay upon TES becoming aware of the occurrence of any unauthorized access or disclosure of Protected Data (a “Data Breach”).
ARTICLE 8 DURATION OF PROCESSING
8.1 Pursuant to this Addendum, TES will Process Protected Data provided by You to TES. TES will Process Your Protected Data for the duration of the Processing as further set forth in Appendix A, and as otherwise allowed under the Agreement or Applicable Law.
ARTICLE 9 AUDIT RIGHTS
9.1 Upon written request, TES will provide reasonable assistance to You with respect to any data protection assessments (or other similar assessments as required under applicable Data Protection Laws) that relate to TES’s Processing of Your Protected Data, including, by providing You with the information and records necessary to show compliance with this Addendum. No more than once per twelve (12) months, TES will, upon thirty (30) days prior written request, allow a qualified independent thirty-party auditor to audit TES’s policies, records, and information that relate to TES’s Processing of Protected Data to examine TES’s compliance with this Addendum. Any audit conducted pursuant to this Section 9.1 shall be during normal business hours and shall not unreasonably disrupt TES’s normal business operations. Any report, documents, information, or record provided to You or created pursuant to this Section 9.1 shall be considered TES Confidential Information.
9.2 The Parties agree that nothing herein will require TES to disclose or make available: (i) any data of any other customer or user of TES; (ii) access to TES systems; (iii) TES’s internal accounting or financial information; or (iv) any trade secret of TES.
ARTICLE 10 RESTRICTED TRANSFERS
10.1 To the extent Protected Data governed by European Data Protection Laws is transferred to a geographic location outside of the European Economic Area, Switzerland, or the UK, the Standard Contractual Clauses will be filled out as set forth in Appendix B and shall be deemed executed and incorporated herein only to the extent applicable.
ARTICLE 11 LIMITATION OF LIABILITY
11.1 Each Party’s liability arising out of or relating to this Addendum is subject to the limitation of liability provisions under the Agreement.
ARTICLE 12 GENERAL TERMS
12.1 Governing Law and Jurisdiction. This Addendum shall be governed by the laws of the country or territory stipulated for this purpose in the Agreement.
12.2 Changes in Data Protection Laws. Notwithstanding anything to the contrary contained here, TES shall have no obligation to monitor changes in Data Protections Laws or to notify You of the same. Nothing herein shall impact Your obligation to continually comply with Data Protection Laws as described hereunder.
12.3 Amendment. TES reserves the right to modify and make updates to this Agreement at any time. All such changes to this Agreement shall be effective immediately upon posting. TES will provide notice to You of any material changes to this Addendum, including, without limitation, giving notice to You by posting an updated version of this Addendum. TES encourages You to regularly check this Addendum and review the terms herein.
12.4 Severance. Should any provision of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained therein.
Appendix A
Details of Data Processing
Duration of Processing
TES will Process Protected Data for the duration of the Agreement and in accordance with the Addendum.
Purpose and Nature of the Processing
TES will Process Protected Data in furtherance of its provision of Services to You and in accordance with the Addendum.
Categories of Data Subjects
– Your Authorized Users and Data Subjects.
Types of Protected Data
– Contact information
– Names and job title
– Other Protected Data You provide TES in connection to Your use of the Services
Appendix B
1. Standard Contractual Clause Appendix: The Appendix to the Standard Contractual Clauses shall be deemed completed pursuant to the below table.
| Applicable Module(s): | MODULE TWO: Transfer controller to processor |
| Clause 7 – Docking Clause: | MODULE TWO: No |
| For Modules Two and Three
Clause 9 – Use of sub-processors
|
MODULE TWO:
Option 2: General written authorisation as set forth in the Addendum |
| Clause 11 – Redress, independent dispute resolution body Option: | MODULE TWO: No |
| For Modules One, Two and Three
Clause 13 – Supervision |
MODULE TWO:
Where the data exporter is not established in an EU Member State, but falls within the territorial scope of application of Regulation (EU) 2016/679 in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of Regulation (EU) 2016/679 |
| Clauses 14 and 15 | Not applicable |
| Clause 17 – Governing Law | MODULE TWO: Option 1: Ireland |
| Clause 18 – Choice of forum and jurisdiction | MODULE TWO: Irish Data Protection Commission |
2. Annex I to the Standard Contractual Clauses: By signing, the Parties agree to also be bound by the UK Addendum to the EU Commission Standard Contractual Clauses attached hereto. Annex I to the Standard Contractual Clauses shall be deemed completed pursuant to the below table.
Data exporter(s): [Identity and contact details of the data exporter(s) and, where applicable, of its/their data protection officer and/or representative in the European Union]
| Name: | The entity or individual who accepted the Agreement | |
| Address: | The address as set forth in Your account and/or profile | |
| Contact person’s name, position and contact details: | The contact information as set forth in Your account and/or profile | |
| Activities relevant to the data transferred under these Clauses: | As set forth in Appendix A | |
| Signature and date: | By transferring Personal Data from the EEA or the UK (as applicable) to the Data Importer, the Data Exporter will be deemed to have signed this Appendix B. | |
| Role (controller/processor): | Controller |
Data importer(s): [Identity and contact details of the data importer(s), including any contact person with responsibility for data protection]
| 1. | Name: | Top Echelon Software, LLC |
| Address: | 4883 Dressler Rd. NW, Ste 100, Canton, OH 44718 | |
| Contact person’s name, position and contact details: | [] | |
| Activities relevant to the data transferred under these Clauses: | As set forth in Appendix A | |
| Signature and date: | By receiving Personal Data from the EEA or the UK (as applicable) from the Data Exporter, the Data Importer will be deemed to have signed this Appendix B. | |
| Role (controller/processor): | Processor |
A. DESCRIPTION OF TRANSFER
| Categories of data subjects whose Personal Data is transferred | As set forth in Appendix A of the Data Processing Addendum to which these clauses are attached. |
| Categories of Personal Data transferred | As set forth in Appendix A of the Data Processing Addendum to which these clauses are attached. |
| Sensitive data transferred (if applicable) | As set forth in Appendix A of the Data Processing Addendum to which these clauses are attached. |
| (For sensitive data only: applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.) | If applicable, as set forth in Appendix A of the Data Processing Addendum to which these clauses are attached |
| The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis). | As set forth in Appendix A of the Data Processing Addendum to which these clauses are attached. |
| Nature of the processing | As set forth in Appendix A of the Data Processing Addendum to which these clauses are attached. |
| Purpose(s) of the data transfer and further processing | As set forth in Appendix A of the Data Processing Addendum to which these clauses are attached. |
| The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period | As set forth in Appendix A of the Data Processing Addendum to which these clauses are attached. |
| For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing | As necessary to provide the Services to the controller. |
B. COMPETENT SUPERVISORY AUTHORITY
| Identify the competent supervisory authority/ies in accordance with Clause 13 | Irish Data Protection Commission |
3. Annex II to the Standard Contractual Clauses: Annex II to the Standard Contractual Clauses shall be deemed completed pursuant to the below.
Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons.
As set forth in the Agreement to which these Clauses are attached.
For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter
As set forth in the Agreement to which these Clauses are attached.
4. Annex III to the Standard Contractual Clauses: Annex III to the Standard Contractual Clauses shall be deemed completed pursuant to the below table.
The controller has provided processor general authorisation to use sub-processors.
5. UK Addendum: The UK Addendum to the Standard Contractual Clauses shall be deemed completed pursuant to Schedule B-1, which is attached hereto and incorporated herein.
6. Switzerland: For transfers out of Switzerland, If the Processing of Protected Data involves the transfer of Protected Data from Switzerland to a jurisdiction outside of Switzerland where the transfer would be prohibited by Data Protection Laws in the absence of standard contractual clauses or another adequate transfer mechanism as approved by the Swiss Federal Data Protection and Information Commissioner (“FDPIC”), the parties agree that such transfer(s) will be carried out in accordance with and subject to the Standard Contractual Clauses as amended by the Addendum to the EU SCCs attached hereto as Schedule B-2.
Schedule B-1
UK ADDENDUM TO THE EU COMMISSION STANDARD CONTRACTUAL CLAUSES
This Schedule B-1shall apply to any transfer of Personal Data from a Data Exporter located in the United Kingdom, to a Data Importer located in a third country that is not deemed to offer adequately similar protection as provided under United Kingdom Law, and applies in addition to, not in lieu of, Schedule B.
TABLE 1: Parties
| Start Date | If applicable, date of Your acceptance of the Agreement in which this document is referenced. | |
| The Parties | Data Exporter | Data Importer |
| Parties’ Details | See Section 2 of Appendix B above | See Section 2 of Appendix B above |
| Key Contact | See Section 2 of Appendix B above | See Section 2 of Appendix B above |
| Signature | By transferring personal data from the UK (as applicable) to the Data Importer, the Data Exporter will be deemed to have signed this Appendix B-1. | By Processing personal data from the UK received from the Data Exporter, the Data Importer will be deemed to have signed this Appendix B-1. |
TABLE 2: Selected SCCs, Modules, and Selected Clauses
| Addendum to EU SCCs | ☒ The version of the approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information:
Date: Reference (if any): Other identifier (if any): |
||||
| Module in Operation | Clause 7 (Docking Clause) | Clause 11 (Option) | Clause 9a (Prior Authorisation or General Authorisation) | Clause 9a (Time Period) | |
| Module | N/A | N/A | N/A | N/A | N/A |
| 1 | N/A | N/A | N/A | N/A | N/A |
| 2 | N/A | N/A | N/A | N/A | N/A |
TABLE 3: Appendix Information
“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
See Appendix B to which this Schedule B-1 is attached.
TABLE 4: Ending this Addendum when the Approved Addendum Changes
Data Exporter shall have the right to terminate this Schedule B-1 in the event this Approved Addendum changes.
MANDATORY CLAUSES
Entering into this Addendum
1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.
2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.
Interpretation of this Addendum
3. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:
| Addendum | This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs. |
| Addendum EU SCCs | The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Table 2, including the Appendix Information. |
| Appendix Information | As set out in Table 3. |
| Appropriate Safeguards | The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR. |
| Approved Addendum | The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18. |
| Approved EU SCCs | The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021. |
| ICO | The Information Commissioner. |
| Restricted Transfer | A transfer which is covered by Chapter V of the UK GDPR. |
| UK | The United Kingdom of Great Britain and Northern Ireland. |
| UK Data Protection Laws | All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK. |
| UK GDPR | As defined in section 3 of the Data Protection Act 2018 |
4. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.
5. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.
6. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.
7. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.
8. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, reenacted and/or replaced after this Addendum has been entered into.
Hierarchy
9. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.
10. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.
11. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs
Incorporation of and Changes to the EU SCCs
12. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that: a. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers; b. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and c. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.
13. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.
14. No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.
15. The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:
a. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;
b. In Clause 2, delete the words: “and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;
c. Clause 6 (Description of the transfer(s)) is replaced with: “The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;
d. Clause 8.7(i) of Module 1 is replaced with: “it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;
e. Clause 8.8(i) of Modules 2 and 3 is replaced with: “the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”
f. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;
g. References to Regulation (EU) 2018/1725 are removed;
h. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;
i. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;
j. Clause 13(a) and Part C of Annex I are not used;
k. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;
l. In Clause 16(e), subsection (i) is replaced with: “the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;
m. Clause 17 is replaced with: “These Clauses are governed by the laws of England and Wales.”;
n. Clause 18 is replaced with: “Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and
o. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.
Amendments to this Addendum
16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.
17. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.
18. From time to time, the ICO may issue a revised Approved Addendum which: a. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or b. reflects changes to UK Data Protection Laws; The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.
19. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in: a its direct costs of performing its obligations under the Addendum; and/or b its risk under the Addendum, and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.
20. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.
Schedule B-2
ADDENDUM TO THE EU SCCs
In accordance with guidance issued by the Swiss Federal Data Protection and Information Commissioner (FDPIC) titled “The transfer of personal data to a country with an inadequate level of data protection based on recognised standard contractual clauses and model contracts,” dated 27 August 2021, the parties hereby agree to adopt the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council annexed to the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021(the “EU SCCs”) as adapted by this Addendum to the EU SCCs (“Addendum”) in order to comply with Swiss legislation and thus be suitable for ensuring an adequate level of protection for data transfers from Switzerland to a third country in accordance with Article 16 paragraph 2 letter a of the Federal Act on Data Protection (“FADP”).
1. Selected SCCs, Modules and Selected Clauses
The version of the EU SCCs which this Addendum is appended to, detailed below:
Reference (if any): Module 2 of the EU SCCs as set forth in Appendix B of the DPA.
2. Amendments to the EU SCCs
The following amendments are hereby made to the EU SCCs in order for the EU SCCs to comply with Swiss legislation and thus be suitable for ensuring an adequate level of protection for data transfers from Switzerland to a third country in accordance with Article 16 paragraph 2 letter a FADP.
2.1 Competent supervisory authority in Annex I.C under Clause 13: The competent supervisory authority shall be the FDPIC, insofar as the data transfer is governed by the FADP; and shall be the EU authority referenced in Annex I.C insofar as the data transfer is governed by the GDPR.
2.2 Applicable law for contractual claims under Clause 17: Applicable law for contractual claims under Clause 17 shall be Swiss law or the law of a country that allows and grants rights as a third-party beneficiary for contractual claims regarding data transfers pursuant to the FADP; law of an EU member state for those according to the GDPR (free choice for Module 4)
2.3 Place of jurisdiction for actions between the Parties pursuant to Clause 18 b: Free choice for actions concerning data transfers pursuant to the FADP; court of an EU member state for actions concerning data transfers pursuant to the GDPR.
2.4 Adjustments or additions concerning the place of jurisdiction for actions brought by data subjects: The term “member state” shall not be interpreted in such a way as to exclude data subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c).
2.5 Adjustments or additions regarding references to the GDPR: References to the GDPR should be understood as references to the FADP insofar as the data transfers are subject to the FADP.
2.6 Supplement until the entry into force of the revFADP: The EU SCCs shall also protect the data of legal entities until the entry into force of the revised FADP.