Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Eloquent AI Terms of Service (the “Agreement”) between Eloquent AI, Inc. (“Eloquent AI,” “we,” “us,” or “our”) and the customer identified in the Agreement (“Customer”). This DPA governs the processing of personal data by Eloquent AI on behalf of the Customer and sets out the parties’ obligations under applicable data protection laws

Precedence. In the event of any conflict between this DPA and the Agreement, the provisions of this DPA shall prevail only to the extent necessary to comply with Applicable Data Protection Laws; otherwise, the Agreement shall govern.

1. Definitions

1.1. Applicable Data Protection Laws: Refers to all laws and regulations applicable to the processing of personal data under this DPA, including but not limited to the General Data Protection Regulation (GDPR), UK GDPR, UK Data Protection Act 2018, Swiss Federal Data Protection Act, California Consumer Privacy Act (CCPA), and any amendments or successors to these laws.

1.2. Controller: The entity that determines the purposes and means of processing personal data.

1.3. Processor: The entity that processes personal data on behalf of the Controller.

1.4. Personal Data: Any information relating to an identified or identifiable natural person, as defined under applicable data protection laws.

1.5. Subprocessor: Any third-party service provider engaged by Eloquent AI to process Personal Data on behalf of the Customer.

1.6. Standard Contractual Clauses (SCCs): Clauses adopted by the European Commission or other applicable authorities for ensuring adequate safeguards in international data transfers.

1.7. Personal Data Breach: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

1.8. EEA: The European Economic Area, including the European Union, Iceland, Liechtenstein, and Norway.

2. Roles and Responsibilities

2.1. Customer as Controller: The Customer acts as the Controller and ensures compliance with all applicable data protection laws, including obtaining necessary consents and providing notices to data subjects.

2.2. Eloquent AI as Processor: Eloquent AI acts as the Processor and will process Personal Data only on the Customer’s documented instructions unless required by law.

Where Eloquent AI is legally required to process Personal Data other than on Customer’s documented instructions, it will inform Customer of that requirement before processing, unless the relevant law prohibits such notice on important grounds of public interest. Any such processing remains subject to Applicable Data Protection Laws and mandatory international-transfer requirements.

2.3. Compliance Cooperation. Each party will cooperate in good faith as reasonably necessary to meet its respective legal obligations under Applicable Data Protection Laws.

2.4 Dual Role. Eloquent AI acts as an independent Controller for its own account management, billing and website analytics activities described in the Privacy Policy. This does not convert Personal Data processed on Customer’s behalf, including masked or pseudonymised data, into independent-controller data or authorise its use for general platform improvements outside Section 3.3.

2.5. Confidentiality of Personnel. Eloquent AI shall ensure that all persons it authorises to process Personal Data, including employees and contractors, are bound by written confidentiality obligations, including through employment or contractor agreements, or are subject to an appropriate statutory obligation of confidentiality. Authorised personnel include individual contractors who work as integrated team members under Eloquent AI’s direct authority and day-to-day supervision, using Eloquent AI-controlled accounts and access permissions. Such personnel may process Personal Data only on Eloquent AI’s instructions, consistent with Customer’s documented instructions, unless otherwise required by applicable law, and must comply with Eloquent AI’s applicable security and access-control requirements. This provision does not exempt any contractor that acts as a separate Subprocessor from the requirements of Section 4.

2.6. Unlawful Instructions. Eloquent AI shall immediately inform Customer if, in its opinion, a Customer instruction infringes Applicable Data Protection Laws. Eloquent AI may, on notice to Customer, suspend only the affected processing to the extent reasonably necessary while Customer clarifies, modifies or withdraws the instruction. Eloquent AI will resume the affected processing once the concern has been resolved and the processing can lawfully continue. This provision does not create a general duty to conduct a legal review of Customer’s instructions or activities or to provide legal advice, and does not limit Eloquent AI’s obligations under Applicable Data Protection Laws.

3. Scope of Processing

3.1. Subject Matter: The processing of Personal Data is required to deliver the services specified in the Agreement.

3.2. Duration: Personal Data will be processed for the term of the Agreement and, after termination, only for the limited purposes and periods specified in Section 8, subject to Customer's documented instructions and Applicable Data Protection Laws.

3.3. Nature and Purpose: Eloquent AI processes Personal Data to provide, maintain, support, secure and improve the Services for Customer on Customer’s documented instructions, and as required by applicable law. Customer instructs Eloquent AI to generate effectively anonymised data for general improvements to Eloquent AI’s products, platform and workflows, subject to applicable law and the Agreement’s confidentiality requirements. Such general improvement use is permitted only after individuals are no longer identifiable by means reasonably likely to be used by Eloquent AI or others, and must not identify Customer or disclose Customer Confidential Information. Masking or removing direct identifiers alone is insufficient; until effectively anonymised, data remains subject to this DPA, including its access, retention and deletion requirements. This permission does not authorise training or fine-tuning third-party foundation models using Customer Data or data derived from it.

3.4. Categories of Data Subjects: Data subjects include the Customer’s employees, contractors, and end-users who interact with Eloquent AI’s services.

3.5. Categories of Personal Data: Include contact information, account credentials, communication records, and other data provided by the Customer, including authorised workflow recordings containing readable passport images and identity details as described in Section 8.4.

4. Appointment of Subprocessors

4.1 Eloquent AI uses Subprocessors to support the provision of the Services. Subprocessors may Process Personal Data only for the purpose of providing their contracted services to Eloquent AI.

4.2 With respect to each Subprocessor, Eloquent AI shall ensure that it has entered into a written agreement containing data protection obligations no less protective than those contained in this DPA. Eloquent AI remains responsible for performance of the obligations it delegates to its Subprocessors and for their acts and omissions in performing those obligations as if they were its own, subject to the Agreement’s applicable liability limitations, exclusions and remedies, except where Applicable Data Protection Laws or mandatory transfer provisions require otherwise.

4.3 Customer provides general authorisation to Eloquent AI to engage the Subprocessors listed at https://app.vanta.com/eloquentai.co/trust/6600zy6wtu7njn8sukijm/subprocessors as appointed on the date this DPA enters into force.

4.4 Eloquent AI:

(a) will maintain a current list of all Subprocessors involved in Processing Personal Data in connection with the Services; and

(b) will provide Customer with additional information about any listed Subprocessor that Customer may reasonably require to comply with Applicable Data Protection Laws.

4.5. Changes to Subprocessors

Eloquent AI will give Customer written notice of any intended addition or replacement of a Subprocessor at least ten (10) business days before that Subprocessor begins processing Customer’s Personal Data. Notice will be given in accordance with the Agreement and will identify the Subprocessor, its processing activities and relevant processing locations. Eloquent AI will provide reasonably requested information necessary for Customer to assess the proposed change.

Customer may object within ten (10) business days after receipt of the notice. An objection must be in writing and specify reasonable, substantiated grounds relating to the protection of Customer’s Personal Data. If Customer does not object within that period, the proposed Subprocessor is authorised under Customer’s general authorisation in Section 4.3, subject to the other requirements of this DPA.

The proposed Subprocessor will not begin processing Customer’s Personal Data before the objection period has expired.

If Customer makes a timely objection meeting these requirements, the parties will work in good faith to resolve it. Eloquent AI may propose additional safeguards, an alternative Subprocessor or another commercially reasonable means of providing the affected Services. Eloquent AI is not required to implement commercially unreasonable changes or maintain a particular Subprocessor indefinitely.

While such an objection remains unresolved, Eloquent AI will not permit the proposed Subprocessor to process that Customer’s Personal Data. This restriction applies only to the affected Customer and processing activities. Eloquent AI may continue using an existing authorised arrangement where reasonably practicable, or suspend the affected processing only as permitted by the Agreement or required by applicable law.

If no reasonable solution is provided within thirty (30) calendar days following expiry of the objection period, Customer may terminate the affected Services by giving at least thirty (30) days’ written notice. Any other termination rights under the Agreement remain applicable.

This Section does not override stricter requirements expressly agreed with Customer, Applicable Data Protection Laws or mandatory international-transfer provisions. Subprocessor appointments remain subject to Sections 4.2 and 7.

5. Security Measures

5.1. Technical and Organizational Measures: Eloquent AI implements measures aligned with industry standards, including:

• Data encryption (AES-256 at rest, TLS 1.2 or higher in transit).
• Role-based access control and multi-factor authentication.
• Regular penetration testing and vulnerability assessments.

These measures are designed to provide a level of security appropriate to the risk and shall not be interpreted as a guarantee of absolute security or uninterrupted service.

5.2. Data Breach Notification: Eloquent AI will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer’s Personal Data. Information may be provided in phases as it becomes available, without undue further delay.

Such notification shall not constitute an admission of fault or liability and will be limited to information reasonably available at the time of notice.

6. Data Subject Rights

6.1. Assistance: Taking into account the nature of the processing, Eloquent AI will assist Customer through appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise data subjects’ rights under Applicable Data Protection Laws.

6.2. Redirection of Requests: If Eloquent AI receives a data subject request directly, it will promptly notify the Customer unless prohibited by law.

6.3. Personally identifiable information (PII), whether collected from data subjects within the United Kingdom, the European Economic Area, or the United States, will be deleted or de-identified once it no longer serves a lawful business purpose. Verified deletion requests will be honoured in accordance with data protection laws such as GDPR (UK and EU) and CCPA/CPRA (US), unless Eloquent AI has a continuing legal or regulatory obligation to retain such data. Specific retention timelines are outlined in Section 8 and Section 4.9 of the Terms of Service. The contractual export request window does not limit data subject rights or Customer's lawful deletion instructions.

6.4 DPIA Assistance. Eloquent AI shall provide reasonable assistance to Customer in conducting Data Protection Impact Assessments and, where required, prior consultation with supervisory authorities under Article 36 of the EU GDPR or UK GDPR, as applicable. Eloquent AI will also assist Customer in meeting its obligations concerning security of processing and personal data breach notifications under Articles 32–34, taking into account the nature of the processing and the information available to Eloquent AI.

7. International and Cross-Border Data Transfers

7.1. Where a transfer of Personal Data is subject to restrictions under Applicable Data Protection Laws, the parties shall ensure that a valid transfer mechanism is in place before that transfer occurs. This may be an applicable adequacy decision or, where legally applicable to the transfer, the appropriate module of the EU Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 and, for relevant UK transfers, the UK International Data Transfer Addendum. If those instruments are not legally available for the relevant processing, the transfer must be covered by another legally valid mechanism before it takes place.

7.2. Eloquent AI implements supplementary technical and organisational safeguards consistent with EDPB Recommendations 01/2020.

7.3. Eloquent AI will comply with U.S. state privacy laws to the extent applicable to its processing under this DPA. Where Personal Data processed on Customer’s behalf is subject to the CCPA/CPRA, Section 11 applies. Storage or processing in the United States does not, by itself, determine whether those laws apply.

7.4. Where the parties rely on the Standard Contractual Clauses or the UK International Data Transfer Addendum, the applicable instrument, module, options and required annexes or tables must be completed and made legally binding between the relevant parties before the transfer begins, and shall form part of this DPA. In the event of a conflict, the mandatory terms of the applicable transfer instrument prevail over this DPA and the Agreement to the extent of that conflict, including in relation to liability, governing law and jurisdiction. The Agreement’s other terms remain unaffected to the extent they do not conflict with those mandatory terms.

7.5 Transfer Impact Assessment. Eloquent AI shall assess and document the impact of applicable third-country laws on the effectiveness of the transfer safeguards relied upon under this Section 7 and implement supplementary technical and organisational measures where necessary to ensure an essentially equivalent level of protection.

7.6. Personal Data will be primarily hosted in AWS data centres in the United States, United Kingdom or European Union. Where a primary hosting region is expressly agreed in the Order Form, Eloquent AI will maintain the primary production datastore containing Customer’s Personal Data in that region.

Unless expressly agreed otherwise in writing, a primary hosting commitment does not require all processing, copies or access to remain within that region. Personal Data may be processed or accessed in other countries in which Eloquent AI, its authorised personnel or its Subprocessors operate, where necessary to provide, maintain, support or secure the Services. This may include AI inference, voice processing, transcription, operational logging, backups and disaster recovery.

All such processing and access remain subject to this DPA, including its purpose limitations, confidentiality, security, retention and international-transfer requirements. Any required transfer mechanism and supplementary safeguards must be in place before the relevant restricted transfer occurs. Subprocessor appointments and changes remain subject to Section 4, including applicable notice and objection rights.

Eloquent AI will provide information about relevant processing locations through its Subprocessor List or other written documentation. Any additional data-residency restrictions must be expressly agreed in writing and identify the data, processing activities, locations and permitted exceptions covered.

8. Retention and Deletion

8.1. At the end of the processing services, Eloquent AI will, at Customer’s choice, return or securely delete Personal Data and delete existing copies, except where applicable law requires storage or Customer expressly instructs lawful continuing limited storage under Sections 8.2 and 8.4. Customer may request return or export of Personal Data in writing within thirty (30) calendar days after termination, and Eloquent AI will provide the requested data. Customer may request earlier deletion at any time after termination; Eloquent AI will securely delete the requested Personal Data held by Eloquent AI or its Subprocessors, subject only to Section 8.5 for residual backup copies, within thirty (30) calendar days after receipt of the request, or sooner where required by Applicable Data Protection Laws. The export request window does not limit deletion requests, statutory data rights or lawful instructions during the Term. Data requested for export will remain available during that window unless Customer instructs earlier deletion.

8.2. The twelve-month period is a maximum, not automatic permission to retain Personal Data after the processing services end. Except for residual backups under Section 8.5, any continuing storage beyond limited return and deletion processing must be expressly instructed by Customer for a specific lawful, necessary purpose and duration, with this DPA continuing to apply, or be covered by a permitted legal-retention requirement. Personal Data processed on Customer's behalf will, subject only to Section 8.5 for residual backup copies, be securely deleted no later than twelve (12) months after termination, or earlier under Section 8.1, Customer's lawful instructions, Applicable Data Protection Laws or the applicable category-specific maximum in Section 4.9 of the Terms of Service. The shortest applicable deadline controls. During permitted post-termination retention, processing is limited to secure storage, authorised retrieval for the documented purpose, return and deletion, or legally required retention, with restricted access and no unrelated use. Continuing audit-storage instructions must identify the data covered, necessary duration and any agreed retrieval arrangements; they do not confer continued platform access or extend the general export request window. Apart from Section 8.5, longer retention is permitted only to the extent lawfully required by applicable law, a regulatory obligation or a documented legal hold; only the necessary data will be retained for that purpose and securely deleted when the requirement ends. The no-fixed-expiry category for Eloquent AI's own sales and contact records does not apply to Personal Data processed on Customer's behalf.

8.3. In the event of any inconsistency between this DPA and Eloquent AI’s internal policies, including the Data Management Policy or Data Retention Matrix, the provisions of this DPA shall prevail to the extent of such inconsistency.

8.4. Workflow recordings. On Customer’s documented instructions, Eloquent AI may record authorised workflow execution, including readable passport images and identity details displayed during the workflow, for Customer’s documented audit purposes. Recordings are subject to this DPA’s confidentiality, security, access and transfer requirements. They may be retained only while necessary for that purpose during the Agreement and for up to twelve (12) months after its termination or expiry. Earlier deletion requirements and limited legal-retention exceptions under this Section 8 continue to apply; residual backups are subject to Section 8.5.

8.5. Residual disaster-recovery backups. Only to the extent permitted by Applicable Data Protection Laws, routine disaster-recovery backups for which selective deletion is not reasonably technically practicable may await destruction after the otherwise applicable deletion deadline. When the deletion obligation arises, affected data must be put beyond operational use, remain protected and access-restricted, and be excluded from ordinary processing, analytics, training and other business use. It must be securely deleted as soon as reasonably practicable through a documented, appropriate backup rotation or destruction cycle; indefinite retention or extension merely for convenience is not permitted. Following restoration, previously applicable deletions must be reapplied before affected data returns to operational use. Eloquent AI shall impose equivalent requirements on relevant Subprocessors. This exception does not extend live or active data deletion deadlines or export rights and does not override mandatory legal deadlines, statutory rights or binding transfer-instrument obligations. Any legally required retention remains limited to the necessary data, purpose and duration under Section 8.2. Deletion confirmations must distinguish completed deletion from residual backup copies awaiting destruction under this Section, without certifying deletion of copies that remain.

9. Audits and Compliance

9.1. Third-Party Audits: Eloquent AI undergoes regular independent third-party audits. Upon Customer’s reasonable written request, Eloquent AI will make available relevant, then-current audit reports, certifications and supporting documentation, including available SOC 2 Type II reports and ISO 27001 certification documentation, subject to appropriate confidentiality obligations and applicable third-party disclosure restrictions. Eloquent AI will provide the information necessary to demonstrate compliance with this DPA and Article 28 of the GDPR or UK GDPR, as applicable. Customer will first review this information before requesting a further audit, unless doing so would delay a legally required or urgent audit under Section 9.2.

9.2. Customer Audits: Where the information provided under Section 9.1 is insufficient to demonstrate compliance, or an audit is otherwise required by Applicable Data Protection Laws, Eloquent AI will allow for and contribute to audits, including inspections, by Customer or a qualified independent auditor appointed by Customer. Any appointed auditor must be bound by appropriate confidentiality obligations and be reasonably acceptable to Eloquent AI, whose acceptance will not be unreasonably withheld or delayed.

Routine audits are limited to once per calendar year on at least thirty (30) days’ prior written notice, during normal business hours and with reasonable measures to minimise disruption. The parties will agree a reasonable scope, procedures and cost allocation in advance. The frequency and notice limits do not apply where a further or earlier audit is required by Applicable Data Protection Laws or a competent supervisory authority, or is reasonably necessary following a material Personal Data Breach affecting Customer or credible evidence of material non-compliance with this DPA. In those cases, Customer will give as much notice as reasonably practicable.

Audits must be limited to processing and controls relevant to Customer’s Personal Data and comply with reasonable security requirements. Eloquent AI may use redaction, controlled access or other suitable evidence to protect proprietary information, trade secrets and other customers’ data, provided those measures permit the necessary verification. No unrestricted access to production systems or unrelated records is granted. Agreement on audit arrangements, confidentiality or costs must not prevent or unduly delay an audit required by Applicable Data Protection Laws. Nothing in this Section limits a competent supervisory authority’s powers or the parties’ mandatory obligations under Applicable Data Protection Laws.

10. Amendments

Eloquent AI may update this DPA to reflect changes in Applicable Data Protection Laws by providing Customer with thirty (30) days’ prior written notice. Additions and replacements of Subprocessors are governed by Section 4.

11. CCPA / CPRA Service-Provider Commitments

To the extent Eloquent AI processes Personal Data on Customer’s behalf that is subject to the California Consumer Privacy Act, as amended by the CPRA, and its implementing regulations (together, “CCPA”), Eloquent AI acts as a service provider. Customer discloses such data only for the limited purposes of handling customer interactions, answering, recording and transcribing calls, authorised workflow execution and recording for Customer’s documented audit purposes under Section 8.4, and related hosting, support, troubleshooting and security, as specified in Section 3 and Annex 1. Eloquent AI shall: (a) not sell or share that data, as those terms are defined in the CCPA; (b) not retain, use or disclose it outside those purposes or the direct business relationship with Customer, or combine it with personal information from other customers, other sources or its own interactions with individuals, except as expressly permitted by the CCPA; (c) comply with applicable CCPA requirements and provide the same level of privacy protection required of businesses for that data, including reasonable security and assistance enabling Customer to respond to consumer requests and meet applicable compliance obligations; (d) promptly notify Customer if it determines that it can no longer meet those obligations; (e) permit Customer to take reasonable and appropriate steps to verify compliant use and, upon notice, stop and remediate unauthorised use, using Section 9’s confidentiality and audit procedures without restricting rights required by the CCPA; and (f) bind any Subprocessor handling that data to written terms meeting applicable CCPA requirements, including this Section. This Section does not extend CCPA obligations to processing exempt from that law or authorise uses prohibited elsewhere in this DPA.

12. General Provisions

12.1. Governing Law: This DPA is governed by the laws specified in the Agreement.

12.2. Costs: Additional compliance activities beyond Eloquent AI’s obligations under this DPA may incur reasonable costs, to be agreed upon in writing.

Annex 1: Details of Processing

• Purpose: To provide, maintain, support, secure and improve the Services for Customer, and generate effectively anonymised data for general platform improvements, only as permitted by Section 3.3; and record authorised workflow execution for Customer’s documented audit purposes under Section 8.4.
• Duration: For the term of the Agreement and the limited post-termination periods in Section 8, subject to Customer’s documented instructions and Applicable Data Protection Laws.
• Categories of Data Subjects: Employees, contractors, and end-users.
• Categories of Personal Data: Contact details, account information, communication records, and authorised workflow recordings containing readable passport images and identity details, including names, dates of birth, nationality, photographs, passport numbers and other details visible during the authorised workflow, subject to Section 8.4 and the AUP.

Annex 2: Security Measures

Eloquent AI’s security measures include:

1. Access Controls: Role-based and least-privilege access.
2. Encryption: AES-256 for data at rest and TLS 1.2 or higher for data in transit.
3. Incident Management: 24/7 monitoring and a formal incident response program.
4. Independent audits and security testing. Eloquent AI undergoes annual independent SOC 2 Type II audits and annual ISO 27001 certification or surveillance audits, as applicable, and conducts periodic penetration testing as part of its ongoing security assurance programme. Relevant audit reports and certification documentation are made available in accordance with Section 9 of this DPA.
5. These controls are reviewed at least annually and updated as necessary to maintain effectiveness.

Annex 3: International Transfer Schedule

1. EU transfers. Where legally applicable under Section 7.1, the EU Standard Contractual Clauses in Decision (EU) 2021/914 are incorporated into this DPA: Module Two (controller to processor); Clause 7 excluded; Clause 9(a), Option 2 (general authorisation), with at least ten (10) business days’ notice before a new or replacement Subprocessor begins processing; Clause 11(a)’s optional provision excluded; Irish law under Clause 17; and Irish courts under Clause 18(b), subject to mandatory data-subject rights. Section 4 governs objections and Section 7.4 governs precedence. A different customer role requires the appropriate module and details to be agreed before transfer.

Official EU SCCs: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

2. Parties and acceptance (Annex I.A). Customer is the exporter and Controller, using the Services and instructing the processing. Its legal name, address and responsible contact’s name, role and contact details are those recorded in the Agreement or Order Form. Eloquent AI, Inc. is the importer and Processor, providing, supporting and securing the Services. Contact address: 456 Montgomery Street, Suite 1450, San Francisco, California 94104, United States. Contact: Privacy Team, privacy@eloquentai.co.

Acceptance of the Agreement or an Order Form expressly incorporating this DPA, including through a legally binding online acceptance process, also constitutes acceptance of this DPA and Annex I.A by both parties, where permitted by applicable law; electronic acceptance must bind both parties. Missing party or contact details, registered addresses and registration numbers (if any) must be completed in the Agreement, Order Form or an incorporated written supplement before reliance on this Annex.

3. Transfers (Annex I.B). Data subjects are Customer’s employees, contractors, authorised users and end-users, including callers. Data include contact and account information, lawfully supplied account credentials, recordings, transcripts, communication content and associated metadata, including authorised workflow recordings containing readable passport images and identity details specified in Annex 1. Processing includes collection, recording, transcription, storage, consultation, return and deletion to provide, maintain, support and secure the Services and record authorised workflow execution for Customer’s documented audit purposes under Section 8.4, on Customer’s documented instructions. Transfers occur on an ongoing basis as needed for those purposes. Sections 3 and 8 and Annex 1 govern the processing duration and retention; Section 7.6 governs locations and access. This Annex does not authorise additional purposes or model training.

Before transferring special-category or criminal-offence data, Customer must identify the categories and any additional safeguards in an incorporated written supplement. Such processing remains subject to the Agreement and AUP, encryption, restricted access, confidentiality, documented instructions and the DPA’s retention controls. Subprocessor processing is limited to the service described in the maintained list and processing agreement, for the purposes and duration permitted by this DPA.

4. Authority and safeguards (Annex I.C and Annex II). The competent supervisory authority is determined under Clause 13 and identified, with any required EU representative details, in the Agreement, Order Form or incorporated written supplement. Annex II incorporates Sections 2.5 and 5 and Annex 2, together with the access, assistance, retention and audit provisions in Sections 6–9. Any supplementary measures required under Section 7.5 must be documented and implemented before transfer. The Subprocessor list in Section 4.3 applies under general authorisation; the SCC Annex III for specific authorisation is not selected. Required onward-transfer safeguards remain applicable.

5. UK transfers. For relevant UK transfers, the ICO UK International Data Transfer Addendum, version B1.0, including its Part 2 Mandatory Clauses as revised under Section 18, is incorporated by reference. Its Part 1 Tables are completed as follows:

Table 1: the parties and contacts in paragraph 2; start date: the DPA’s effective date; acceptance as in paragraph 2 and Addendum Section 2. Table 2: the EU SCCs and selections in paragraph 1. Table 3: Annex I.A is paragraph 2, Annex I.B is paragraph 3, Annex II is paragraph 4, and Subprocessor information is the Section 4.3 list. Table 4: the Importer may end the Addendum only under its Section 19.

The Addendum’s mandatory adaptations and hierarchy apply, including the laws and courts of England and Wales and the ICO’s jurisdiction. Ending the Addendum does not authorise transfers without a valid alternative mechanism.

Official UK Addendum: https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf