Standard Contractual Clauses and International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

Updated: FEBRUARY 2026

1.           Each party acknowledges that in order to fulfil their respective obligations under the Agreement it may be necessary to make a Restricted Transfer (as defined in Chapter V of the GDPR) and therefore each party hereby agrees to the European Commission’s Standard Contractual Clauses of 21 June 2021 (“SCCs”) and/or, where a transfer of UK citizens personal data the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (Version A1.0 in force 21 March 2022) (the “UK Addendum”).

2.           If the Parties manually complete SCCs and/or a UK Addendum specific to this Agreement then such fully completed SCCs and/or UK Addendum shall be deemed incorporated into this Schedule and the rest of this Schedule shall not apply.

3.           In the absence of a fully completed SCCs and/or an UK Addendum, each party agrees that the Module 1 SCCs and, where applicable under the Agreement, the Module 2 SCCs (controller to processor), and the template Addendum linked to above is hereby incorporated by reference into this Agreement and it shall be construed to include the following provisions (Table references below refer to Table references in the Addendum and the information at Table 3 is applicable to Annex I and II of the SCCs:

In relation to SCCs, (a) the Parties agree that the Data Protection Commissioner of Ireland shall be the competent Supervisory Authority pursuant to clause 13 of the SCCs; (b) data subjects for whom the Extorter processes EU personal data are third party beneficiaries under the applicable SCCs; (c) the SCCs shall be governed by the law of Ireland, which allows for third party beneficiary rights pursuant to Clause 17 of the SCCs; and (d) any dispute arising from the SCCs shall be resolved by the courts of Ireland pursuant to Clause 18 of the SCCs.

Table 1: Parties

Parties’ details: The Exporter and Importer shall be the relevant parties to this Agreement (depending on which party sends and which party receives the Relevant Transfer)

Key Contact: shall be any relationship managers (or similar) referred to in the Agreement or in the absence of the same the primary liaison points at each of the Exporter and Importer

Signature: the signature to the Agreement shall be deemed to be included in Table 1

Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs: the second box in the table shall be deemed to be ticked

Modules: Module 1 ticked with no docking clause permitted and Clause 11 Option ticked.

Module 2 ticked where Company is a data processor in relation to Client Personal Data also with no docking clause permitted and Clause 11 Option ticked.

Table 3: Appendix Information

Annex 1A: List of Parties: means the parties to this Agreement

Annex 1B: Description of Transfer: means the transfer of personal data identified in the Agreement from one party to the other as contemplated by the Agreement

Annex II: Technical and organisational measures: means industry standard and no less than adequate technical and organisational measures to ensure the security of the data, for example standards such as or equivalent to ISO 27001

Annex III: Any sub-processors which either party is using for the purposes of processing personal data under this Agreement and which such party shall notify to the other party in writing

Table 4: Ending this Addendum when the Approved Addendum changes

Each of the Importer and the Exporter can end the Addendum as set out in Section 19