UK GDPR addendum

This UK GDPR Addendum (this “UK Addendum”) supplements the WeaveScope GDPR Data Processing Addendum, or other agreement between Customer and WeaveScope governing the processing of Customer Data (the “DPA”). This UK Addendum applies when the UK GDPR applies to Customer’s use of the Services to process UK Customer Data. Unless otherwise defined in this UK Addendum, all capitalised terms used in this UK Addendum will have the meanings given to them in the DPA.

1. Applicability. Except as otherwise set out in this UK Addendum, the terms of the DPA will apply to Customer’s use of the Services to process UK Customer Data, and all references to (i) “GDPR” will be replaced with “UK GDPR”, (ii) “Customer Data” will be replaced with “UK Customer Data”, (iii) “Standard Contractual Clauses” will be replaced with “UK Standard Contractual Clauses”, (iv) “Controller-to-Processor Clauses” will be replaced with “UK Controller-to-Processor Clauses”, and (v) “Processor-to-Processor Clauses” will be replaced with “UK Processor-to-Processor Clauses”.

2. Transfers of UK Customer Data. When this UK Addendum applies, Sections 12.2 (“Application of Standard Contractual Clauses”) and 12.3 (“Alternative Transfer Mechanism”) of the DPA will not apply, and the following Sections will apply:

“12.2 Application of UK Standard Contractual Clauses. Subject to Section 12.3, the UK Standard Contractual Clauses will only apply to UK Customer Data that is transferred, either directly or via onward transfer, to any UK Third Country, (each a “UK Data Transfer”).

12.2.1 When Customer is acting as a controller, the UK Controller-to-Processor Clauses will apply to a UK Data Transfer.

12.2.2 When Customer is acting as a processor, the UK Processor-to-Processor Clauses will apply to a UK Data Transfer. Taking into account the nature of the processing, Customer agrees that it is unlikely that WeaveScope will know the identity of Customer’s controllers because WeaveScope has no direct relationship with Customer’s controllers and therefore, Customer will fulfil WeaveScope’s obligations to Customer’s controllers under the UK Processor-to-Processor Clauses.

12.3 Alternative Transfer Mechanism. The UK Standard Contractual Clauses will not apply to a UK Data Transfer if WeaveScope has adopted Binding Corporate Rules (as defined in the UK GDPR) for Processors or an alternative recognised compliance standard for lawful UK Data Transfers.”

3. Definitions. The following capitalised terms used in this UK Addendum have the meaning given to them below:

“International Data Transfer Addendum” means the international data transfer addendum to the Standard Contractual Clauses issued by the Information Commissioner’s Office under section 119A of the Data Protection Act 2018 on 2 February 2022, and located in Annex A of this UK Addendum.

“UK Controller-to-Processor Clauses” means the Controller-to-Processor Clauses, as amended by the International Data Transfer Addendum.

“UK Processor-to-Processor Clauses” means the Processor-to-Processor Clauses, as amended by the International Data Transfer Addendum.

“UK Standard Contractual Clauses” means (i) the UK Controller-to-Processor Clauses, or (ii) the UK Processor-to-Processor Clauses, as applicable in accordance with Sections 12.2.1 and 12.2.2.

“UK Customer Data” means the “personal data” (as defined in the UK GDPR) that is uploaded to the Services under Customer’s WeaveScope accounts.

“UK GDPR” means the “applied GDPR” as defined in section 3 of the Data Protection Act 2018.

“UK Third Country” means a country outside the UK not recognised by the Secretary of State or the Data Protection Act 2018 as providing an adequate level of protection for personal data (as described in the UK GDPR).”

4. International Data Transfer Addendum. Annex A (“International Data Transfer Addendum to the Standard Contractual Clauses”) of this UK Addendum will apply in accordance with Section 2 of this UK Addendum.

4. Entire Agreement; Conflict. Except as supplemented by this UK Addendum, the DPA (if applicable) and the Agreement will remain in full force and effect. Where both this UK Addendum and the DPA apply to a processing activity, both will apply concurrently. This UK Addendum, together with the DPA and the Agreement: (a) is intended by the parties as a final, complete and exclusive expression of the terms of their agreement, and (b) supersedes all prior agreements and understandings between the parties with respect to the subject matter hereof.

Annex A

International Data Transfer Addendum to the Standard Contractual Clauses (the “Addendum”)

This Addendum is attached to and forms part of the UK Addendum. The parties hereby enter into this Addendum as a legally binding contract for the purpose of making UK Data Transfers. Unless otherwise defined in this Addendum, all capitalised terms used in this Addendum will have the meanings given to them in the UK Addendum.

Part 1: Tables

Table 1: Parties

Table 2: Selected SCCs, Modules and Selected Clauses

Table 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:

Annex 1A: List of Parties:

Data exporter(s):

Name: The entity identified as “Customer” in the DPA.

Address: The address for Customer associated with its WeaveScope account or as otherwise specified in the DPA or the Agreement.

Contact person’s name, position and contact details: The contact details associated with Customer’s WeaveScope account, or as otherwise specified in the DPA or the Agreement.

Activities relevant to the data transferred under these Clauses: The activities specified in Section

1.3 of the DPA.

Signature and date: By using the Services to transfer Customer Data to Third Countries, the data exporter will be deemed to have signed Annex I.

Role (controller / processor): (I) where the Controller-to-Processor Clauses apply, the data exporter will be a controller; and (ii) where the Processor-to-Processor Clauses apply, the data exporter will be a processor.

Data importer(s):

Name: "WeaveScope” as identified in the DPA.

Address: The address for WeaveScope specified in the Agreement.

Contact person’s name, position and contact details: The contact details for WeaveScope specified in the DPA or the Agreement.

Activities relevant to the data transferred under these Clauses: The activities specified in Section

1.3 of the DPA.

Signature and date: By transferring Customer Data to Third Countries on Customer’s instructions, the data importer will be deemed to have signed Annex I.

Role (controller / processor): Processor.

Annex 1B: Description of Transfer:

Categories of data subjects whose personal data is transferred

Categories of data subjects are specified in Section 1.3 of the DPA.

Categories of personal data transferred

The personal data is described in Section 1.3 of the DPA.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures

The data exporter might include sensitive personal data in the personal data described in Section

1.3 of the DPA.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis)

Personal data is transferred in accordance with Customer’s instructions as described in Section 12 of the DPA.

Nature of the processing

The nature of the processing is described in Section 1.3 of the DPA.

Purpose(s) of the data transfer and further processing To provide the Services.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period

Not applicable because the data exporter determines the duration of processing in accordance with the terms of the DPA.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing

The subject matter, nature and duration of the processing are described in Section 1.3 of the DPA.

Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data:

Description of the technical and organisational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons

The technical and organizational measures (including the certifications held by the data importer) as well as the scope and the extent of the assistance required to respond to data subjects’ requests, are described in the DPA.

For transfers to (sub-) processors, also describe the specific technical and organisational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter.

The technical and organisational measures that the data importer will impose on sub-processors are described in the DPA.

Annex III: List of Sub processors (Modules 2 and 3 only):

A link to a list of Sub-processors is set out in Section 6 of the DPA.

Table 4: Ending this Addendum when the Approved Addendum Changes

Part 2: Mandatory Clauses

Entering into this Addendum

1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.

2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

3. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms shall have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

4. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.

5. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.

6. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.

7. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.

8. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

Hierarchy

9. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.

10. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.

11. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs

12. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:

1. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;

2. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and

3. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.

13. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.

14. No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.

15. The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:

a. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs; b. In Clause 2, delete the words:

“and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU)

2016/679”;

3. Clause 6 (Description of the transfer(s)) is replaced with:

“The details of the transfers(s) and in particular the categories of personal data that are

transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;

3. Clause 8.7(i) of Module 1 is replaced with:

“it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK

GDPR that covers the onward transfer”;

3. Clause 8.8(i) of Modules 2 and 3 is replaced with:

“the onward transfer is to a country benefitting from adequacy regulations pursuant to

Section 17A of the UK GDPR that covers the onward transfer;”

3. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European

Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;

3. References to Regulation (EU) 2018/1725 are removed;

4. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;

5. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;

6. Clause 13(a) and Part C of Annex I are not used;

7. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;

8. In Clause 16(e), subsection (i) is replaced with:

“the Secretary of State makes regulations pursuant to Section 17A of the Data Protection

Act 2018 that cover the transfer of personal data to which these clauses apply;”; m. Clause 17 is replaced with:

“These Clauses are governed by the laws of England and Wales.”;

14. Clause 18 is replaced with:

“Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and

14. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum

16. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.

17. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.

18. From time to time, the ICO may issue a revised Approved Addendum which:

    1. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or

    2. reflects changes to UK Data Protection Laws;

The revised Approved Addendum will specify the start date from which the changes to the Approved

Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.

16. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:

    1. its direct costs of performing its obligations under the Addendum; and/or b its risk under the Addendum,

and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.

16. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.