Standard Contractual Clauses
The Parties agree that the applicable Standard Contractual Clauses are incorporated into the DPA by reference, as if they had been set out in full, and are populated as follows. Unless expressly stated below, any optional clauses contained within the Standard Contractual Clauses shall not apply.
The following Standard Contractual Clauses shall apply where Personal Data is transferred to a third country (unless the transfer is permitted on the basis of an adequacy decision):
a) CONTROLLER → PROCESSOR (Module Two) (“Controller to Processor Standard Contractual Clauses”) if Customer, acting as a Controller, is making a restricted transfer of Personal Data subject to the GDPR and/or the UK GDPR (as applicable) to Azets, acting as a Processor;
b) PROCESSOR → PROCESSOR (Module Three) (“Processor to Processor Standard Contractual Clauses”) if Customer, acting as a Processor, makes a restricted transfer of Personal Data subject to the GDPR and/or the UK GDPR (as applicable) to Azets acting as a Processor; and/or
c) PROCESSOR → CONTROLLER (Module Four) (“Processor to Controller Standard Contractual Clauses”) if Azets, acting as a Processor, makes a restricted transfer of Personal Data subject to the GDPR and/or the UK GDPR (as applicable) to Customer, acting as a Controller.
UK Addendum
The Parties agree that the UK Addendum is incorporated into the DPA by reference, as if it had been set out in full, and is populated and shall be read against the EU SCCs as follows. Unless expressly stated below, any optional clauses contained within the UK Addendum shall not apply.
Start Date
The UK Addendum is effective from the effective date of the Engagement Letter.
1. Table 1: Parties
Exporter and key contact: As set out in Annex 1 of the Standard Contractual Clauses below.
Importer and key contact: As set out in Annex 1 of the Standard Contractual Clauses below.
2. Table 2: Selected SCCs, Modules and Clauses
As applicable, Module 2, Module 3 or Module 4 of the EU SCCs as incorporated by reference into Schedule 1 of this DPA including any supplementary clauses set out within Schedule 1 of this DPA.
3. Table 3: Appendix Information
As set out in Annex 1 and Annex 2 of the of the Standard Contractual Clauses below.
4. Table 4: Ending this Addendum when the Approved Addendum Changes
In the event the Commissioner issues a revised Approved Addendum, in accordance with Section 18 of the UK Addendum which as a direct result of such changes has a substantial, disproportionate and demonstrable increase in: (a) the data importer’s direct costs of performing its obligations under the Addendum; and/or (b) the data importer’s risk under the Addendum, the data importer may terminate this UK Addendum on reasonable written notice to the data exporter in accordance with Table 4 and paragraph 19 of the UK Addendum.
Supplementary clauses for Module Two and Module Three:
Erasure and deletion: For the purposes of Clause 8.5, Section II of Module Two and Module Three of the Standard Contractual Clauses the data importer shall delete the Personal Data in accordance with clause 9.1 of the DPA.
Audit: The Parties acknowledge that the data importer complies with its obligations under Clause 8.9, Section II of Module Two and Module Three of the Standard Contractual Clauses by (i) acting in accordance with clause 8.1.5 of the DPA and (ii) exercising its contractual audit rights it has agreed with its Sub-Processors. For the purposes of Clause 8.9(e), Section II of Module Three of the Standard Contractual Clauses, the data exporter shall ensure the results are provided to the relevant controller(s) on a confidential basis and that the controller(s) have committed themselves to confidentiality in respect of the same.
Notifications: For the purposes of Clause 8, Section II of Module Three of the Standard Contractual the data exporter shall use all reasonable endeavours to ensure any instructions provided by the relevant controller(s) are directed via the data exporter. The data exporter shall be responsible for ensuring any notifications provided by the data importer are promptly notified to the relevant controller(s) to fulfil the data importer’s notification obligations pursuant to Clause 8.
Sub-Processors: For the purposes of Clause 9, Section II of Module Two and Module Three of the Standard Contractual Clauses, the Parties agree that option 2: general written authorisation shall apply, and the data importer shall notify the data exporter of any changes in accordance with clause 6.1 of the DPA. For the purposes of Clause 9, Section II of Module Three of the Standard Contractual Clauses, the data importer shall notify the data exporter of any changes to a Sub-Processor and the data exporter shall be responsible for ensuring such notifications are provided to the relevant controller(s) and shall inform the data importer of any objections within the time frames specified. Copies of any Sub-Processor Engagement Letters (redacted as appropriate) requested from the data importer shall be provided to the data exporter for onward provision to the relevant controller, as applicable.
Data Subject Rights: For the purposes of Clause 10(a) to (c) Section II of Module Three of the Standard Contractual Clauses, the Parties acknowledge that given the nature of the Processing by the data importer it would not be appropriate for the data importer to notify or assist the controller directly in respect of any requests received from a Data Subject.
Transfer impact assessment: For the purposes of Clause 14(c), Section III of Module Two and Module Three of the Standard Contractual Clauses, the data exporter acknowledges that Azets may transfer Personal Data to the countries listed at https://www.azets.co.uk/about-us/policies-legal/privacy-policy/processors or https://www.blickrothenberg.com/privacy-policy/privacy-policy-processors as applicable. The data exporter acknowledges a transfer impact assessment has been made available by the data importer on or prior to the date of the Engagement Letter which the data exporter accepts as sufficient to fulfil the data importer’s obligations pursuant to Clause 14(c) and 14(a) of the Standard Contractual Clauses.
For the purposes of Clause 14(c), 15.1(b) and 15.2, Section III of Module Two and Module Three of the Standard Contractual Clauses, the Parties agree that “best efforts” and the obligations of the data importer under clause 15.2 shall mean exercising the degree of skill and care, diligence, prudence and foresight which would reasonably and ordinarily be expected from a leading practice engaged in a similar type of undertaking under the same or similar circumstances and shall not include actions that would result in civil or criminal penalty such as contempt of court under the laws of the relevant jurisdiction.
Governing law and Jurisdiction: For the purposes of Clause 17 and 18, Section IV of Module Two and Module Three of the EU SCCs, the Parties agree that the laws and courts of Norway shall apply. For the purpose of the UK Addendum, the Parties acknowledge and accept that the laws and courts of England and Wales shall apply.
Supplementary clauses for Module Four:
Erasure and Deletion: For the purposes of Clause 8.1(d), Section II of Module Four of the Standard Contractual Clauses, the data exporter shall delete the Personal Data in accordance with clause 9.1 of the DPA.
Governing law and Jurisdiction: For the purposes of Clauses 17 and 18, Section IV of Module Four of the EU SCCs and the UK Addendum, the Parties agree that the laws and courts of England and Wales shall apply.
Effective 23 January 2023