Annex III — UK Addendum to the Data Processing Agreement

UK Addendum to the Data Processing Agreement

For Processing involving United Kingdom personal data

Last update: 05/18/2026

This Annex III (EU) (the "UK Addendum") forms part of the Software as a Service Agreement (the "SSA") between Maestra B.V. ("Provider") and the Customer identified in the Engagement Letter. This UK Addendum applies whenever the Customer Processes Personal Data of data subjects in the United Kingdom through the Services, or whenever the UK GDPR otherwise applies to such Processing.

Capitalized terms not defined in this UK Addendum have the meanings given in the SSA and in the applicable Data Processing Agreement (Annex 1 (EU) for Customers established within the European Economic Area, or Annex 2 (EU) for Customers established outside the European Economic Area). Where terms used in this UK Addendum are defined in the UK GDPR or the United Kingdom Data Protection Act 2018, those terms shall have the same meaning as in that legislation.

1. Scope and Purpose

1.1. The purpose of this UK Addendum is to ensure that the Processing of Personal Data of data subjects in the United Kingdom through the Services complies with the UK GDPR, the United Kingdom Data Protection Act 2018, and any other applicable United Kingdom data protection legislation.

1.2. This UK Addendum applies in addition to, and modifies as set forth below, the Data Processing Agreement otherwise applicable to the Customer (Annex 1 (EU) or Annex 2 (EU), as applicable, together the "Underlying DPA").

2. Construction Rules

2.1. For the purposes of any Processing of Personal Data of data subjects in the United Kingdom under this UK Addendum and the Underlying DPA:

(a) references in the Underlying DPA to "the GDPR" or to "Regulation (EU) 2016/679" shall be read, in respect of Personal Data of data subjects in the United Kingdom, as references to the UK GDPR and the United Kingdom Data Protection Act 2018;

(b) references in the Underlying DPA to a "Member State" or to the "European Economic Area" shall be read, where the context relates to United Kingdom Personal Data, as references to the United Kingdom;

(c) references in the Underlying DPA to "Articles 13 and 14" or other Articles of the GDPR shall be read as references to the equivalent provisions of the UK GDPR;

(d) references in the Underlying DPA to a "supervisory authority" shall be read, in respect of Personal Data of data subjects in the United Kingdom, as references to the Information Commissioner’s Office.

2.2. Except as expressly modified by this UK Addendum, the Underlying DPA continues to apply in full.

3. International Transfers of United Kingdom Personal Data

3.1. Where the Processing of Personal Data of data subjects in the United Kingdom by Provider or by a sub-processor involves a transfer of Personal Data from the United Kingdom to a third country that does not benefit from an adequacy decision under Article 45 of the UK GDPR (or its UK equivalent regulations), the Parties incorporate by reference into this UK Addendum the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the United Kingdom Information Commissioner’s Office (Version B1.0, in force 21 March 2022, the "UK IDTA Addendum"). The authoritative text of the UK IDTA Addendum is available at:

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/

3.2. The UK IDTA Addendum operates as an addendum to the European Commission Standard Contractual Clauses ("SCCs") referenced in the Underlying DPA, and the SCCs are deemed to apply (with the modifications set forth in the UK IDTA Addendum) to such transfers of United Kingdom Personal Data.

4. Populated UK IDTA Addendum Tables

The Parties complete the tables of the UK IDTA Addendum as follows:

Table 1: Parties

The Parties to this UK Addendum are the data exporter (the Customer) and the data importer (Maestra B.V.), with the details set forth in Annex I.A of the Underlying DPA.

Start date: the Effective Date of the SSA.

Table 2: Selected SCCs, Modules and Selected Clauses

The version of the SCCs that this UK IDTA Addendum is appended to:

SCC version: the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021;
Module: Module Two (Controller to Processor);
Docking Clause: not applied;
Sub-processor authorisation: general written authorisation with thirty (30) calendar days’ advance notice of changes (or shorter notice in the emergency circumstances set forth in Section 2(c) of Annex 2 (EU) and Clause 7.7 of Annex 1 (EU), as applicable);
Independent dispute resolution: not applied;
Annexes to the SCCs: as set forth in the Underlying DPA (Annex I.A — List of Parties; Annex I.B — Description of the Transfer; Annex I.C — Competent Supervisory Authority; Annex II — Technical and Organisational Measures; Annex III — Sub-processors).

Table 3: Appendix Information

The Appendix Information required to complete the UK IDTA Addendum is the Appendix to the Underlying DPA (which sets out, in Annex I.A, I.B, I.C, II and III, the parties, description of transfer, competent supervisory authority, technical and organisational measures, and sub-processors). For the purposes of the UK IDTA Addendum, the competent supervisory authority is the Information Commissioner’s Office (replacing the Autoriteit Persoonsgegevens or other authority designated in Annex I.C), with contact details set forth in Section 5 below.

Table 4: Ending this Addendum when the Approved Addendum Changes

In accordance with Section 19 of the UK IDTA Addendum, the Parties select the following ending right when an Approved Addendum is revised by the Information Commissioner’s Office:

(a) Neither Party may end this UK Addendum solely on the basis that the Information Commissioner’s Office has issued a revised Approved Addendum that changes the Mandatory Clauses, provided that the revised Approved Addendum can reasonably be operated by Provider in the ordinary course of business;

(b) If the revised Approved Addendum materially affects the Processing under this UK Addendum and the Parties cannot reasonably operate under the revised Approved Addendum, either Party may end this UK Addendum upon thirty (30) days’ prior written notice to the other Party.

5. Competent Authority for UK Personal Data

The competent supervisory authority in respect of United Kingdom Personal Data Processed under this UK Addendum is:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire SK9 5AF

United Kingdom

Telephone: +44 (0) 303 123 1113

Website: https://ico.org.uk

6. Order of Precedence

6.1. In the event of any conflict or inconsistency between this UK Addendum and the Underlying DPA in respect of the Processing of Personal Data of data subjects in the United Kingdom, this UK Addendum shall prevail solely with respect to the UK-specific points.

6.2. In all other respects, including the substantive obligations of the Parties regarding Processing instructions, security, sub-processor engagement, audit, breach notification, data subject rights, and erasure or return of data at the end of the Processing, the Underlying DPA continues to apply in full.

6.3. This UK Addendum is incorporated into the SSA as part of the applicable DPA in accordance with Section 7.4 and Section 16.7 of the SSA.

7. Updates

7.1. If the Information Commissioner’s Office issues a successor to the UK IDTA Addendum, or if the United Kingdom adopts an updated transfer mechanism that materially affects the operation of this UK Addendum, the Parties shall negotiate in good faith any amendments to this UK Addendum required to implement such successor mechanism.

7.2. If the Parties do not reach mutual agreement on the required amendments within sixty (60) days from the date the successor mechanism enters into force, either Party may terminate the SSA in respect of the Processing of Personal Data of data subjects in the United Kingdom upon thirty (30) days’ written notice to the other Party.