Worldly Data Privacy Addendum
Last Updated: August 2026
This statement accompanies and explains the Data Privacy Addendum (the “Addendum”) and the basis on which Worldly Holdings Inc. (“Worldly”) classifies its role for personal data processed through the Worldly platform (the “Platform”). This Cover Statement is explanatory only and does not modify or form part of the Addendum.
Within the Worldly Platform, our brand customers may submit data (such as supplier or facility lists) and invite suppliers and facilities to register with the Worldly Platform to share information with Worldly, the brand, and other Platform users. Where a Supplier or facility accepts an invitation to use the Platform, or has already registered with the Platform, the supplier or facility enters into a direct contractual relationship with Worldly, creates their own account, and chooses which brands to share information with. Suppliers and facilities retain those accounts independently of, and after the end of, any Brand relationship. Worldly’s role as a controller or processor, therefore, differs by activity:
– Worldly is a Processor of Submitted Information: Worldly is a processor or service provider where a brand uploads a supplier or facility list to the Platform unless or until a supplier or facility registers directly with Worldly. That processing is on the brand’s behalf under GDPR/UK GDPR Arts. 4(8) and 28.
– Worldly is a Controller of Facility/Supplier Information: Once a facility or supplier creates an account within the Worldly Platform, Worldly processes the supplier’s or facility’s data as an independent controller under its own customer relationship with the facility/supplier, pursuant to the Worldly Terms of Use. Worldly cannot grant a brand control or deletion rights over data held in its controller relationship with a supplier without breaching its obligations to that supplier.
– Worldly is an independent controller of Account Data: Worldly has an independent need to collect registration, account, authentication, usage, IP, device, and billing, support, and similar administrative data from all users in order to provide, maintain and secure the Platform, and for its own business administration purposes. For this processing, Worldly determines the purposes and essential means, selects its lawful basis, and sets retention, notices, and data-subject rights handling under GDPR/UK GDPR Arts. 4(7), 5, 6, 12–22, and 24.
Legal Analysis under the GDPR and UK GDPR
Functional classification (EU and UK).
Under GDPR Art. 4(7) and UK GDPR Art. 4(7), the controller is the person who, alone or jointly with others, determines the purposes and means of processing. Under GDPR Art. 4(8) and UK GDPR Art. 4(8), the processor processes personal data on behalf of the controller. Classification is functional and fact-based; contractual labels are not decisive. The European Data Protection Board confirms that the same entity may act as controller for certain processing operations and as processor for others, assessed activity by activity. See EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR (Version 2.1, adopted 7 July 2021; minor corrections 20 September 2022), para. 24–26; GDPR Recital 79 (allocation of responsibilities). The UK Information Commissioner’s Office applies the same purposes-and-means test under the UK GDPR.
Independent (not joint) controllers.
Joint controllership under GDPR Art. 26 and UK GDPR Art. 26 arises only where two or more controllers jointly determine the purposes and means of the same processing. The ICO confirms that parties are not joint controllers if they process the same data for different purposes. Here, Worldly and each brand (and each supplier after registration) separately determine their own purposes, lawful bases, notices, and responses to data-subject rights for their respective processing; they do not jointly decide shared purposes and essential means. The relationship is therefore independent controllership, not Art. 26 joint controllership (Addendum § 5). See GDPR/UK GDPR Art. 26; ICO, Controllers and processors guidance (joint controllers); EDPB Guidelines 07/2020.
Limited processor processing and safeguards.
For the brand-uploaded supplier/facility lists, and only until the supplier or facility registers with Worldly, Worldly processes that data on the brand’s behalf as processor. That limited processing is governed by a binding contract meeting GDPR Art. 28(3) and UK GDPR Art. 28(3) (subject-matter, duration, nature and purpose, types of data and data subjects, and processor obligations including documented instructions, confidentiality, security, sub-processor authorization, assistance with data-subject rights, return or deletion, and audit). Parallel California service-provider restrictions under Cal. Civ. Code § 1798.140(ag) apply to that same limited slice (Addendum § 5). After registration, Worldly no longer processes that data as the brand’s processor; it processes as an independent controller under its direct relationship with the supplier.
Cross-border transfers.
Where personal data is transferred from the EEA to a third country without an adequacy decision, the EU Standard Contractual Clauses under Commission Implementing Decision (EU) 2021/914 apply: Module One (controller-to-controller) for transfers between independent controllers, and Module Two (controller-to-processor) for the limited processor processing. For restricted transfers from the UK, the parties rely on the UK International Data Transfer Agreement (IDTA) or the EU SCCs together with the UK Addendum to the EU SCCs, as applicable. Swiss transfers use the EU SCCs with Swiss adaptations recognised by the FDPIC, as applicable (Addendum § 10).
Retention, return/deletion, and precedence.
Consistent with controller accountability (GDPR/UK GDPR Arts. 5(1)(e) and 5(2)), Worldly retains controller personal data under its own retention policies and lawful bases. For the limited processor processing, Worldly returns or deletes the relevant personal data at the Brand’s election when processing ends, as required by GDPR/UK GDPR Art. 28(3)(g) (Addendum § 11). The Addendum prevails over any inconsistent Agreement or Terms of Use term as to personal data (Addendum § 2); commercial terms remain in the Order Form.
WORLDLY HOLDINGS INC.
DATA PRIVACY ADDENDUM
This Data Privacy Addendum (“Addendum”) is a binding agreement between you (“Company”) and Worldly Holdings Inc. (“Worldly”) on behalf of itself and its affiliates, effective as of the date of acceptance of the Terms of Use (the “Agreement”). This Addendum is incorporated by reference into the Agreement and forms part of the Agreement. The term “Platform” “Services” has the meaning set forth in the Agreement.
- Definitions.
1.1. “Data Privacy Laws” means all applicable data protection and data privacy laws and regulations, including but not limited to the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), and other applicable U.S. federal and state privacy laws, and the European Union General Data Protection Regulation (“GDPR”), where applicable to the Services specified in the Agreement and/or the Company Personal Information to be Processed hereunder, as such laws may be amended or replaced from time to time, including laws and regulations that are enacted or become effective after the Effective Date.
1.2. “Company Personal Information” means Personal Information that Company submits to the Platform in connection with Company’s access to and use of the Services (as defined in the Agreement).
1.3. “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.
1.4. “Processing” means any operation or set of operations which is performed upon Personal Information, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available. The terms “Process,” “Processes,” and “Processed” shall have the same meaning.
1.5. “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Information transmitted, stored, or otherwise Processed under this Addendum. Where the GDPR applies, a Security Incident includes a “personal data breach” within the meaning of Article 4(12) of the GDPR.
1.6. “Supervisory Authority” means an independent public authority established under Data Privacy Laws that is responsible for monitoring the application of those laws, including a supervisory authority within the meaning of Article 51 of the GDPR.
- Order of Precedence and Interpretation. In this Addendum, capitalized terms shall have the meanings set out herein and any capitalized terms which are not defined in this Addendum shall have the meanings ascribed to such terms in the Agreement. In the event that any terms of this Addendum and its appendices are inconsistent with any other terms of the Agreement, the terms of this Addendum and its appendices will prevail, except as otherwise indicated in this Addendum.
- Roles of the Parties. Except as expressly set out below, each party is an independent controller in respect of the Personal Information it Processes under this Addendum and separately determines the purposes and means of its own Processing.
3.1. Worldly as a Controller. Worldly operates as an independent controller with respect to (a) user registration and account information, log-in credentials, IP addresses, device and usage data, billing information, support information, and other general administrative and business information that Worldly collects from users of the Platform, and (b) any information that is submitted to the Platform by a facility or supplier user.
3.2. Worldly as a Processor. Subject to Section 3.1, Worldly acts as a processor solely with respect to Personal Information that Company uploads to the Worldly Platform. Company acknowledges that, in some cases, the Personal Information that Company uploads to the Worldly Platform may be the same Personal Information that Worldly collects as a controller directly from the applicable supplier or facility pursuant to such supplier or facility registering and creating an account within the Worldly Platform.
- Details of Processing. The subject matter of the Processing is set forth in the Agreement, and the duration of Processing will be for the duration of the Agreement (or as otherwise defined in the Agreement). The nature and purpose of the Processing is the provision of the Services by Worldly to Company as further described in the Agreement.
- Processing of Company Personal Information. Where Worldly Processes Company Personal Information as a processor pursuant to Section 3, Worldly will Process such Company Personal Information only to perform the Services and in accordance with Company’s lawful, documented instructions (which consist of the terms of the Agreement and this Addendum) or as required by law, and will not (i) retain, use, or disclose such Company Personal Information outside the direct business relationship with Company; or (ii) sell such Company Personal Information, or share it for cross-context behavioral advertising, as those terms are defined by Data Privacy Laws. Each party will ensure that persons it authorizes to Process Personal Information are subject to an appropriate duty of confidentiality. Worldly will take all measures required pursuant to Article 32 of the GDPR with respect to such Company Personal Information. Worldly will promptly inform Company if, in Worldly’s opinion, an instruction infringes the GDPR or other applicable Data Privacy Laws.
- Independent Controller. Where a party Processes Personal Information as an independent controller and such party individually responsible for (a) determining the purposes and means of its own Processing; (b) establishing a lawful basis for its Processing; (c) providing any required notices to, and honoring the rights of, data subjects in respect of its Processing; and (d) complying with the Data Privacy Laws applicable to it. Neither party Processes Personal Information received from the other party subject to the other party’s instructions, except as provided below.
- Subprocessors. Each party may engage third-party processors (each, a “Subprocessor”) to Process Personal Information in connection with its own Processing activities, as described in that party’s privacy policy or subprocessor list. Where, and only to the extent, Worldly acts as a processor pursuant to Section 3, Worldly will engage Subprocessors under a written contract imposing data-protection obligations substantially consistent with those in this Addendum, and will remain responsible to Company for such Subprocessor’s performance of those obligations. Each party acting as an independent controller is responsible for its own Subprocessors.
- Individual Requests. Each party is responsible for responding to requests it receives from data subjects (or their authorized agents) to exercise rights under Data Privacy Laws in respect of Personal Information for which it is the controller. Each party will provide reasonable cooperation and assistance to the other to enable the other to comply with such requests and with its obligations under Data Privacy Laws. If a party receives a request concerning Personal Information for which the other party is responsible, it will, without undue delay, direct the individual to the other party or forward the request to the other party. With respect to Company Personal Information, Worldly will assist Company with, and forward to Company, requests relating to the Company Personal Information Worldly Processes on Company’s behalf.
- Information and Assessments. Each party will, on reasonable request and no more than once per year (unless a Security Incident affecting the requesting party or a Supervisory Authority requires otherwise), make available to the other information reasonably necessary to demonstrate its compliance with Data Privacy Laws in respect of its Processing under this Addendum. A party may satisfy this obligation by providing a summary of a current third-party audit, certification, or attestation (for example, SOC 2 Type II or ISO/IEC 27001). The scope, timing, and confidentiality of any such exchange will be mutually agreed in advance.
- Compliance. Each party will comply with the Data Privacy Laws applicable to it and will protect Personal Information as required by Data Privacy Laws. Each party will provide reasonable assistance to the other to enable the other to meet its obligations under Data Privacy Laws to the extent related to the Processing under this Addendum. If a party determines that it can no longer meet its obligations under Data Privacy Laws in a manner that materially affects the other party’s Personal Information, it will notify the other party in writing within five (5) business days, and the parties will cooperate in good faith to remediate or, if remediation is not achievable, to wind down the affected Processing.
- Cross-Border Transfers; Standard Contractual Clauses. To the extent a party’s Processing under this Addendum involves a transfer of Personal Information protected by European Data Protection Laws to a country that has not received an adequacy decision, the parties incorporate by reference the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), which are deemed executed by the parties: (a) for transfers between the parties as independent controllers, Module One (controller-to-controller) applies; and (b) to the extent Worldly acts as a processor with respect to Company Personal Information, Module Two (controller-to-processor) applies. For transfers subject to UK data protection law, the parties incorporate the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; and for transfers subject to Swiss law, the Clauses apply with the amendments required by the Swiss Federal Act on Data Protection. In the event of any conflict, the Standard Contractual Clauses prevail over this Addendum with respect to that transfer.
- Deletion or Return of Company Personal Information. To the extent, and only to the extent, that Worldly Processes Company Personal Information as a processor pursuant to Section 3, then at Company’s request during the term or on termination or expiration of the Agreement, Worldly will, within sixty (60) calendar days, return to Company or delete (or anonymize) such Company Personal Information in its possession, except to the extent retention is allowed or required by law. For all other Personal Information that Worldly Processes as an independent controller, including account, registration, user-generated, log-in, IP, device, usage, billing, support, and supplier- or facility-submitted data, Company acknowledges that Worldly may retain and continue to Process such Personal Information after termination in accordance with Worldly’s own data retention and deletion policies and applicable law.
- Term. The term of this Addendum commences on the Effective Date and continues for so long as either party Processes Personal Information in connection with the Agreement. Provisions that by their nature should survive termination, including those governing each party’s status as an independent controller, the retention and use of Personal Information as a controller, security, and cross-border transfers, will survive termination or expiration of the Agreement and this Addendum.
- IT Security. Each party will implement and maintain appropriate technical and organizational measures designed to protect the Personal Information it Processes against Security Incidents. If Worldly experiences a Security Incident affecting Company Personal Information Processed under this Addendum, Worldly will notify Company without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of it, will provide sufficient detail to enable the Company to meet its obligations under Data Privacy Laws, and will reasonably cooperate in the investigation, mitigation, and remediation of the Security Incident. Each party’s liability arising out of or relating to this Section and any Security Incident is subject to the limitations of liability set out in the Agreement.
- Deidentified Information. If Worldly receives Deidentified Information from Company, or creates Deidentified Information at Company’s instruction, Worldly will (i) take reasonable measures to ensure the Deidentified Information cannot be associated with an individual or household, (ii) publicly commit to maintain and use the Deidentified Information in deidentified form, and (iii) not attempt to reidentify the Deidentified Information except for the sole purpose of determining whether Worldly’s deidentification processes satisfy the requirements of applicable Data Privacy Laws. For purposes of this Addendum, “Deidentified Information” means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular individual.
APPENDICES TO THE DATA PRIVACY ADDENDUM
The following Appendices form part of, and are incorporated by reference into, this Addendum. Except as the context requires, capitalized terms have the meanings given in the Addendum or the Agreement. Where a field is shown in square brackets, it is to be completed for the applicable Company / transaction.
APPENDIX A
Description of the Processing
This Appendix A describes the Processing of Personal Information under this Addendum and reflects the allocation of roles in Section 3 (Roles of the Parties): except for the limited processor role described in Part 2, each party acts as an independent controller. Where the Standard Contractual Clauses apply (see Appendix C), this Appendix A constitutes Annex I.B (Description of the transfer) to those clauses.
Part 1 – Processing by each party as an independent controller
Categories of data subjects | • The Company’s authorized users and personnel who access the Worldly Platform (e.g. sustainability, procurement, and compliance staff); • The Company’s suppliers and facilities, and the contact persons of those suppliers and facilities, who are invited to, register with, or submit data to the Worldly Platform; • Other users of the Worldly Platform who interact with the Company’s account. |
Categories of Personal Information | • User registration and account information; • Log-in credentials and authentication data; • IP addresses, device data, and usage / activity data (e.g. log-in times, pages accessed); • Billing and support contact information and the content of related support and service communications; • Business contact details of supplier and facility representatives (e.g. name, business email, business telephone, job title, employer / facility); • Data that a supplier or facility submits directly upon registering and creating its own account within the Worldly Platform, including Higg Index (e.g. FEM / FSLM) assessment data to the extent it relates to an identifiable individual. |
Special categories of data (sensitive data) | None intended. The Worldly Platform is not designed or intended to Process special categories of Personal Information within the meaning of Article 9 GDPR, and the parties will not upload, submit, or otherwise make available such data through the Worldly Platform. |
Frequency of the Processing / transfer | Continuous, for the duration of the Agreement, and (for Personal Information each party Processes as a controller) on an ongoing basis thereafter in accordance with that party’s own retention and deletion policies. |
Nature of the Processing | Collection, recording, organization, structuring, storage and hosting, authentication, use, retrieval, consultation, analysis, disclosure by transmission between the parties and to their respective sub-processors, and erasure or anonymization. |
Purpose(s) of the Processing | Provision and receipt of the Services and the Worldly Platform, including creating and administering user accounts; authentication; hosting, storing, and analyzing supply-chain environmental and social performance data; onboarding and engaging the Company’s suppliers and facilities; administering Higg Index (e.g. FEM / FSLM) assessments; and providing related reporting, support, and communications. In addition, each party Processes Personal Information as a controller for its own compliance, security, billing, product-improvement, and other legitimate business purposes. |
Retention period | As set out in Section 12 of the Addendum, Worldly may retain and continue to Process Personal Information it holds as a controller after termination of the Agreement. |
Part 2 – Processing by Worldly as a processor
This Part 2 applies only to the limited processor role described in Section 3, namely Personal Information that the Company uploads to the Worldly Platform (such as a supplier or facility list), and only until the applicable supplier or facility registers and creates its own account within the Worldly Platform, after which Worldly Processes that Personal Information as an independent controller (and Part 1 applies).
Categories of data subjects | Contact persons of the Company’s suppliers and facilities identified in a list or file that the Company uploads to the Worldly Platform prior to the registration of the applicable supplier or facility. |
Categories of Personal Information | Business contact details contained in the uploaded list or file (e.g. name, business email address, business telephone number, employer / facility, and job title). |
Special categories of data (sensitive data) | None. |
Nature and purpose of the Processing | Hosting and making available the uploaded list or file solely to enable Worldly to provide the Services (e.g. to invite and onboard the identified suppliers or facilities), on the Company’s documented instructions (which consist of the terms of the Agreement and this Addendum). |
Duration of the Processing | From upload until the earlier of (i) the applicable supplier or facility registering and creating its own account within the Worldly Platform (after which the data is Processed by Worldly as an independent controller under Part 1), or (ii) the return, deletion, or anonymization of the Company Personal Information in accordance with Section 12. |
Frequency of the transfer | Continuous during the limited window described above. |
For transfers of Personal Information Processed under this Part 2, Module Two (controller-to-processor) of the EU Standard Contractual Clauses applies; for transfers of Personal Information Processed under Part 1 between the parties as independent controllers, Module One (controller-to-controller) applies (see Appendix C).
APPENDIX B
Technical and Organisational Measures
This Appendix B describes the technical and organisational measures implemented by Worldly pursuant to Section 14 (IT Security). Where the Standard Contractual Clauses apply (see Appendix C), this Appendix B constitutes Annex II (Technical and organisational measures) to those clauses. Each party is responsible for maintaining appropriate technical and organisational measures for the Personal Information it Processes as a controller; the measures set out below describe those of Worldly as the party that hosts and operates the Worldly Platform.
The measures are evidenced by Worldly’s SOC 2 Type II attestation covering the Worldly Platform (independent service auditor’s report; renewed periodically; available under NDA via trust.worldly.io). Worldly operates as a fully remote organization and hosts its production environment on Amazon Web Services (“AWS”); AWS provides physical and environmental data-center security as a sub-processor under its own certifications (e.g. ISO/IEC 27001, SOC 2). Worldly does not maintain its own data center.
1. Confidentiality (Art. 32(1)(b) GDPR)
Physical access control | Production infrastructure is hosted in AWS data centers; physical and environmental access controls are operated by AWS under its certifications. Worldly has no self-managed data-center facilities; personnel work remotely on managed endpoints. |
System access control | Logical access to production systems is restricted to authorized personnel on a least-privilege basis. Identity and access management services. Administrative access requires individual user accounts and is subject to periodic access reviews. |
Data access control | Role-based access controls govern access to Personal Information. Customer data is logically segregated between tenants. Access to production data is logged and monitored. |
Separation control | Production and non-production environments are separated. Customer data is processed and stored separately from that of other customers. |
Encryption | Personal Information is encrypted in transit and at rest using industry-standard encryption technologies. |
2. Integrity (Art. 32(1)(b) GDPR)
Transfer control | Data in transit is protected by encryption (TLS). Transfers of Personal Information to the United States are made on the basis of the EU Standard Contractual Clauses, supplemented by the measures in this Appendix. |
Input control | System and user activity is logged, providing audit trails that record who has entered, changed, or removed Personal Information within the production environment. |
3. Availability and resilience (Art. 32(1)(b),(c) GDPR)
Availability control | The environment is protected by intrusion-detection and threat-detection, monitoring, and network controls provided. |
Recoverability | Data is backed up using AWS backup services, with recovery procedures maintained by the Worldly engineering team. |
Resilience testing | Regular vulnerability scans across systems and networks, and penetration testing over the production environment, are performed. |
4. Procedures for regular review, assessment, and evaluation (Art. 32(1)(d) GDPR)
Independent assurance | Worldly maintains a SOC 2 Type II attestation over the Worldly Platform, examined by an independent service auditor; the report is renewed periodically and available under NDA via trust.worldly.io. |
Information security management | Documented security policies and operational procedures govern the environment, including change management and risk management. |
Incident and breach response | Operational procedures exist for managing security incidents, including notification procedures supporting the breach-notification obligations in Section 14. |
Staff confidentiality and training | Personnel with access to Personal Information are bound by confidentiality obligations and receive security and data-protection awareness training. |
Data retention and disposal | Data-retention and data-disposal procedures are applied, consistent with the deletion provisions of the Addendum and Appendix A. |
Sub-processor / onward-transfer management | Sub-processors are subject to due diligence and contractual data-protection obligations. The current sub-processor list is maintained at trust.worldly.io. |
APPENDIX C
EU Standard Contractual Clauses
For transfers of Company Personal Information, the parties are deemed to have entered into the Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the “EU SCCs”), which are incorporated by reference. This Appendix C records the parties’ module selections and clause options and completes Annex I.A, Annex I.C, and Annex III of the EU SCCs. Annex I.B (Description of the transfer) is set out in Appendix A and Annex II (Technical and organizational measures) is set out in Appendix B.
Modules. Module One (controller-to-controller) applies to transfers between the parties as independent controllers. Module Two (controller-to-processor) applies to the extent, and only to the extent, that Worldly acts as a processor pursuant to Section 3 of the Addendum with respect to Company Personal Information. For transfers of Company Personal Information from an establishment in the EEA to Worldly in the United States, the Company is the data exporter and Worldly is the data importer.
Clause options
Clause 7 (Docking clause) | Applies. The optional docking clause is included, so that an entity that is not a party may accede to the EU SCCs with the agreement of the parties. |
Clause 9 (Use of sub-processors) – Module Two only | Option 2 (General written authorization). The data importer may engage sub-processors from the list maintained at trust.worldly.io and will inform the data exporter of intended changes at least thirty (30) days in advance, giving the exporter the opportunity to object. |
Clause 11 (Redress) | The optional language providing for an independent dispute-resolution body is not used. |
Clause 17 (Governing law) | The EU SCCs are governed by the law of the EU Member State in which the data exporter is established; where that Member State’s law does not allow for third-party beneficiary rights, the law of Ireland. |
Clause 18(b) (Choice of forum and jurisdiction) | The courts of the EU Member State whose law governs under Clause 17 (or, where that is Ireland, the courts of Ireland). |
Relationship to the Agreement. The governing law and forum selected above apply solely to disputes arising under the EU SCCs and do not alter, and are without prejudice to, the governing law or forum of the Agreement or this Addendum.
Annex I.A – List of the parties
Data exporter | Company (contact information as set forth in the Service Order) |
Data importer | Name: Worldly Holdings, Inc. Address: 2041 East St PMB 833, Concord, CA 94520, USA. Contact person’s name, position, and contact details: Worldly Privacy / Data Protection Team, privacy@worldly.io. Activities relevant to the data transferred: provision, hosting, and operation of the Worldly Platform and the Services, as described in Appendix A. Role: controller (Module One); processor (Module Two). |
APPENDIX D
UK International Data Transfer Addendum
Transfers of Company Personal Information subject to UK data protection law are made under the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner, version B1.0, in force 21 March 2022 (the “UK Addendum”), the Mandatory Clauses of which are incorporated by reference. The parties are deemed to have entered into the UK Addendum, completed as set out below. This Appendix D applies only where the United Kingdom General Data Protection Regulation and/or the Data Protection Act 2018 govern the transfer.
Table 1: Parties | The data exporter and data importer are as set out in Appendix C (Annex I.A). The start date is the effective date of the Addendum. |
Table 2: Selected SCCs, Modules and selected clauses | The Approved EU SCCs, including the Appendix Information and with only the modules and clause options selected in Appendix C (Module One and, to the extent Worldly acts as a processor, Module Two). |
Table 3: Appendix Information | Annex 1A (List of Parties): Appendix C. Annex 1B (Description of Transfer): Appendix A. Annex II (Technical and organisational measures): Appendix B. Annex III (List of Sub-processors): Appendix C. |
Table 4: Ending this Addendum when the Approved Addendum changes | Either party may end the UK Addendum as set out in Section 19 of the UK Addendum. |
APPENDIX E
Switzerland
For transfers of Company Personal Information subject to the Swiss Federal Act on Data Protection (“FADP”), the EU SCCs in Appendix C apply with the following adaptations: (i) references to the “GDPR” are understood to be references to the FADP insofar as the transfer is governed by the FADP; (ii) the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (“FDPIC”) insofar as the transfer is governed by the FADP; (iii) the term “Member State” must not be interpreted so as to exclude data subjects in Switzerland from suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c); (iv) references to EU Member State law and to the courts of an EU Member State include Switzerland and the Swiss courts where the FADP governs the transfer; and (v) until the entry into force of the revised FADP, the EU SCCs also protect the Personal Information of legal entities until such data no longer receives protection under the FADP.
