Optimizely Logo

UK Addendum to the EU Commission Standard Contractual Clauses

Optimizely DPA Exhibit 3A

International data transfer addendum to the EU Commission

Standard Contractual Clauses

In cases of Personal Data transfer from and to the United Kingdom this Exhibit 3A applies in addition to the applicable Standard Contractual Clauses. This Exhibit 3A is a true copy of the template addendum version B.1.0 issued by the
UK Information Commissioner under S119A(1) Data Protection Act 2018 and laid before the UK Parliament on 2 February 2022, subject to completion of Tables 1, 2, 3, and 4, and subject to section 9 of the DPA to which this Exhibit 3A is attached. This UK Addendum is deemed entered into by the parties identified in Table 1 below, and is deemed entered into on the Effective Date of the DPA.

PART 1: TABLES

Table 1: Parties

Start date

­­­Effective Date (See Order Form)

The Parties

Exporter (who sends the Restricted Transfer)

Importer (who receives the Restricted Transfer)

Parties’ details

Customer and/or the Customer Affiliates operating in the countries which comprise the European Economic Area, UK and/or Switzerland and/or – to the extent agreed by the Parties – Customer and/or the Customer Affiliates in any other country to the extent the GDPR or corresponding Swiss law applies.

Customer and Customer Affiliate’s contact person’s position and contact details as well as (if appointed) the data protection officer’s and (if relevant) the representative’s contact details will be notified to Optimizely prior to the processing of Personal Data via email to privacy@optimizely.com or an available form provided by Optimizely in Customer’s account in the Services.

The activities relevant to the data transfer under these Clauses are defined by the Agreement and the data exporter who decides on the scope of the Processing of Personal Data in connection with the Services further described in Exhibit1 and in the Agreement.

The Optimizely company identified in the applicable order form under the Agreement.

The data importer’s contact person can be contacted at privacy@optimizely.com

The data importer’s activities relevant to the data transfer under these Clauses are as follows: the data importer Processes Personal Data provided by the data exporter on behalf of the data exporter in connection with providing the Software Services to the data exporter as further specified in Exhibit 1 and in the Agreement.

Key Contact

Customer and Customer Affiliate’s contact person’s position and contact details as well as (if appointed) the data protection officer’s and (if relevant) the representative’s contact details will be notified to Optimizely prior to the processing of Personal Data via email to privacy@optimizely.com or an available form provided by Optimizely in Customer’s account in the Services.

The data importer’s contact person can be contacted at privacy@optimizely.com

 

Table 2: Selected SCCs, Modules and Selected Clauses

Addendum EU SCCs

The Approved EU SCCs, including the Appendix Information and with only the following modules, clauses or optional provisions of the Approved EU SCCs brought into effect for the purposes of this Addendum.

· Module 2 - Exhibit 2: Standard Contractual Clauses (Controller to Processors)

· Module 3 - Exhibit 2A: Standard Contractual Clauses (Processor to Processors)

As amended by Section 9.3 of the DPA.

Applicable clauses or optional provisions:

· Clause 7 (Docking Clause): refer to section 9.4 of the DPA.

· Clause 11 (Option): refer to section 9.4 of the DPA.

· Clause 9a (Prior Authorisation or General Authorisation): refer to section 9.4 of the DPA.

· Clause 9a (Time period): refer to section 9.4 of the DPA.

Table 3: Appendix Information

“Appendix Information” means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out: is as follows:

Annex 1A: List of Parties: as specified in Table 1 above of this Exhibit 3A.

Annex 1B: Description of Transfer: as specified in Exhibit 1 of the DPA to which this Exhibit 3A is attached.

Annex II: Technical and organization measures, including Technical and organization measures to ensure the security of the data: as further specified in Exhibit 2 of the DPA to which this Exhibit 3A is attached. For reference: https://www.optimizely.com/trust-center/privacy/sub-processors/).

Annex III: List of Sub-processors (Modules 2 & 3 only): as further specified in section 8 of the DPA to which this Exhibit 3A is attached.

Table 4: Ending this Addendum when the Approved Addendum Changes

Ending this Addendum when the Approved Addendum changes

Optimizely (as data importer) may end this DPA, to the extent the UK Addendum applies, in accordance with clause ‎19 of the Mandatory Clauses.

PART 2: MANDATORY CLAUSES

Mandatory Clauses

Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section ‎‎18 of those Mandatory Clauses.