Data Processing Addendum


Last updated and effective as of September 28, 2026 (the “DPA Date”).

This Data Processing Addendum (“DPA”), forms part of the Software-as-a-Service Subscription Agreement (as applicable, the “Agreement”) between Auxilius, Inc. (“Auxilius”) and the entity that has engaged Auxilius to provide the Service (“Customer”). Capitalized terms used and not otherwise defined herein shall have the meanings ascribed to them in the Agreement. In the event of a conflict between this DPA and any other terms in the Agreement, the terms of this DPA will govern. Each of Auxilius and Customer is referred to in this DPA individually as a “party”, collectively the “parties”. By entering into the Agreement, the parties are deemed to have signed all Exhibits, Attachments, Annexes, Schedules, and Appendices, including those incorporated by reference, to this DPA where applicable.
‍

  1. Definitions. For the purposes of this DPA:  
    1. “Customer Data” means any information Processed by Auxilius solely on behalf of Customer, including without limitation any EU Personal Data and/or UK Personal Data.
    2. “GDPR” means the General Data Protection Regulation (EU) 2016/679.
    3. “Personal Data” means (1) any information relating to any identified or identifiable individual; and (2) any information defined as “personal information,” “personal data,” “personally identifiable information,” or similar terms used in Privacy Laws, in each case as Processed by Auxilius under or in connection with the Agreement.
    4. "Privacy Laws" means any applicable data protection or privacy laws, rules and regulations applicable to the Processing of Personal Data under or in connection with the Agreement.
    5. “Processing” (including any grammatically inflected forms thereof) means any operation or set of operations which is performed on data or on sets of data, whether or not by automated means, including without limitation collection, recording, organization, structuring, storage, adaptation or alteration, access, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
    6. “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored or otherwise Processed.
    7. “UK” means the United Kingdom.
    8. “UK Data Protection Laws” means the UK GDPR and the UK’s Data Protection Act 2018 (“UK DPA 2018”).
    9. “UK GDPR” means the UK equivalent of the GDPR, as defined in section 3(10) (and as supplemented by section 205(4)) of the UK DPA 2018.

‍

  1. Roles of the Parties. Except as otherwise expressly set out in this DPA, as between the parties Customer is the controller and Auxilius is the processor with respect to Personal Data Processed under the Agreement. Where Customer acts as a processor on behalf of a third party, Auxilius acts as a sub-processor and references to Customer as controller are construed accordingly.

‍

  1. Data Processing. Auxilius shall:
    1. Process Personal Data only in accordance with the Agreement unless Auxilius is required by applicable laws or binding order of a governmental entity to otherwise Process the Personal Data; in such a case Auxilius shall inform Customer of this legal requirement before Processing unless such applicable laws prohibit such information on important grounds of public interest;  
    2. immediately inform Customer if, in Auxilius’ opinion, Processing the Personal Data in accordance with a written instruction received from Customer or in the performance of its obligations under the Agreement infringes Privacy Laws;  
    3. taking into account the nature of Auxilius' Processing of Personal Data and of the information available to Auxilius, and at Customer's request, provide reasonable assistance to Customer in ensuring compliance with its obligations under the Privacy Laws, including to carry out data protection impact assessments, address consumer and/or data subject rights, fulfill notice obligations, and seek prior consultation of the governmental authorities;
    4. at the election of Customer, delete or return all Personal Data to Customer at any time and/or at the end of the term of the Agreement, and securely delete existing copies of such data unless Privacy Laws require storage of such data beyond such term. In such case, Auxilius shall notify Customer of the applicable legal requirement, details of Personal Data to be retained and a timeline for the return and/or deletion of the Personal Data once the specific retention requirement ends;  
    5. make available to Customer, at Customer's request and not more than once annually (except following a Security Incident or where required by a supervisory authority), information reasonably necessary to demonstrate compliance with Auxilius' obligations under this DPA and Privacy Laws, and allow for and contribute to audits, including inspections, conducted by Customer or another auditor mandated by Customer (that is not a competitor of Auxilius) or under Privacy Laws. Such audits shall be conducted at Customer's expense,  on at least thirty (30) days' prior written notice, during normal business hours, subject to reasonable confidentiality obligations, and in a manner that does not unreasonably disrupt Auxilius' business or compromise the security or confidentiality of other customers' data. Auxilius may satisfy its obligations under this paragraph by providing its then-current SOC 2 Type 2 report and responses to a reasonable security questionnaire, provided such materials reasonably address Customer's inquiry; provided further that Auxilius shall notify Customer in writing if it believes in good faith that the exercise of rights under this paragraph 3(e) would infringe Privacy Laws;
    6. ensure that its personnel authorized to Process Personal Data are subject to written obligations of confidentiality or an appropriate statutory obligation of confidentiality, that such obligations survive the termination of their engagement, and that access to Personal Data is limited to those personnel who require it to perform Auxilius's obligations under the Agreement;
    7. implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR and any equivalent requirement under other Privacy Laws, including the measures set out in Section 4 and Annex II. Auxilius may update such measures from time to time provided that it does not materially reduce the overall level of security of the Service during the term of the Agreement;
    8. notify Customer without undue delay after becoming aware of a Security Incident affecting Personal Data. Such notification shall include the information then available to Auxilius regarding the nature of the Security Incident, the categories and approximate volume of Personal Data affected, the likely consequences, and the measures taken or proposed to address it. Where that information is not available at the time of the initial notification, Auxilius shall provide it in phases as it becomes available. Auxilius shall take reasonable steps to investigate, contain, and remediate the Security Incident and shall provide Customer with reasonable assistance in meeting Customer's own notification obligations under Privacy Laws. Auxilius's notification under this paragraph is not an acknowledgement of fault or liability;
    9. comply with Privacy Laws applicable to Auxilius in its capacity as a processor of Personal Data under the Agreement.

‍

  1. Data Security. Auxilius shall, when Processing Personal Data:
    1. comply, and require its personnel to comply, with a written information security program ("Information Security Program") designed to protect Personal Data that complies with Privacy Laws, is maintained in accordance with Auxilius's SOC 2 Type 2 program (a current SOC 2 Type 2 report shall be made available to Customer upon request), and that includes physical security, organizational security, network security, access, and antivirus and antimalware controls;
    2. taking into account any changes in the Processing activities, the risks and the applicable legal requirements, conduct periodic risk assessments and reviews of the Information Security Program at least annually or whenever there is a material change of practices that may affect the security, confidentiality or integrity of Personal Data;

‍

  1. Liability. Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement, and any reference in the Agreement to a party's liability includes liability under this DPA.

‍

  1. Sub-processing. Customer provides general authorization for Auxilius to engage sub-processors. The sub-processors engaged as of the effective date are listed in Annex III. Auxilius will notify Customer at least thirty (30) days before engaging a new sub-processor. Customer may object on reasonable data protection grounds within that period, in which case the parties will discuss the objection in good faith. If Auxilius proceeds notwithstanding an unresolved objection, Customer may terminate the affected portion of the Service on written notice and receive a pro-rata refund of prepaid fees for the terminated portion.

‍

  1. Auxilius shall ensure that each sub-processor it engages is bound by written obligations no less protective of Personal Data than those set forth in this DPA, and shall remain fully liable to Customer for the acts and omissions of its sub-processors to the same extent as if performed by Auxilius, subject to the limitations and exclusions of liability set out in the Agreement.

‍

  1. Cross-Border Transfers. To the extent Auxilius Processes Personal Data regulated by the GDPR solely on behalf of Customer (“EU Personal Data”), and to the extent Customer is a controller (as defined in the GDPR) and Auxilius is a processor (as defined in the GDPR) on behalf of Customer with regard to such EU Personal Data, then to the extent required by the GDPR, Module 2 of the Standard Contractual Clauses for the Transfer of Personal Data as set out in European Commission Decision 2021/914/EC, available at https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN (the “Controller to Processor Standard Contractual Clauses”) will apply to the transfer of such EU Personal Data by Customer to Auxilius and to Auxilius’ Processing of such EU Personal Data and the parties hereby agree to comply with such Controller to Processor Standard Contractual Clauses, which are hereby incorporated into the Agreement in their entirety, as set forth in Schedule A. In the event of a conflict between the Agreement and the Controller to Processor Standard Contractual Clauses, the Controller to Processor Standard Contractual Clauses will control to the extent applicable to such EU Personal Data.

‍

  1. To the extent Auxilius Processes EU Personal Data, and to the extent Customer is a processor (as defined in the GDPR) on behalf of a third party with respect to EU Personal Data and Auxilius is a processor on behalf of Customer with regard to such EU Personal Data, then to the extent required by the GDPR, Module 3 of the Standard Contractual Clauses for the Transfer of Personal Data as set out in European Commission Decision 2021/914/EC, available at https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32021D0914&from=EN (the “Processor to Processor Standard Contractual Clauses”) will apply to the transfer of such EU Personal Data by Customer to Auxilius and to Auxilius’ Processing of such EU Personal Data and the parties hereby agree to comply with such Processor to Processor Standard Contractual Clauses, which are hereby incorporated into the Agreement in their entirety, as set forth in Schedule B. In the event of a conflict between the Agreement and the Processor to Processor Standard Contractual Clauses, the Processor to Processor Standard Contractual Clauses will control to the extent applicable to such EU Personal Data.

‍

  1. To the extent Auxilius Processes Personal Data regulated by the UK Data Protection Laws solely on behalf of Customer (“UK Personal Data”), then to the extent required by the UK Data Protection Laws, the UK’s ‘International Data Transfer Addendum to the EU Commission Standard Contractual Clauses’, Version B1.0, in force from March 21, 2022, available at https://ico.org.uk/media/for-organisations/documents/4019535/addendum-international-data-transfer.docx (the “UK DTA”) will apply to the transfer of such UK Personal Data by Customer to Auxilius and to Auxilius’ Processing of such UK Personal Data and the parties hereby agree to comply with such UK DTA, which is hereby incorporated into the Agreement in its entirety and as set forth in Schedule C. In the event of a conflict between the Agreement and the UK DTA, the UK DTA will control to the extent applicable to the UK Personal Data.

‍

  1. U.S. State Privacy Laws. To the extent Auxilius Processes Personal Data subject to U.S. state privacy laws, including the California Consumer Privacy Act, as amended, and its implementing regulations (the "CCPA"), Customer is a business or controller and Auxilius is a service provider or processor, in each case as applicable. Auxilius Processes such Personal Data solely on Customer's behalf for the business purposes described in the Agreement and Annex I.B, and will not: (a) sell or share it; (b) retain, use or disclose it for any purpose other than those business purposes, including for a commercial purpose other than providing the Service, or outside the direct business relationship between the parties; or (c) combine it with personal information that Auxilius receives from or on behalf of another person, or collects from its own interaction with a consumer, except as permitted by the CCPA or its implementing regulations. Auxilius certifies that it understands and will comply with the restrictions in this Section. Auxilius will notify Customer if it determines that it can no longer meet its obligations under applicable U.S. state privacy laws, and Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data, provided that any right to assess, monitor or audit Auxilius' Processing under such laws is exercised in accordance with Section 3(e).

‍

  1. Customer Responsibilities. Customer represents, warrants, and covenants that: (i) it has (and will have) Processed, collected, and disclosed all Customer Data in compliance with applicable law and provided any notice and obtained all consents and rights required by applicable law to enable Auxilius to lawfully Process Customer Data as permitted by the Agreement and/or this DPA; (ii) it has (and will continue to have) full right and authority to make the Customer Data available to Auxilius under the Agreement and this DPA, and the Customer Data does not infringe or violate the rights of any third party; and (iii) Customer’s instructions will not require Auxilius to infringe upon or violate any applicable law or any rights of any third party. Customer shall indemnify, defend and hold Auxilius harmless against any third-party claims, actions, proceedings (including without limitation any governmental investigations, complaints and actions), and against resulting expenses, damages, liabilities and reasonable attorneys’ fees, arising out of Customer’s violation of this Section.

‍

  1. Anonymized and Representative Data. Notwithstanding anything to the contrary in the Agreement (including this DPA), Customer acknowledges that Auxilius shall have a right to anonymize Customer Data and to use such anonymous data in connection with its business, provided that Auxilius takes reasonable measures designed to ensure such data can no longer be used to identify any individual, does not attempt to reverse that process, and requires any recipient of such data to do the same.  Customer further acknowledges that Auxilius shall have the right to use and disclose data pertaining to Customer’s representatives relating to the operation, support and/or use of the Service for its legitimate business purposes, such as product development and sales and marketing. To the extent any such data pertaining to Customer’s representatives is considered Personal Data, then, to the extent Auxilius is subject to Privacy Laws as a controller (or equivalent role under the applicable Privacy Laws) with respect to such data, Auxilius is the controller of such data and accordingly shall Process such data in accordance with Privacy Laws.

‍

  1. Miscellaneous. This DPA (together with the Agreement), constitutes the entire agreement between the parties and supersedes all prior undertakings and agreements between the parties, whether written or oral, with respect to the subject matter of this DPA. Auxilius may update this DPA from time to time by written notice to Customer, provided that no such update will reduce the protections afforded to Personal Data or expand Auxilius' rights to Process Personal Data under this DPA. This paragraph does not apply to Schedules A, B or C, which may be amended only as permitted by their terms, and does not affect Auxilius' obligation to notify Customer of new sub-processors under Section 6.

‍

  1. In this DPA, unless a clear contrary intention appears: (i) where not inconsistent with the context, words used in the present tense include the future tense and vice versa and words in the plural number include the singular number and vice versa; (ii) reference to any person includes such person’s successors and assigns but, if applicable, only if such successors and assigns are not prohibited by the Agreement; (iii) reference to any gender includes each other gender; (iv) reference to any agreement, document or instrument means such agreement, document or instrument as amended or modified and in effect from time to time in accordance with the terms thereof and includes all addenda, exhibits and schedules thereto; (v) the titles and subtitles used in this DPA are used for convenience only and are not to be considered in construing or interpreting this DPA; (vi) “hereunder,” “hereof,” “hereto,” and words of similar import shall be deemed references to this DPA as a whole and not to any particular Section or Subsection of this DPA; (vii) “including” (including grammatically inflected forms thereof) means including without limiting the generality of any description preceding such term; (viii) all references to “days” refer to calendar days; and (ix) the word “or” is not exclusive. This DPA has been executed in English and the English language version shall control notwithstanding any translations of this DPA.

‍

Schedule A

MODULE 2 – CONTROLLER TO PROCESSOR
STANDARD CONTRACTUAL CLAUSES

‍

For the purposes of the Controller to Processor Standard Contractual Clauses:

  1. Clause 7. The parties agree that the optional language in Clause 7 is included.
  1. Clause 9(a). The parties agree that under Option 2, Auxilius has Customer’s general authorization to subcontract its processing activities to the list of sub-processors set out in Annex III. Auxilius will inform Customer in writing of any intended changes to the list of sub-processors set out in Annex III at least thirty (30) days prior to engaging with any other sub-processor, in accordance with Section 6 of the DPA.
  1. Clause 11. The parties agree that the optional language in Clause 11 is excluded.
  1. Clause 13. The parties agree that the brackets are removed in the provisions in Clause 13(a) such that the appropriate provision will apply as applicable.
  1. Clause 17. Option 1 shall apply and the Controller to Processor Standard Contractual Clauses shall be governed by the laws of Ireland.
  1. Clause 18. The parties agree that any dispute arising from the Controller to Processor Standard Contractual Clauses shall be resolved by the courts of Ireland.
  2. Annex I.A.
Data Exporter (Customer)Data Importer (Auxilius)
NameThe entity that has entered into the Agreement with Auxilius, as identified in the Agreement or the applicable Order Form.Auxilius, Inc.
AddressAs set out in the Agreement or the applicable Order Form.73 Spring Street (4th Floor), New York, NY 10012
Contact person’s name, position and contact detailsThe contact identified by Customer in the Agreement or the applicable Order Form, or as otherwise notified to Auxilius in writing.Privacy Team, privacy@auxili.us
Activities relevant to the data transferredProvision and receipt of the Service as described in the Agreement.Provision and receipt of the Service as described in the Agreement.
Signature and dateAs set forth in the Agreement.As set forth in the Agreement.
RoleControllerProcessor

‍

8. Annex I.B.

FieldDetail
Categories of data subjectsPersonnel of the institution where the clinical study is conducted (“Institution”); and clinical study subjects.
Categories of personal data — Institution personnelBusiness contact details including name, email, or phone number.
Categories of personal data — clinical study subjects (each category pseudonymized by the data exporter prior to transfer)Subject ID number; subject visit dates; and subject enrollment and discontinuation reports (excluding treatment efficacy information).
Sensitive data and safeguards appliedPseudonymous data concerning clinical study subjects described above, to the extent such data constitutes pseudonymous data concerning health. Pseudonymization is applied by the data exporter prior to transfer; the measures in Annex II apply.
Frequency of the transferContinuous.
Nature of the processingBasic processing, including but not limited to collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction, for the purpose of providing the Service by data importer to data exporter in accordance with the terms of the Agreement.
Purpose of the transfer and further processingProvision of the Service by data importer to data exporter.
Retention period / durationFor as long as data importer carries out personal data processing operations on behalf of data exporter, or until termination of the Agreement (and all personal data has been returned or deleted in accordance with the Controller to Processor Standard Contractual Clauses).
Transfers to sub-processorsPersonal data will be transferred to the sub-processors listed in Annex III so that data importer can provide the Service to data exporter. The nature of the processing by such sub-processors is basic processing as described above. The duration of such processing continues as long as those sub-processors carry out processing operations on behalf of data importer.

‍

  1. Annex I.C.
    1. The data exporter's competent supervisory authority will be determined in accordance with the GDPR.
  2. Annex II.
    1. The data importer utilizes a number of technical and organizational measures including the following measures:
MeasureDescription
EncryptionData importer encrypts personal data in transit using TLS 1.2 or higher, and at rest using AES-256. Encryption keys are managed through data importer's cloud provider's key management service using FIPS 140-2 validated hardware security modules, with key access restricted to authorised personnel.
Access control and authenticationAccess to personal data is restricted to personnel and sub-processors with a need to know. Data importer registers and authorises new internal and external users prior to issuing system credentials and granting access, and removes credentials when access is no longer authorised. Unique user identifiers, strong passwords and multi-factor authentication are required for access to data importer's production systems. Access rights are reviewed at least quarterly. Where Customer federates end-user authentication to its own identity provider, authentication policy for those accounts, including multi-factor authentication, is configured and controlled by Customer.
Physical access controlPhysical access to data importer's facilities is restricted to authorised personnel. Data centre physical security is provided by data importer's infrastructure sub-processor under its own audited controls.
Transmission and transfer controlData importer restricts the transmission, movement and removal of information to authorised internal and external users and processes, and protects information during transmission, movement or removal.
Logging and monitoringAccess, authentication, administrative and system events are logged across data importer's infrastructure and application. System components and their operation are monitored for anomalies indicative of malicious acts, natural disasters and errors affecting data importer's ability to meet its objectives. Anomalies are analysed to determine whether they represent security events.
Network securityData importer implements logical access security software, infrastructure and architectures protecting its systems and protected information assets against threats originating outside its network boundaries.
Segregation of customer dataPersonal data processed on behalf of each customer is logically segregated from data processed on behalf of other customers.
Malicious code protectionData importer implements controls to prevent, or detect and act upon, the introduction of unauthorised or malicious software.
Business continuity and disaster recoveryData importer maintains a documented disaster recovery plan and business continuity plan, identifies and implements activities to recover from identified security incidents, and tests recovery plan procedures supporting system recovery at least annually.
Vulnerability management and security testingData importer conducts regular testing, assessment and evaluation of the effectiveness of its technical and organisational measures, including automated vulnerability scanning, periodic internal vulnerability assessments, and independent third-party penetration testing at least annually. Identified vulnerabilities are prioritised by severity and remediated accordingly.
Secure developmentChanges to systems processing personal data are subject to a documented software development lifecycle and change-management process. Changes are developed and tested in environments separate from production, are peer-reviewed and approved prior to deployment, and undergo automated security testing and quality assurance testing. Production data is not used in development or test environments. Access to promote changes to production is restricted to authorised personnel.
Personnel security and trainingPersonnel authorised to process personal data are subject to written obligations of confidentiality that survive termination of their engagement. Personnel and contractors with access to personal data or application code are subject to background screening prior to engagement and complete information security awareness training within three months of engagement and annually thereafter.
Sub-processor and vendor managementData importer assesses and manages risks associated with its vendors and business partners, and executes required agreements and data transfer provisions where required by applicable law. Sub-processors are bound by obligations no less protective than those in this DPA.
Incident detection and responseData importer responds to identified security incidents by executing a defined incident response programme to understand, contain, remediate and communicate security incidents as appropriate, and notifies Customer in accordance with this DPA.
Data retention and deletionData importer deletes or destroys personal data at the direction of the data exporter and in accordance with internal records retention policies, or as soon as it is no longer needed for business purposes. Data residing in backup media is deleted in accordance with data importer's backup retention cycle.
Governance, certification and auditData importer maintains a written information security programme in accordance with its SOC 2 Type 2 programme, conducts periodic risk assessments and reviews of that programme at least annually or on material change of practices, and makes its then-current SOC 2 Type 2 report available to Customer on request.

‍

  1. Annex III.
    1. Customer hereby authorizes the use of the following sub-processor(s):
Sub-processor / AddressPurposeNature of ProcessingDuration
Amazon Web Services, Inc.410 Terry Avenue North, Seattle, WA 98109, USA Cloud hosting and infrastructure for the Service. Hosting, storage and Processing of Personal Data within Auxilius' AWS environment. Location of Processing: United States (AWS us-east-1). Term of the applicable Statement of Work.
Anthropic PBC548 Market Street, PMB 90375, San Francisco, CA 94104, USA Provider of the large language models used in the Service. Models are currently accessed through Amazon Bedrock within Auxilius' AWS environment; Auxilius may also leverage models directly through Anthropic if and as necessary. Inference Processing to generate outputs returned to Customer. Location of Processing: United States (via Amazon Bedrock, AWS us-east-1). Personal Data is not used to train, fine-tune or develop models. Term of the applicable Statement of Work.
Snowflake Inc.106 East Babcock Street, Suite 3A, Bozeman, MT 59715, USA Data warehousing and analytics supporting delivery and performance of the Service. Storage and Processing of Personal Data. Location of Processing: United States. Term of the applicable Statement of Work.

‍

Schedule B

‍

‍MODULE 3 – PROCESSOR TO PROCESSOR
STANDARD CONTRACTUAL CLAUSES

‍

For the purposes of the Processor to Processor Standard Contractual Clauses:

  1. General. Except as expressly set out in this Schedule B, the elections, information and annexes set out in Schedule A apply to the Processor to Processor Standard Contractual Clauses, and each reference in Schedule A to the Controller to Processor Standard Contractual Clauses shall be read as a reference to the Processor to Processor Standard Contractual Clauses.
  1. Clause 9(a). The parties agree that under Option 2, Auxilius has Customer’s general authorization to subcontract its processing activities to the list of sub-processors set out in Annex III. Auxilius will inform Customer in writing of any intended changes to that list at least thirty (30) days prior to engaging with any other sub-processor, in accordance with Section 6 of the DPA.
  1. Annex I.A. Notwithstanding Schedule A, the roles of the parties are as follows: Auxilius is a processor and Customer is a processor.
  1. Annex II. Annex II of Schedule A is incorporated herein by reference.
  1. Annex III. Annex III of Schedule A is incorporated herein by reference.

‍‍

Schedule C‍

‍

UK DTA

For the purposes of the UK DTA:
‍

  1. For the purposes of Table 1 of the UK DTA, the start date shall be the later of the DPA Date or the Effective Date, and the names of the parties, their roles and their details shall be as set out in Annex I.A of Schedule A and, for the Processor to Processor Standard Contractual Clauses, as varied by Schedule B;
  1. For the purposes of Tables 2 and 3 of the UK DTA, the Controller to Processor Standard Contractual Clauses and the Processor to Processor Standard Contractual Clauses, including the information set out in Annex I.B, Annex II and Annex III of Schedule A (as applied to the Processor to Processor Standard Contractual Clauses by Schedule B), shall apply; and
  1. For the purposes of Table 4 of the UK DTA, either party may end the UK DTA.

‍

‍

‍