Important: This version takes effect on November 30, 2026. It applies to new Subscriptions from that date, and to existing Subscriptions from their next renewal on or after that date, unless a signed agreement or counter-signed Order Form provides otherwise. Until it applies to a Subscription, the previous version continues to govern that Subscription — view the previous version.

Data Transfer Addendum

Version 2.0 • Nov 30, 2026     View Previous Versions

This Data Transfer Addendum (this “DTA”) between ID123 Inc. (the “Service Provider”) and the Client applies to any International Data Transfer. It forms part of the Data Processing Addendum (“DPA”) and, through it, the Master Service Agreement (“MSA”). Terms not defined in this DTA have the meanings given in the DPA or the MSA.

1. Definitions

“International Data Transfer” means a transfer of Personal Data that is subject to the Data Protection Law of the European Economic Area, Switzerland or the United Kingdom to the Service Provider in a country that is not recognised under that law as providing an adequate level of protection for personal data.

“SCCs” means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021, as amended or replaced from time to time.

“UK Addendum” means the International Data Transfer Addendum to the SCCs, version B1.0, issued by the Information Commissioner under section 119A of the Data Protection Act 2018, as revised under Section 18 of its Mandatory Clauses.

2. Transfers to the Service Provider as Processor

Where Client transfers Personal Data to the Service Provider acting as Processor under the DPA, Module Two of the SCCs is incorporated into this DTA and completed as follows:

(a) Clause 7: the optional docking clause does not apply.

(b) Clause 9(a): Option 2 (general written authorisation) applies. The agreed list of sub-processors is the list referred to in Section 5.1 of the DPA, and the Service Provider will inform Client in writing of any intended addition or replacement of a sub-processor at least thirty (30) days in advance, by email to the notice address on Client’s account.

(c) Clause 11(a): the optional language does not apply.

(d) Clause 13 and Annex I.C: the competent supervisory authority is determined as set out in Appendix 4, Part A.4 of the DPA.

(e) Clause 17: Option 2 applies, and the Member State referred to in that Option is Ireland. Where Client is not established in an EU Member State, Option 1 applies and the SCCs are governed by the law of Ireland.

(f) Clause 18(b): the courts of the Member State whose law governs the SCCs under paragraph (e).

(g) Annexes I and II: completed with Appendices 1 and 2 of the DPA respectively.

Where Client acts as a Processor on behalf of a third-party Controller, as permitted by Section 1.1 of the DPA, Module Three of the SCCs is incorporated into this DTA and completed as set out in paragraphs (a) to (g), with Client as data exporter acting as processor and the Service Provider as data importer acting as sub-processor.

3. Controller to Controller Transfers

To the extent Client transfers Personal Data to the Service Provider acting as an independent Controller under Section 1.3.2 of the DPA, Module One of the SCCs is incorporated into this DTA and completed as set out in Section 2 so far as applicable, with Annex I completed with the description of that Processing in the Service Provider’s Privacy Policy and Annex II completed with Appendix 2 of the DPA.

4. Switzerland

For International Data Transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply with the adaptations set out in Appendix 4, Part A.3 of the DPA, and the term “Member State” is not to be interpreted so as to exclude data subjects in Switzerland from bringing proceedings in their place of habitual residence under Clause 18(c).

5. United Kingdom

For International Data Transfers subject to the UK GDPR, the SCCs are supplemented by the UK Addendum, which is incorporated into this DTA and completed as follows: in Table 1, the parties are Client as exporter and the Service Provider as importer, with the details set out in Appendix 1 of the DPA; in Table 2, the Addendum EU SCCs are the SCCs as completed in Sections 2 and 3; in Table 3, the Appendix Information is set out in Appendices 1 and 2 of the DPA and Section 2(b); and in Table 4, the Importer may end the UK Addendum as set out in its Section 19.

6. Government Access Requests

Requests by any governmental, law enforcement or intelligence authority for access to Personal Data transferred under this DTA are governed by Section 7.9 of the MSA, in addition to Clause 15 of the SCCs.

7. Further Assurance

(a) If Data Protection Law requires the SCCs or the UK Addendum to be executed as a separate agreement for a particular transfer, the Service Provider will execute them on request, with any changes necessary to reflect that law.

(b) If a transfer mechanism referred to in this DTA ceases to be valid, or a supervisory authority requires transfers under it to be suspended, the Service Provider may implement an alternative mechanism permitted by Data Protection Law, and will notify Client of the change and its effective date.

8. Order of Precedence

In the event of conflict, the SCCs and the UK Addendum, as applicable, prevail over this DTA, and this DTA prevails over the remainder of the DPA and the MSA.

9. Changes

This DTA forms part of the DPA, and changes to it are made in accordance with Section 15.4 of the DPA.