UK International Data Transfer Addendum
Last revised: August 9, 2026
International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, VERSION B1.0, in force 21 March 2022
This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.
This Addendum is appended to the Standard Contractual Clauses adopted by Vistaly, and is incorporated by reference into Vistaly's Data Processing Addendum. It applies to transfers subject to the UK GDPR in the circumstances described in Section 11.2(b) of that Data Processing Addendum — that is, if the UK Extension to the EU-U.S. Data Privacy Framework, or any relevant adequacy decision, ceases to provide a lawful basis for the transfer.
Part 1: Tables
Table 1: Parties
| Exporter | Importer | |
|---|---|---|
| Start date | The effective date of the Principal Agreement between the Parties. | As Exporter. |
| The Parties' details | The Customer, as identified in the Order Form or in the Terms of Service accepted by the Customer. | Vistaly, Inc., 225A E Main Street, Charlottesville, VA 22902, United States. |
| Role | Controller | Processor |
| Key Contact | The Customer contact named in the Order Form, or the Customer's account owner. | C.P. Dehli, Data Protection Officer — dpo@vistaly.com |
| Signature | Not separately signed. This Addendum is incorporated by reference into the Principal Agreement, in the same manner as the Data Processing Addendum to which it relates, and takes effect on the start date above. | As Exporter. |
Table 2: Selected SCCs, Modules and Selected Clauses
| Field | Selection |
|---|---|
| Addendum EU SCCs | The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information. |
| Which EU SCCs | The Standard Contractual Clauses set out in the Annex to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as published at vistaly.com/sccs. |
| Module in operation | Module Two — Controller to Processor. |
| Clause 7 (Docking Clause) | Used. |
| Clause 9 (Sub-processors) | Option 2 — general written authorisation. Time period for prior notice of sub-processor changes: 14 days. |
| Clause 11 (Optional language) | Not used. |
| Clause 17 (Governing law) | The laws of England and Wales. |
| Clause 18 (Choice of forum) | The courts of England and Wales. |
Clauses 17 and 18 are stated here as the laws and courts of England and Wales, and not as the EU Member State elected in Section 11.2(a) of the Data Processing Addendum. A Restricted Transfer under the UK GDPR is governed by UK law, and Section 15 of the Mandatory Clauses — which sets out the amendments to the Approved EU SCCs — substitutes the laws and courts of England and Wales in Clauses 17 and 18 accordingly.
Table 3: Appendix Information
"Appendix Information" means the information which must be provided for the selected modules as set out in the Appendix of the Approved EU SCCs (other than the Parties), and which for this Addendum is set out in:
| Annex | Location |
|---|---|
| Annex 1A: List of Parties | Table 1 above, and Annex I.A of the Standard Contractual Clauses. |
| Annex 1B: Description of Transfer | Annex I (Description of Processing) of the Data Processing Addendum: subject matter, duration, nature and purpose of processing, types of personal data, and categories of data subjects. |
| Annex II: Technical and organisational measures | Annex II (Technical and Organizational Security Measures) of the Data Processing Addendum. |
| Annex III: List of Sub-processors | The Sub-Processor List, as updated from time to time in accordance with Clause 9, Option 2. |
Table 4: Ending this Addendum when the Approved Addendum changes
| Field | Selection |
|---|---|
| Which Parties may end this Addendum as set out in Section 19 | Neither Party. |
Part 2: Mandatory Clauses
Entering into this Addendum. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.
Interpretation of this Addendum. This Addendum incorporates the Mandatory Clauses of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner under section 119A(1) of the Data Protection Act 2018 and laid before Parliament on 2 February 2022, as they are revised under Section 18 of those Mandatory Clauses.
Where the Mandatory Clauses use terms defined in Table 1 to Table 4 above, those terms have the meanings given in those Tables. Where this Addendum and the Approved EU SCCs conflict, this Addendum prevails in respect of a Restricted Transfer subject to the UK GDPR.
The current version of the Approved Addendum, and any revision issued by the Information Commissioner, is published at ico.org.uk.
Questions about this Addendum may be sent to dpo@vistaly.com.