UK International Data Transfer Addendum
Addendum to the EU Commission Standard Contractual Clauses, issued by the UK ICO under section 119A of the Data Protection Act 2018. Version B1.0.
About this document.
This is a pre-filled copy of the UK Information Commissioner's Office International Data Transfer Addendum (version B1.0). The Addendum's authoritative text is published by the ICO at ico.org.uk. Where this page summarises the Addendum for readability, the ICO text controls.
Incorporation
The Parties incorporate by reference the UK ICO's International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, and agree to be bound by it. The selections in the Tables below complete the Addendum for transfers of personal data subject to the UK GDPR from the data exporter in the United Kingdom to Komplexity AI LLC in the United States.
The Addendum operates by attaching to a copy of the EU Commission's Standard Contractual Clauses and adapting them to UK law. The underlying EU SCCs are set out at komplexai.io/sccs and are incorporated here by reference.
Table 1 — Parties
Exporter
| Start date | The date the Customer accepts the DPA or otherwise signs Annex A. |
| Parties' details | [Customer to complete — legal entity name, registered address in the UK] |
| Key contact | [Customer to complete — name, role, contact email] |
| Signature (if required for the start date) | [Customer to complete] |
| Role under Article 4 UK GDPR | Controller (exporter) |
Importer
| Start date | The date Komplexity AI LLC signs the DPA. |
| Parties' details | Komplexity AI LLC (d/b/a Komplex AI), 7514 Girard Ave, Ste 1 #935, San Diego, California 92037, USA |
| Key contact | Galen Wilkerson, Managing Member — legal@komplexai.io |
| Signature (if required for the start date) | Signed by Komplexity AI LLC on the date set out in the DPA signature block. |
| Role under Article 4 UK GDPR | Processor (importer) |
Table 2 — Selected SCCs, Modules and selected clauses
| Addendum EU SCCs | The version of the Approved EU SCCs which this Addendum is appended to is the Standard Contractual Clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021, in the form pre-filled at komplexai.io/sccs. |
| Module in operation | Module 2 (Controller to Processor) |
| Clause 7 (Docking Clause) | Included |
| Clause 9(a) (Prior Authorisation or General Authorisation) | Option 2 (General Authorisation) with thirty (30) days' advance written notice of changes |
| Clause 11 (Option) | The optional independent dispute resolution language is NOT included |
| Clause 17 (Governing law) | Ireland (under the underlying EU SCCs) |
| Clause 18 (Forum) | Ireland (under the underlying EU SCCs) |
| Annex 1A: List of Parties | As completed in Table 1 above and at komplexai.io/sccs (Annex I.A) |
| Annex 1B: Description of Transfer | As set out at komplexai.io/sccs (Annex I.B), reproduced for convenience in Table 3 below |
| Annex II: Technical and organisational measures | As set out at komplexai.io/sccs (Annex II) and komplexai.io/dpa#annex-d |
| Annex III: List of sub-processors | As set out at komplexai.io/sccs (Annex III) and komplexai.io/dpa#annex-c |
Table 3 — Appendix Information
“Appendix Information” means the information that must be provided for the selected modules of the EU SCCs, set out in the EU SCC Annexes. The Appendix Information for this transfer is the same as that set out at komplexai.io/sccs. Reproduced for convenience:
| Annex 1A — List of Parties | Exporter and Importer as set out in Table 1 above. |
| Annex 1B — Description of Transfer | Categories of data subjects: end users of the Exporter's own products. Categories of personal data: submitted text (transient, not retained) plus limited usage metadata (timestamp, hashed API-key identifier, token counts, response latency, transient IP). Sensitive data: not knowingly processed; HIPAA-protected health information prohibited. Frequency: continuous. Nature: hallucination-likelihood scoring. Purpose: provision of the Services. Retention: submitted text — zero; usage metadata — 24 months; account information — until deletion + 90 days. Transfers to sub-processors as listed in Annex III. |
| Annex II — Technical and Organisational Measures | Zero-retention of submitted text; TLS 1.2+; MFA on production access; logging excludes submitted text and model outputs; sub-processor diligence; 72-hour breach notification; no SOC 2 or ISO 27001 attestation at this time. Full description at komplexai.io/dpa#annex-d. |
| Annex III — List of Sub-processors | Modal Labs, Inc. (inference compute, US); Stripe, Inc. (payments, US); Vercel, Inc. (web hosting, US). Each engaged under its own published DPA and SCCs. |
Table 4 — Ending this Addendum when the Approved Addendum changes
The Party which may end this Addendum as set out in Section 19 of the Addendum is: Importer.
Rationale: where the ICO issues a revised version of the Addendum that would change the obligations on the Importer in a way the Importer cannot accept, the Importer may end this Addendum on reasonable notice. The Exporter retains the same protection through the DPA's termination-for-cause rights.
Part 2 — Mandatory clauses
The Mandatory Clauses of the Addendum (as set out in Part 2 of the ICO-published template) are incorporated into this Addendum by reference and apply between the Parties. Those clauses, among other things, modify references within the EU SCCs (for example, references to the GDPR are read as references to the UK GDPR, references to a Member State are read as references to the United Kingdom, and Clauses 17 and 18 are modified so that the laws and courts of England and Wales apply where required by the Mandatory Clauses).
For the full operative text of the Mandatory Clauses, see the ICO's published International Data Transfer Addendum, version B1.0.
Signatures
The Parties sign this Addendum together with the DPA. The signature block of the DPA constitutes signature of this Addendum.
Importer (Processor)
Komplexity AI LLC
7514 Girard Ave, Ste 1 #935
San Diego, California 92037, USA
By: [Authorized Signatory Name]
Title: [Title]
Date: ____________________
Exporter (Controller)
[Customer to complete]
Entity: ____________________
By: ____________________
Title: ____________________
Date: ____________________