United Kingdom — TM-UK (International Data Transfer Addendum) and ANX-UK (UK Annex)
Document IDs: TM-UK v1.0 and ANX-UK v1.0 · Language: English · Effective date: [[TO CONFIRM: publication date]]
Applies to: Clinics established in England, Wales, Scotland or Northern Ireland. Part of the Master Data Processing Agreement (the "MDPA"). Terms defined in the MDPA have the same meaning here.
PART I — TM-UK: International Data Transfer Addendum to the EU Commission Standard Contractual Clauses
1. Framework
1.1 The transfer chain.
- Leg 1: from the Clinic in the UK to VstreamX in Canada.
- Leg 2: from VstreamX to its Sub-processors, mainly in the United States.
1.2 Primary basis for leg 1. Canada is subject to UK adequacy regulations for recipients subject to PIPEDA. VstreamX is subject to PIPEDA, so leg 1 is made under those regulations. Under the Data (Use and Access) Act 2025, those regulations are treated as meeting the data protection test.
1.3 Primary basis for leg 2. Google LLC and Meta Platforms, Inc. participate in the UK Extension to the EU-U.S. Data Privacy Framework, as recognised by the Data Protection (Adequacy) (United States of America) Regulations 2023. VstreamX keeps a dated record of their listings. [[TO CONFIRM: both UK Extension listings verified live]]
1.4 The Addendum is entered into now.
- By accepting the MDPA, the Clinic and VstreamX hereby enter into the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the Information Commissioner (the "Addendum").
- The Addendum is completed by the tables below. It is incorporated by reference, and its Part 2 Mandatory Clauses are reproduced in full in the bundle the Clinic reads and in the Executed Copy. [[TO CONFIRM: embed the ICO's official text of the Mandatory Clauses from the official source file]]
- The Addendum applies whenever a transfer under this Annex is not covered by UK adequacy regulations. It applies at all times to VstreamX's onward transfers, through Clause 8.7 of the Addendum EU SCCs.
1.5 Transfer risk assessment. VstreamX has carried out a transfer risk assessment for the transfers. Its summary is in the assessment pack, and it follows the structure of the TM-EEA Appendix A. [[TO CONFIRM: the TRA, dated and signed off, under the post-DUAA "data protection test"]]
1.6 Precedence.
- The Addendum, and the Addendum EU SCCs as it amends them, prevail over the MDPA, this Annex and the DentalX Terms of Service.
- The limitation of liability in the Terms and in MDPA clause 17 does not apply to liability towards data subjects under the Addendum.
2. Part 1 of the Addendum: Tables
Table 1: Parties
| Exporter (who sends the Restricted Transfer) | Importer (who receives the Restricted Transfer) | |
|---|---|---|
| Start date | The date of the Clinic's electronic acceptance, «Acceptance date (UTC)» | |
| Parties' details | Full legal name: «Clinic legal name» · Trading name (if different): «Clinic trading name» · Main address: «Clinic address», United Kingdom · Official registration number (if any): «Companies House number, if any» · ICO registration number: «ICO registration number» | Full legal name: VstreamX Studio Inc. · Trading name: DentalX · Main address: Office B – 1043 Rosser Ave, Brandon, Manitoba R7A 0L5, Canada · Official registration number: [[TO CONFIRM: Manitoba corporation number]] |
| Key contact | «Signatory name», «Signatory role», «Signatory email»; data protection officer or privacy contact: «Clinic privacy contact» | Ricardo Javier Sandoval Sandoval, Chief Financial Officer, accountable individual for privacy · admin@vstreamx.com · UK representative: [[TO CONFIRM: UK Art. 27 representative]] |
| Signature | Electronic acceptance by «Signatory name» | Electronic signature of VstreamX's authorised officer on the acceptance certificate |
Table 2: Selected SCCs, Modules and Selected Clauses
| Addendum EU SCCs | The version of the Approved EU SCCs which this Addendum is appended to, detailed below, including the Appendix Information. Only the following modules, clauses and optional provisions of the Approved EU SCCs are brought into effect for the purposes of this Addendum: |
|---|
| Module | Module in operation | Clause 7 (Docking Clause) | Clause 11 (Option) | Clause 9a (Prior Authorisation or General Authorisation) | Clause 9a (Time period) | Is personal data received from the Importer combined with personal data collected by the Exporter? |
|---|---|---|---|---|---|---|
| 1 | No | — | — | — | — | — |
| 2 | Yes | Yes | No | General Authorisation | 30 days | — |
| 3 | No | — | — | — | — | — |
| 4 | No | — | — | — | — | — |
Table 3: Appendix Information
| Item | Where it is |
|---|---|
| Annex 1A: List of Parties | Table 1 above. |
| Annex 1B: Description of Transfer | MDPA Schedule 1, as reproduced in TM-EEA Annex I.B (incorporated here). The competent authority is the Information Commissioner. |
| Annex II: Technical and organisational measures including technical and organisational measures to ensure the security of the data | MDPA Schedule 2, mapped in TM-EEA Annex II (incorporated here). |
| Annex III: List of Sub processors (Modules 2 and 3 only) | MDPA Schedule 3, version 1.0 (incorporated here). |
Table 4: Ending this Addendum when the Approved Addendum Changes
| Ending this Addendum when the Approved Addendum changes | Which Parties may end this Addendum as set out in Section 19: Neither Party. [[TO CONFIRM: counsel's preference between "Neither Party" and "Importer"]] |
|---|
3. Part 2 of the Addendum: Mandatory Clauses
Mandatory Clauses. These are the Mandatory Clauses of the Approved Addendum: the template Addendum B.1.0 issued by the ICO and laid before Parliament under section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses.
Governing law and courts. Under the Mandatory Clauses, the Addendum EU SCCs are governed by the laws of England and Wales. Disputes go to the courts of England and Wales. A data subject may also bring proceedings before the courts of any country in the UK.