Data Processing Agreement

This policy was last updated on July 20, 2026, to clarify the identities of the data exporter and the data importer in Annex IV and to revise the technical and organisational measures in Annex II so they reflect the enhanced current practices.

This Data Processing Agreement entered into between you and TYPEFORM SL (the “Company”, “we”, or “us”) regulates the particularities of data processing in connection with your use of both the platform accessible through the www.typeform.com and www.videoask.com domain names (the “Site”) and the services we may offer through the Site from time to time, consisting in ‘typeform’ forms and other services (indistinctly referred to as the “Services”). If you are also subject to the CCPA, please check our ‘CCPA Notice’ here to learn which specific provisions apply to you.

Please, note that ‘Data controller’, ‘data processor’, ‘data subject’, ‘personal data’, ‘processing’ will have the meaning set forth in the GDPR or in any other applicable European data protection law. ‘GDPR’ shall be understood as (i) the Regulation (EU) 2016/679, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data; (ii) the GDPR as it forms part of UK law by virtue of section 3 of the UK European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 (together, “UK Data Protection Laws”); (iii) any future laws that may amend them or complement them in the future.

For clarification purposes, under this DPA (i) the processing of data regulated hereunder shall take place for as long as there is a service agreement in place between you and we, or until you decide to terminate said agreement; (ii) the nature and purposes of the processing shall be the collection, saving, organization, hosting, and deletion of data, as well as making it available to you upon your request; and (iii) the types of personal data and the categories of data subjects that are likely to be used in our product are name, surname, email address, telephone number, other ID details belonging to employees, candidates, prospects, and clients.

1. Processing of data

We will process any personal data we may have access to because of the provision of the Services in accordance with the documented instructions provided by you from time to time. Should a Union or Member State law to which we are subject requires us to process personal data —including the international transfer of personal data—, we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

Should we have reasonable grounds to believe that a documented instruction given by you infringes the GDPR or any other applicable EU data protection law or regulation, we will put said instruction on hold and immediately notify you. At your sole risk and without us being responsible or liable to you for any losses, you will be entitled to order us to perform any such instruction despite the concerns raised by us, as long as you reconfirm your instruction in writing.

For purposes of this DPA, it will be understood that a ‘documented instruction’ includes, without limitation, (i) any instruction delivered by you by means of any durable media, such as a letter or email; (ii) any instruction electronically sent by you when using the software provided as part of the Services (i.e. by using the interface part of the software and the features made available through it); or (iii) the provisions of the DPA.

For clarification purposes and given your position of data controller, you warrant and represent that you will timely and sufficiently perform your obligations under the applicable privacy laws, such as inform data subjects (e. g. respondents to the forms, etc.) and obtain their consent (where appropriate). This enumeration is for illustration purposes only, in the sense that you will still be required to satisfy the obligations you are subject under the GDPR, such as making sure, in general, that the processing satisfies the requirements of the GDPR, you have the right and obligation to decide about the purpose and means of said processing, or making sure that there is a legal basis for the processing.

2. Confidentiality duty

We will ensure that all employees authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.

3. Sub-processors

You will subscribe to the emailing list available at https://help.typeform.com/hc/en-us/articles/360029617191-What-other-companies-do-we-share-data-with- in order to receive notifications for changes in the sub-processor list pursuant to this Section. Said page includes a current list of approved subprocessors for purposes of this Section.

In the event that we intend to replace one subprocessor by other or contract new subprocessors to provide you with the Services, you will be entitled to reasonably oppose (i.e. any challenge based on the potential or actual failure to meet the legal requirements set forth by the GDPR by the subprocessor to be appointed) to such change in the non-extendable term of fifteen (15) calendar days and, if you exercise such right, we will be entitled to early terminate the contractual relationship set forth in for the provision of the Services.

We will enter into written agreements with any sub-processors engaged in the provision of the Services including the safeguards and guarantees required by the GDPR, particularly in respect of implementing the security measures required in the GDPR, and we will be liable for any actions by our sub-processors.

4. Data subjects’ rights

Taking into account the nature of the processing, we will assist you by appropriate technical and organizational measures, insofar as this is possible, for the fulfilment of your obligation to respond to requests for exercising the data subject's rights laid down in Chapter III of the GDPR, if applicable. For the avoidance of doubt, we will send to you any request data subjects may address directly to us together with all relevant information, if any, so that you can formally contact and answer to data subjects.

5. Security measures

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as those measures are further detailed in Annex II. Taking into account the nature of processing and the information available to us, we will reasonably assist you in compliance with the security obligations set forth by Article 32 of the GDPR.

6. Assistance and data breaches

In addition to the duty set forth in Section 5 above, we will also provide, subject to the nature of processing and information available to us, assistance in complying with obligations set forth in Articles 32 to 36 of the GDPR, if applicable.

With respect to data breaches, we will notify you without undue delay upon we becoming aware of a personal data breach affecting personal data and, in any event, within the deadlines set forth under the GDPR. We will provide you with sufficient information to allow it to meet any obligations to report or inform competent authorities or data subjects. We will reasonably cooperate with you and take such reasonable commercial steps as are directed by you to assist in the investigation, mitigation and remediation of each such data breach. For the avoidance of doubt, you will be the only Party responsible for both filing any reports required under applicable law and notifying data subjects, and you will defend, indemnify and hold us harmless of any and all costs (including attorney’s fines), fines or sanctions, or any damages that lack of action on your side may cause.

7. Termination

You will decide whether you want us to delete or return personal data, unless Union or Member State law requires storage of the personal data. To this end, you acknowledge that deletion of the account provided as part of the Services will always result in deletion of personal data, and its request to delete the account will be understood as a request to delete data under this Section 7.

Canceling your paid subscription shall not result in a termination of the Services and, therefore, a termination of this DPA. You will still be able to keep using our Services under a free plan, but some of the functionalities offered to you may not be fully available.

If you are an inactive free user, as this term is described in the STC, you accept that data is deleted after the 24-month period of time set forth in these STC.

8. Audit rights

We will make available to you the information necessary to demonstrate our compliance with the obligations set forth in this DPA. You agree that the obligation to provide information demonstrating compliance with this DPA may be satisfied by us making available to you copies of the audit reports and/or certifications undergone by us, such as ISO27001 or SOC2 certificates. In the event that these documents do not reasonably address your concerns, you agree that you may only conduct up to one (1) audit per year, unless there are reasonable grounds to believe that we are not performing the obligations laid down in this DPA. Audits will only be carried out during normal business hours, and you will bear all costs unless we are found to be in a material breach of this DPA.

9. International transfer of personal data

In the event that the you are neither subject to the GDPR, nor located in the EEA, nor the transfer can be legally performed in accordance with the GDPR (because such transfer falls under an adequacy decision passed by the European Commission or can be otherwise performed under the GDPR on the basis of BCR, a certification mechanism or under a legally binding instrument), you and us enter into the SCCs, module 4, as a mechanism to ensure the adequate protection of personal data being transferred outside the EEA.

Should you be based in the United Kingdom, the Parties declare that the transfer of data from the United Kingdom to Spain or from Spain to the United Kingdom will not be construed as an international transfer of personal data, considering the adequacy decisions passed on this subject. Annex IV shall apply in respect of any onward transfers.

You authorize to the transfer of data to the sub-processors listed in Section 3 above, it being understood that any such transfer will be performed to the extent that we enter into a written contract with the sub-processors setting forth the obligations to be implemented by the sub-processors in respect of the transfer of data (e.g. SCCs, module 3; or, should you be an entity subject to the UK GDPR, the SCCs amended as specified in Annex IV), and you have the right to oppose any future changes or amendments of the sub-processors by following the same steps mentioned in Section 3 above. Should you exercise any such right, we will be entitled to early terminate the contractual relationship set forth for the provision of the Services. For purposes of the SCCs:

• Clause 7 (Docking Clause) will not apply;
• Option 2 in Clause 9 (general written authorization) is chosen. Option 2 will be construed in the light of the provisions of this DPA;
• Clause 11 (Optional Language) will not apply; and
• In Clause 13, 17 and 18, Spanish law shall be the applicable law, and the competent courts and authorities of the Kingdom of Spain shall be the ones competent to solve any disputes connected with the SCCs.

ANNEX I

A. LIST OF PARTIES

Data exporter(s): TYPEFORM, S.L., a Spanish entity with registered address at Via Augusta 29 - 31, 08006 – Barcelona (Spain), and N.I.F. (Spanish tax identification number) B65831836. The Company is registered in the Commercial Registry of Barcelona, page B-421911, folio 145, volume 43262. TYPEFORM’s Data Protection Officer can be contacted at: gdpr@typeform.com, or in the postal address mentioned at the STC.

Data importer(s): You, as identified when creating an account with TYPEFORM.

B. DESCRIPTION OF TRANSFER

Categories of data subjects whose personal data is transferred – Any kind of data subject categories..

Categories of personal data transferred – Any kind of personal data categories.

Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures – sensitive information may be processed, and subject to the security measures described in Annex II.

The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis) – Continuous basis.

Nature of the processing – data collection, saving, organization, hosting, deletion. Making the data available to the data exporter following its requirements / petitions.

Purpose(s) of the data transfer and further processing –Provision of customer service services, as further detailed in the STC.

The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: data will be retained for as long as the data exporter requires the services.

For transfers to (sub-) processors, also specify subject matter, nature and duration of the processing – same as above.

C. COMPETENT SUPERVISORY AUTHORITY

–the Spanish Data Protection Agency.

ANNEX II

TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA

1. Technical Security Measures

1.1 Data Encryption. All data is encrypted in transit using modern encryption protocols (TLS 1.2 or higher). At rest, data is encrypted using robust encryption standards (AES-256). Keys are managed through secure, centralized key management services to ensure confidentiality and integrity.

1.2 Access Controls. Access to data and systems is limited according to the principle of least privilege and managed via role-based access control. Multi-factor authentication is required for all privileged users, and access provisioning is integrated with Single Sign-On systems. Access rights are reviewed periodically to maintain secure and appropriate permissions.

1.3 Logging and Monitoring. Comprehensive logging is implemented across all infrastructure and application components. Logs are stored in secure, immutable systems and are continuously monitored. Suspicious or unauthorized activities generate real-time alerts and trigger incident response procedures.

1.4 Vulnerability and Patch Management. Routine vulnerability scans are performed across all environments. Security updates and patches are applied based on risk assessment, severity, and system criticality. External security assessments and penetration tests are conducted regularly.

1.5 Secure Software Development. A secure software development lifecycle is practiced, including activities such as threat modeling, secure code reviews, and automated security testing. Identified vulnerabilities are remediated prior to release, and secure development standards are followed throughout the lifecycle.

1.6 Network and Infrastructure Security. Network architecture is segmented and designed with layered defenses, including firewalls, intrusion detection systems, and traffic filtering mechanisms. Cloud environments are configured to restrict access based on defined security zones. Protections are in place to mitigate common threats such as DDoS attacks.

1.7 Backup and Disaster Recovery. Backups are encrypted and created on a daily basis, with redundancy across multiple geographic regions. Business continuity and disaster recovery plans are documented, tested, and regularly updated to ensure system resilience and data availability.

2. Organizational Security Measures

2.1 Information Security Management System. A formal information security program is in place to guide policies, procedures, risk management, and continuous improvement efforts. Governance is maintained through regular reviews and audits.

2.2 Data Protection by Design and Default. Security and privacy are integrated into system and product design from the outset. Personal data is collected and processed using configurations that favor minimal access, reduced data retention, and maximum user control.

2.3 Data Subject Rights Management. Processes support individuals' rights regarding their data, including access, correction, deletion, and portability. Requests are authenticated, logged, and addressed within defined timeframes, ensuring transparency and accountability.

2.4 Training and Awareness. All employees receive mandatory training on security, privacy, and compliance topics. Role-specific training is provided for developers and other personnel with access to sensitive data. Ongoing awareness campaigns and simulations help reinforce best practices.

2.5 Vendor and Third-Party Management. Vendors are subject to risk assessments and due diligence procedures prior to onboarding. Security and privacy requirements are contractually enforced, and vendor performance is monitored throughout the engagement lifecycle.

2.6 Incident Response Management. An established incident response process enables timely identification, containment, eradication, and recovery from security incidents. Lessons learned are documented and used to improve processes. Affected stakeholders are notified promptly in the event of a data breach.

2.7 Audit and Compliance. Internal and external audits are conducted regularly to assess the effectiveness of controls and verify adherence to security and privacy requirements. Gaps are documented and addressed through defined remediation processes.

2.8 User Lifecycle Management. User access is managed through standardized onboarding and offboarding workflows. Permissions are reviewed regularly, and accounts are promptly deactivated upon role changes or departures. Monitoring ensures adherence to access management policies.

ANNEX III

LIST OF SUB-PROCESSORS

For TYPEFORM

TYPEFORM shall be entitled to seek the assistance of its affiliates TYPEFORM US LLC, conducting business in the US and having registered address at Spaces 95, 3rd St. 2nd Floor - San Francisco, CA 94103 (United States of America); TYPEFORM UK Limited, a company incorporated in England and Wales with registered office at 9th Floor, 107 Cheapside, London, EC2V 6DN (United Kingdom); and Typeform DE GmbH, a company incorporated in Germany with registered office at EdisonStr. 63 - 12459 Berlin (Germany). These companies are providing engineering, marketing & sales and customer success support services. Additionally, TYPEFORM shall be entitled to engage other companies as subprocessors as identified here https://help.typeform.com/hc/en-us/articles/360029617191-What-other-companies-do-we-share-data-with

For VIDEOASK

Company shall be entitled to seek the assistance of its affiliates TYPEFORM US LLC, conducting business in the US and having registered address at Spaces 95, 3rd St. 2nd Floor, San Francisco, CA 94103 (United States of America); and TYPEFORM UK Limited, a company incorporated in England and Wales with registered office at 9th Floor, 107 Cheapside, London, EC2V 6DN (United Kingdom). These companies are providing engineering and customer success support services. Additionally, Company shall be entitled to engage Amazon Web Services Inc., a US entity with registered address at 2021 Seventh Ave., Seattle — Washington 98121 (United States of America) for the provision of hosting services; Auth0, Inc., a US entity with registered address at 10800 NE 8th, St Suite 700, Bellevue, WA 98004 (USA) for user authentication services; Slack Technologies, LLC, a US entity with registered address at 500 Howard Street, San Francisco — California 94105 (USA); as well as other subprocessors for carrying out the Services, as those subprocessors are listed and identified in https://www.videoask.com/help/how-it-works/4405905082260-what-companies-do-we-share-data-with.

ANNEX IV

International Data Transfer Addendum to the EU Commission Standard Contractual Clauses

This Addendum has been issued by the Information Commissioner for Parties making Restricted Transfers. The Information Commissioner considers that it provides Appropriate Safeguards for Restricted Transfers when it is entered into as a legally binding contract.

Part 1: Tables

Table 1 Parties

Start date: As specified in the STCs

The Parties:

Exporter (who sends the Restricted Transfer)
Full legal name: Typeform SL
Trading name (if different): N/A
Main address (if a company registered address): As specified in the STCs
Registration number (if any) (company number or similar identifier): As specified in the STCs
Key Contact
Full Name (optional): N/A
Job Title: N/A
Contact details including email: gdpr@typeform.com

Importer (who receives the Restricted Transfer)
Full legal name: The relevant sub-processor located outside the UK/EEA that receives the personal data as part of an onward transfer under Section 9, as listed in Annex III of this DPA (for example, Amazon Web Services Inc.)
Trading name (if different): As listed in Annex III of this DPA
Main address (if a company registered address): As listed in Annex III of this DPA
Official registration number (if any) (company number or similar identifier): As identified when creating an account with us
Key Contact
Full Name (optional): N/A
Job Title: N/A
Contact details including email: As listed in Annex III of this DPA

Signature (if required for the purposes of Section 2)

Table 2: Selected SCCs, Modules and Selected Clauses

As stipulated in Section 9 of the DPA.

Table 3: Appendix Information

Appendix Information: means the information which must be provided for the selected modules as set out in the Appendix of the EU SCCs (other than the Parties), and which is set out in the DPA.

Table 4:

Neither party may end this Addendum when the approved Addendum changes.

Part 2: Mandatory Clauses

Entering into this Addendum

1. Each Party agrees to be bound by the terms and conditions set out in this Addendum, in exchange for the other Party also agreeing to be bound by this Addendum.

2. Although Annex 1A and Clause 7 of the Approved EU SCCs require signature by the Parties, for the purpose of making Restricted Transfers, the Parties may enter into this Addendum in any way that makes them legally binding on the Parties and allows data subjects to enforce their rights as set out in this Addendum. Entering into this Addendum will have the same effect as signing the Approved EU SCCs and any part of the Approved EU SCCs.

Interpretation of this Addendum

5. Where this Addendum uses terms that are defined in the Approved EU SCCs those terms will have the same meaning as in the Approved EU SCCs. In addition, the following terms have the following meanings:

Addendum: This International Data Transfer Addendum which is made up of this Addendum incorporating the Addendum EU SCCs.

Addendum EU SCCs: The version(s) of the Approved EU SCCs which this Addendum is appended to, as set out in Section ‘Table 2’, including the ‘Appendix Information.

Appendix Information: As set out in Table 3.

Appropriate Safeguards: The standard of protection over the personal data and of data subjects’ rights, which is required by UK Data Protection Laws when you are making a Restricted Transfer relying on standard data protection clauses under Article 46(2)(d) UK GDPR.

Approved Addendum: The template Addendum issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18.

Approved EU SCCs: The Standard Contractual Clauses set out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

ICO: The Information Commissioner.

Restricted Transfer: A transfer which is covered by Chapter V of the UK GDPR.

UK: The United Kingdom of Great Britain and Northern Ireland.

UK Data Protection Laws: All laws relating to data protection, the processing of personal data, privacy and/or electronic communications in force from time to time in the UK, including the UK GDPR and the Data Protection Act 2018.

UK GDPR: As defined in Section 3 of the Data Protection Act 2018.

7. This Addendum must always be interpreted in a manner that is consistent with UK Data Protection Laws and so that it fulfils the Parties’ obligation to provide the Appropriate Safeguards.

8. If the provisions included in the Addendum EU SCCs amend the Approved SCCs in any way which is not permitted under the Approved EU SCCs or the Approved Addendum, such amendment(s) will not be incorporated in this Addendum and the equivalent provision of the Approved EU SCCs will take their place.

9. If there is any inconsistency or conflict between UK Data Protection Laws and this Addendum, UK Data Protection Laws applies.

10. If the meaning of this Addendum is unclear or there is more than one meaning, the meaning which most closely aligns with UK Data Protection Laws applies.

11. Any references to legislation (or specific provisions of legislation) means that legislation (or specific provision) as it may change over time. This includes where that legislation (or specific provision) has been consolidated, re-enacted and/or replaced after this Addendum has been entered into.

Hierarchy

12. Although Clause 5 of the Approved EU SCCs sets out that the Approved EU SCCs prevail over all related agreements between the parties, the parties agree that, for Restricted Transfers, the hierarchy in Section 10 will prevail.

13. Where there is any inconsistency or conflict between the Approved Addendum and the Addendum EU SCCs (as applicable), the Approved Addendum overrides the Addendum EU SCCs, except where (and in so far as) the inconsistent or conflicting terms of the Addendum EU SCCs provides greater protection for data subjects, in which case those terms will override the Approved Addendum.

14. Where this Addendum incorporates Addendum EU SCCs which have been entered into to protect transfers subject to the General Data Protection Regulation (EU) 2016/679 then the Parties acknowledge that nothing in this Addendum impacts those Addendum EU SCCs.

Incorporation of and changes to the EU SCCs

15. This Addendum incorporates the Addendum EU SCCs which are amended to the extent necessary so that:

• a. together they operate for data transfers made by the data exporter to the data importer, to the extent that UK Data Protection Laws apply to the data exporter’s processing when making that data transfer, and they provide Appropriate Safeguards for those data transfers;
• b. Sections 9 to 11 override Clause 5 (Hierarchy) of the Addendum EU SCCs; and
• c. this Addendum (including the Addendum EU SCCs incorporated into it) is (1) governed by the laws of England and Wales and (2) any dispute arising from it is resolved by the courts of England and Wales, in each case unless the laws and/or courts of Scotland or Northern Ireland have been expressly selected by the Parties.

16. Unless the Parties have agreed alternative amendments which meet the requirements of Section 12, the provisions of Section 15 will apply.

17. No amendments to the Approved EU SCCs other than to meet the requirements of Section 12 may be made.

18. The following amendments to the Addendum EU SCCs (for the purpose of Section 12) are made:

• a. References to the “Clauses” means this Addendum, incorporating the Addendum EU SCCs;
• b. In Clause 2, delete the words: “and, with respect to data transfers from controllers to processors and/or processors to processors, standard contractual clauses pursuant to Article 28(7) of Regulation (EU) 2016/679”;
• c. Clause 6 (Description of the transfer(s)) is replaced with: “The details of the transfers(s) and in particular the categories of personal data that are transferred and the purpose(s) for which they are transferred) are those specified in Annex I.B where UK Data Protection Laws apply to the data exporter’s processing when making that transfer.”;
• d. Clause 8.7(i) of Module 1 is replaced with: “it is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer”;
• e. Clause 8.8(i) of Modules 2 and 3 is replaced with: “the onward transfer is to a country benefitting from adequacy regulations pursuant to Section 17A of the UK GDPR that covers the onward transfer;”
• f. References to “Regulation (EU) 2016/679”, “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation)” and “that Regulation” are all replaced by “UK Data Protection Laws”. References to specific Article(s) of “Regulation (EU) 2016/679” are replaced with the equivalent Article or Section of UK Data Protection Laws;
• g. References to Regulation (EU) 2018/1725 are removed;
• h. References to the “European Union”, “Union”, “EU”, “EU Member State”, “Member State” and “EU or Member State” are all replaced with the “UK”;
• i. The reference to “Clause 12(c)(i)” at Clause 10(b)(i) of Module one, is replaced with “Clause 11(c)(i)”;
• j. Clause 13(a) and Part C of Annex I are not used;
• k. The “competent supervisory authority” and “supervisory authority” are both replaced with the “Information Commissioner”;
• l. In Clause 16(e), subSection (i) is replaced with: “the Secretary of State makes regulations pursuant to Section 17A of the Data Protection Act 2018 that cover the transfer of personal data to which these clauses apply;”;
• m. Clause 17 is replaced with: “These Clauses are governed by the laws of England and Wales.”;
• n. Clause 18 is replaced with: “Any dispute arising from these Clauses will be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.”; and
• o. The footnotes to the Approved EU SCCs do not form part of the Addendum, except for footnotes 8, 9, 10 and 11.

Amendments to this Addendum

19. The Parties may agree to change Clauses 17 and/or 18 of the Addendum EU SCCs to refer to the laws and/or courts of Scotland or Northern Ireland.

20. If the Parties wish to change the format of the information included in Part 1: Tables of the Approved Addendum, they may do so by agreeing to the change in writing, provided that the change does not reduce the Appropriate Safeguards.

21. From time to time, the ICO may issue a revised Approved Addendum which:

• a. makes reasonable and proportionate changes to the Approved Addendum, including correcting errors in the Approved Addendum; and/or
• b. reflects changes to UK Data Protection Laws;

22. The revised Approved Addendum will specify the start date from which the changes to the Approved Addendum are effective and whether the Parties need to review this Addendum including the Appendix Information. This Addendum is automatically amended as set out in the revised Approved Addendum from the start date specified.

23. If the ICO issues a revised Approved Addendum under Section 18, if any Party selected in Table 4 “Ending the Addendum when the Approved Addendum changes”, will as a direct result of the changes in the Approved Addendum have a substantial, disproportionate and demonstrable increase in:

• a. its direct costs of performing its obligations under the Addendum; and/or
• b. its risk under the Addendum,

24. and in either case it has first taken reasonable steps to reduce those costs or risks so that it is not substantial and disproportionate, then that Party may end this Addendum at the end of a reasonable notice period, by providing written notice for that period to the other Party before the start date of the revised Approved Addendum.

25. The Parties do not need the consent of any third party to make changes to this Addendum, but any changes must be made in accordance with its terms.