Data Processing Addendum

Version 1.0 · Last updated: 13 October 2026

This Data Processing Addendum (“DPA”) forms part of the Agreement between Ares Technology Limited (“Ares”) and the Customer (as identified in the applicable Order Form) and sets out how Customer Personal Data is processed under the Agreement.

To the extent there is a conflict in relation to the processing of Customer Personal Data, the following order of precedence applies: (1) the Transfer Mechanisms in Annex IV, for the transfers they cover; (2) this DPA and its Annexes; and (3) the rest of the Agreement. Capitalised terms not defined here have the meanings given in the Ares Platform Terms.

1. Definitions and Interpretation

Unless otherwise defined herein, capitalised terms and expressions used in this DPA shall have the following meaning.

“Agreement”: means the Ares Platform Terms, together with this DPA and each applicable Order Form accepted in accordance with those Terms, including electronically.
“Aggregated Data”: has the meaning given in the Ares Platform Terms. Aggregated Data is not Customer Personal Data.
“Applicable Data Protection Laws”: means UK GDPR, the Data Protection Act 2018, and, to the extent applicable to the processing of Personal Data under this DPA, the EU GDPR (Regulation (EU) 2016/679) and any other data protection or privacy legislation applicable to a Party, including, where applicable to the relevant processing, the US State Privacy Laws.
“Customer Personal Data”: means Personal Data comprised within Customer Data (as defined in the Ares Platform Terms) that is processed by Ares on behalf of the Customer under or in connection with the Agreement, including Personal Data about the Customer’s own customers, contacts, leads or prospects collected, imported, enriched or processed via the Services. Customer Personal Data also includes Personal Data within Supplemental Data or Usage Data to the extent Ares processes that Personal Data on the Customer’s behalf.
“DPA”: means this addendum and its Annexes.
“Prohibited Data”: means: (a) Special Categories of Personal Data; (b) personal data relating to criminal convictions and offences; (c) personal data of children under the age of 18 (or such lower age of digital consent as applies in the relevant jurisdiction); (d) payment card data subject to PCI DSS, financial account numbers, or government-issued identification numbers; and (e) other categories of data that the Parties agree in writing must not be processed via the Services.
“Services”: means the services provided and defined under the Agreement.
“Sub-processor”: means any third party, including any Ares group company, engaged by Ares to process Customer Personal Data on behalf of the Customer.
“Supplemental Data”: has the meaning given in the Ares Platform Terms.
“Transfer Mechanism”: means a lawful mechanism recognised under Applicable Data Protection Laws for the transfer of Personal Data outside the UK or EEA, including but not limited to the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, the UK Extension to the EU-U.S. Data Privacy Framework (the “UK-US Data Bridge”), the EU-U.S. Data Privacy Framework, and adequacy decisions.
“UK GDPR”: means the EU GDPR as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended.
“US State Privacy Laws”: means all US state laws relating to the protection of personal information that are applicable to the processing of Customer Personal Data, including but not limited to the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”).

The terms “Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Special Categories of Personal Data” have the meanings given in Applicable Data Protection Laws.

Where and to the extent that the EU GDPR applies to the processing of Customer Personal Data under this DPA: (a) references to UK GDPR or to any provision of UK GDPR shall be read as including the EU GDPR or its equivalent provision; (b) references to the Information Commissioner’s Office shall be read as including the competent supervisory authority under the EU GDPR; (c) references to the UK shall, where the context requires, be read as including the EEA; and (d) terms defined by reference to Applicable Data Protection Laws shall bear the meaning given under whichever of UK GDPR or EU GDPR applies to the relevant processing. Where both regimes apply to the same processing, this DPA shall be interpreted so as to give effect to the requirements of both.

2. Roles of the Parties

2.1.
The Customer is the Controller and Ares is the Processor of the Customer Personal Data for the purposes of the Applicable Data Protection Laws, save as set out in clause 2.3.
2.2.
The subject matter, duration, nature and purpose of processing, the types of Personal Data, and the categories of Data Subjects are set out in Annex I (Description of Processing).
2.3.
This DPA does not apply to Personal Data that Ares processes as an independent Controller for its own lawful purposes, including administration of account contacts, billing and contractual business records, and Usage Data used for independently determined service-security and business-administration purposes, as described in its Privacy Policy. Ares is also an independent Controller for sourcing and supplying Supplemental Data as described in clause 3.6.
2.4.
Each Party shall comply with all obligations that apply to it under Applicable Data Protection Laws.

3. Processing of Customer Personal Data

3.1.
Ares shall process Customer Personal Data only:
1. 3.1.1.
  on the documented instructions of the Customer and as described in Annex I, except insofar as required to do otherwise by the Applicable Data Protection Laws (the “Permitted Purposes”); and
2. 3.1.2.
  in compliance with the Agreement and any obligations imposed on Ares by Applicable Data Protection Laws.
3.2.
The Agreement, this DPA, the Customer’s configurations and its authorised use of the Services constitute documented instructions. Ares will promptly notify the Customer if, in its opinion, any instruction infringes Applicable Data Protection Laws.
3.3.
As between the Parties, the Customer is responsible for providing all notices and information to Data Subjects required under Applicable Data Protection Laws for processing Customer Personal Data on its behalf.
3.4.
Where Customer Personal Data includes Personal Data relating to individuals who are not users of the Services, including the Customer’s prospects, contacts, or meeting participants, the Customer is solely responsible for identifying and maintaining a valid lawful basis for the collection and processing of such data.
3.5.
The Customer represents and warrants that it has provided, and will maintain throughout the term, all required consents, notices, and legal bases to permit recording, transcription and processing of personal data relating to participants in any meeting or communication using the recording or transcription features of the Services.
3.6.
Where Customer Personal Data is enriched using tools or integrations configured by the Customer, Ares processes the resulting data on behalf of the Customer under this DPA. Where Ares supplies Supplemental Data, Ares acts as an independent Controller for its sourcing and supply. The Customer acts as Controller for its own subsequent processing. Personal Data within Supplemental Data hosted or otherwise processed by Ares on the Customer’s behalf within the Services is Customer Personal Data.
3.7.
Each Party shall provide reasonable cooperation to the other in respect of any Data Subject request, objection or complaint relating to Supplemental Data.

4. Prohibited Data

4.1.
The Services are not intended for the processing of Prohibited Data. The Customer shall not, and shall ensure its Authorised Users do not, intentionally submit Prohibited Data to the Services or configure the Services to collect it, unless agreed in writing under clause 4.4.
4.2.
The Customer acknowledges that recordings, transcripts and other content captured by the Services may incidentally contain Prohibited Data. Such incidental processing shall not by itself constitute a breach of this DPA by either Party. Ares shall process any such data as Customer Personal Data in accordance with this DPA and Annex II, and the Customer remains responsible for any lawful basis or condition required for that processing.
4.3.
If either Party becomes aware that Prohibited Data has been submitted to the Services other than incidentally, it shall notify the other Party promptly. The Customer shall delete that data using the Services’ deletion functionality or instruct Ares to delete it. Ares may restrict access to or delete such data where reasonably necessary to comply with Applicable Data Protection Laws, giving the Customer prior notice where practicable.
4.4.
Any agreed exception must be recorded in writing and specify the categories of Prohibited Data, the purpose of processing, and any additional security measures that apply.

5. Personnel and Confidentiality

5.1.
Ares shall ensure that any person authorised to process Customer Personal Data is subject to a strict duty of contractual or statutory confidentiality and shall only process Customer Personal Data as necessary in order to carry out the Permitted Purposes.

6. Security

6.1.
Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as well as the risk to the rights and freedoms of natural persons, Ares shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including, as appropriate, measures referred to under Applicable Data Protection Laws.
6.2.
At minimum, Ares shall have in place the measures set out in Annex II. Ares may update the measures in Annex II from time to time provided such updates do not materially reduce the overall level of security.

7. Personal Data Breach

7.1.
Where Ares becomes aware of a Personal Data Breach affecting Customer Personal Data, Ares shall inform the Customer without undue delay and in any event within 48 hours of becoming aware of it. Where Ares does not have all relevant information at that time, it may provide the information in phases without undue further delay.
7.2.
To the extent information is available at the time, such notification shall include:
1. 7.2.1.
  the nature of the breach;
2. 7.2.2.
  the likely consequences of the breach; and
3. 7.2.3.
  measures taken or proposed to address the breach and mitigate its effects.
7.3.
Ares shall cooperate with the Customer to take reasonable steps as required by the Customer to assist in any investigation, mitigation or remediation of the breach.

8. Sub-Processing

8.1.
The Customer authorises Ares to engage Sub-processors to process Customer Personal Data, subject to the requirements of this clause 8. Ares’ current list of Sub-processors is set out and maintained at https://trust.withares.ai/, or such other URL as Ares may notify, which in each case identifies the Sub-processor and its processing location(s).
8.2.
Ares shall provide at least 14 days’ prior notice of the addition or replacement of any Sub-processor, which notice may be given by posting the details of the update to the URL above, or by email.
8.3.
If the Customer has a reasonable objection, on data protection grounds and supported by specific written reasons, to a new or replacement Sub-processor, it shall notify Ares in writing within the notice period, and the Parties shall discuss the objection in good faith. If Ares cannot reasonably accommodate the objection, including by offering an alternative means of providing the affected Services, and the objection remains unresolved for 30 days following Ares’ receipt of the Customer’s notice, the Customer may, as its sole and exclusive remedy, terminate only those Services that cannot be provided without the objected-to Sub-processor, on written notice.
8.4.
Ares shall impose data protection obligations on each Sub-processor that are substantially no less protective of Customer Personal Data than those set out in this DPA, and shall remain fully liable to the Customer for any breach of this DPA that is caused by an act, error or omission of the Sub-processor.
8.5.
Ares shall not make Customer Personal Data available to any Sub-processor for that Sub-processor’s own model training or improvement purposes. Where a Sub-processor that is an AI or machine learning model provider offers a mechanism to opt out of any such use, Ares shall maintain that opt-out, and shall notify the Customer if it ceases to be available.

9. Data Subject Rights

9.1.
Where a Data Subject makes a request relating to the exercise of their legal rights in relation to Personal Data and taking into account the nature of the processing, Ares shall assist the Customer to enable the Customer to respond, insofar as this is possible. Ares may charge the Customer its reasonable costs of providing such assistance where the relevant request is manifestly unfounded, excessive or repetitive, or where the Customer is able to respond to the request itself using self-service functionality of the Services.
9.2.
If Ares receives a request directly from a Data Subject in respect of Customer Personal Data, it shall not respond substantively and shall promptly forward the request to the Customer, save that it may acknowledge receipt and confirm that the request has been redirected.

10. Data Protection Impact Assessment

10.1.
Ares shall provide reasonable assistance to the Customer with any data protection impact assessments the Customer requires in accordance with Applicable Data Protection Laws, including, where necessary, to assist the Customer with any consultation with the relevant supervisory authority.

11. Deletion or return of Customer Personal Data

11.1.
Upon termination or expiry of the Agreement, or permanent cessation of an affected Service, Ares shall, at the Customer’s choice, delete the relevant Customer Personal Data or return a copy in a standard, commonly used format and then delete it. Return and deletion shall take place in accordance with the deadlines in Annex I.
11.2.
This clause is subject to Ares’ right to retain Customer Personal Data under clause 5.5 of the Ares Platform Terms, in which case Ares shall isolate and protect that data from further processing except for the purpose for which it is retained.

12. Audit rights

12.1.
Ares shall maintain records sufficient to demonstrate compliance with its obligations under this DPA. Ares will also maintain a third party audit of its security measures which shall be completed at least annually and in accordance with SOC 2 Type II standards, or an equivalent. Ares shall make available to the Customer such documentation, including the third party audit report or a summary of such, as necessary to confirm Ares’ compliance with this DPA.
12.2.
Where the Customer’s audit requirements are not satisfied, or cannot be satisfied, by the rights set out in clause 12.1, the Customer may conduct an audit of Ares solely with the purpose of confirming Ares’ compliance with this DPA at its own cost. Audits must be completed by a verified third party, requested no more than once per 12-month period, save where required by a supervisory authority or following a Personal Data Breach, on 30 days’ written notice, during business hours, and subject to confidentiality.

13. Data Transfers

13.1.
Ares may transfer Customer Personal Data outside of the UK or the EEA only where an appropriate Transfer Mechanism is in place, or the destination benefits from an applicable adequacy decision.
13.2.
The Transfer Mechanisms that apply to transfers of Customer Personal Data under this DPA, and the Parties’ completion of the applicable Standard Contractual Clauses and UK transfer tools, are set out in Annex IV (International Data Transfers), which forms part of this DPA. By entering into this DPA, the Parties are deemed to have entered into those Transfer Mechanisms as completed in Annex IV.
13.3.
Where Customer Personal Data is transferred to Ares or a Sub-processor in the United States that is self-certified under the EU-U.S. Data Privacy Framework, or the UK Extension to the EU-U.S. Data Privacy Framework, the transfer is made in reliance on that framework. If the relevant framework is invalidated or ceases to provide a lawful basis for the transfer, or the recipient’s certification lapses or is withdrawn: (a) for a transfer from the Customer to Ares, the Standard Contractual Clauses as completed in Annex IV shall apply to that transfer without further action by the Parties; and (b) for an onward transfer from Ares to a Sub-processor, Ares shall ensure that the transfer is covered by an alternative valid Transfer Mechanism.
13.4.
Where Ares intends to host Customer Personal Data, or engage a Sub-processor to process it, in a country not listed in Annex I, Ares shall (a) give prior notice in accordance with clause 8.2, during which the Customer may object under clause 8.3; and (b) ensure that a valid Transfer Mechanism, and any required transfer risk assessment, is in place before the transfer occurs.
13.5.
If any Transfer Mechanism relied upon under this DPA is invalidated, suspended, or ceases to be a lawful basis for the relevant transfer, the Parties shall cooperate in good faith to implement, without undue delay, an alternative valid Transfer Mechanism, and Ares may suspend the affected transfer until such alternative is in place.

14. Liability

14.1.
Each Party’s liability arising out of or in connection with this DPA, whether in contract, tort or otherwise, is subject to the exclusions and limitations of liability set out in the Agreement, and any such liability shall count towards the cap in clause 12.4 of the Ares Platform Terms. Nothing in this clause 14 limits or excludes either Party’s liability to Data Subjects or supervisory authorities under Applicable Data Protection Laws.

15. US State Privacy Laws

15.1.
This clause applies where and to the extent that Ares processes Customer Personal Data that is subject to the US State Privacy Laws. For such data, the Customer is the “business” (or equivalent) and Ares is the “service provider” (or equivalent).
15.2.
Ares shall process such Customer Personal Data solely to provide the Services and for the Permitted Purposes, and shall not:
1. 15.2.1.
  sell or share the data (as those terms are defined in the US State Privacy Laws);
2. 15.2.2.
  retain, use or disclose the data for any purpose other than performing the Services or as otherwise permitted for service providers under the US State Privacy Laws, including to improve the quality of the Services; or
3. 15.2.3.
  combine the data with personal information obtained from other sources, except as permitted by the US State Privacy Laws, including to provide the enrichment functionality of the Services.
15.3.
Ares shall notify the Customer without undue delay if it determines that it can no longer meet its obligations under the applicable US State Privacy Laws. The Customer may, on reasonable notice, take reasonable and appropriate steps to stop and remediate any unauthorised use of Customer Personal Data.

16. Term and Termination

16.1.
This DPA remains in effect for as long as Ares or any Sub-processor retains Customer Personal Data. All obligations relevant to that retained data, including confidentiality, security, breach response, assistance, Sub-processor oversight, audit, return/deletion, transfers and liability, continue until lawful deletion is completed. Clauses which by their nature must survive continue thereafter.

17. General Terms

17.1.
Confidentiality. General confidentiality obligations between the Parties, as distinct from the data-protection-specific confidentiality duties in clause 5, are governed by the confidentiality provisions of the Ares Platform Terms.
17.2.
Variation. Save for updates expressly permitted under this DPA, no variation of this DPA shall be effective unless in writing and signed by both Parties.
17.3.
Severability. If any provision of this DPA is held invalid or unenforceable, the remainder shall continue in full force and effect.
17.4.
Governing Law and Jurisdiction. This DPA is governed by the laws of England and Wales and the courts of England and Wales shall have exclusive jurisdiction, save that nothing in this clause restricts a Data Subject’s or supervisory authority’s rights under Applicable Data Protection Laws.

Annex I - Description of Processing

This Annex describes processing by Ares as Processor on the Customer’s behalf. Capitalised terms have the meanings given in the DPA.

Customer Name: The Customer’s name as set out in the Customer’s Order Form.
Address: The Customer’s registered address as set out in the Customer’s Order Form.
Contact details: As set out in the Order Form.
Activities relevant to the data transferred under these Clauses: Ares processes Customer Personal Data to provide, operate, secure and support the Services pursuant to the Agreement.
Signature and date: This DPA is deemed executed when the Agreement is validly accepted by the Parties, including electronically, and applies from the start of the relevant processing.
Role (controller/processor): Controller in respect of Customer Personal Data.

Ares’ Name: Ares Technology Limited
Address: Ares’ registered address as set out in the Agreement.
Contact details: legal@withares.ai
Activities relevant to the data transferred under these Clauses: Ares processes Customer Personal Data to provide, operate, secure and support the Services pursuant to the Agreement.
Signature and date: This DPA is deemed executed when the Agreement is validly accepted by the Parties, including electronically, and applies from the start of the relevant processing.
Role (controller/processor): Processor in respect of Customer Personal Data.

Subject matter of processing: Ares processes Customer Personal Data to provide, operate, secure and support the Services pursuant to the Agreement.
Nature of processing: Hosting, storage, retrieval, analysis, classification, summarisation, generation of outputs, platform access, support, monitoring, and security.
Purpose of processing: Customer Personal Data is processed to provide the Services and to maintain, secure and improve them, as described in this Annex I.
Duration of processing: For the term of the Agreement, plus the deletion or return period set out below.
Categories of data subjects: Customer employees and users.
Individuals at the Customer’s own customers, prospects, partners and other business contacts, including participants in calls and meetings recorded or transcribed via the Services.
Categories of Personal Data: User identity and contact information, including business email address and account identifiers.
Authentication and account metadata, including user IDs, authentication tokens and account status flags.
Customer application profile, settings and configuration data.
Customer-uploaded files or content.
Application logs and operational metadata that may include request identifiers or user IDs.
Audio files and transcripts; and backup/recovery copies of the above.
Enrichment data appended to Customer Personal Data via Customer-configured integrations, and Supplemental Data once delivered into the Customer’s account.
Derived content and outputs, including transcripts, summaries, action items, insights and other outputs generated by the Services.
Special category, criminal offence, children’s or sensitive data: No intentional processing is authorised unless specifically agreed in writing under clause 4.
Independent controller processing, if any: Ares acts as an independent Controller in respect of its sourcing and supply of Supplemental Data and for the limited account, billing, business-record and Usage Data purposes described in clause 2.3. Personal Data in Supplemental Data or Usage Data processed on the Customer’s behalf is Customer Personal Data subject to this DPA.
Processing locations, including remote access locations: At the date of this DPA, hosting and Sub-processor locations are the UK, EEA and United States. Ares may add a new hosting or Sub-processor location only in accordance with clauses 8.2, 8.3 and 13.4. Temporary access by Ares employees from another country is permitted as described below and is not a new location for this purpose.
Temporary access by employees of Ares from another country is permitted only following Ares’ documented assessment of applicable legal and security risks and subject to Annex II. Access by a separate group entity or contractor is subject to clause 8 where that entity is a Sub-processor and clause 13 where it constitutes a restricted transfer. No access may take place in breach of applicable sanctions or data-protection law.
International transfers: At the date of this DPA, hosting and Sub-processor locations are the UK, EEA and United States. Ares may add a new hosting or Sub-processor location only in accordance with clauses 8.2, 8.3 and 13.4.
Deletion or return period: Active systems. Ares shall delete the relevant Customer Personal Data from active production systems by the earlier of:
90 days after termination or expiry of the Agreement, or permanent cessation of the affected Service; and
30 days after receiving the Customer’s written instruction to delete that data.
Return. If the Customer requests a copy before deletion, Ares shall return it in a standard, commonly used format before completing deletion and within the applicable deadline above.
Backups. Backup copies shall be permanently deleted or overwritten no later than 90 days after deletion from active production systems. Until then, they shall remain protected and unavailable for ordinary operational use. If a backup is restored for disaster recovery, the relevant deletion instructions shall be reapplied before the restored data returns to ordinary operational use.
Sub-processors. Ares shall ensure that its Sub-processors comply with these deadlines.
These requirements are subject only to lawful retention permitted under clause 11.2.
AI, machine learning, analytics, product improvement or model training use: Ares uses AI, machine learning, embeddings and analytics to provide the Services to the Customer, including parsing, summarising, classifying, searching and generating outputs from Customer Personal Data.
Ares may also process Customer Personal Data to maintain, secure and improve the Services supplied to the Customer, subject to clauses 5.2 and 5.3 of the Ares Platform Terms. Customer content is never shared with or made visible to other customers.
Ares personnel only access the content of Customer Personal Data to the extent necessary to support, operate and maintain the Services for the Customer, investigate and resolve faults or security incidents, or comply with applicable law, in each case subject to appropriate access controls, confidentiality obligations and this DPA. Any Customer Personal Data used to create test data is anonymised first.
Ares shall not use Customer Personal Data to train any AI or machine learning model, or make it available to a Sub-processor for that Sub-processor’s own model training or improvement purposes.
Ares may create Aggregated Data and use it for analytics, benchmarking and improving the Services.
Security measures: See Annex II.
Approved sub-processors: See Annex III.

Annex II - Technical and Organisational Security Measures

Ares maintains an information security programme that is independently audited at least annually. Ares maintains appropriate technical and organisational measures, including encryption, SSO/MFA, role-based and least-privilege access controls, confidentiality obligations, secure development practices, vulnerability management, logging and monitoring, backups, incident response, access reviews, sub-processor controls, and data deletion/return procedures.

Remote access to Customer Personal Data is permitted only through Ares-managed devices using SSO/MFA and encrypted connections, with access logged. Customer Personal Data may not be stored locally on devices except where necessary for authorised support, security or operational purposes, and access is not permitted from countries subject to comprehensive UK sanctions.

Ares maintains an up-to-date Trust Center with further information at https://trust.withares.ai/. Ares may also provide its current SOC 2 Type II report or equivalent or additional security documentation on request.

Annex III - Sub-Processors

Ares maintains an up-to-date list of Sub-Processors at https://trust.withares.ai/.

Annex IV - International Data Transfers

This Annex applies to restricted transfers of Customer Personal Data outside the UK or EEA where no adequacy decision or other valid exemption applies. Parts A and B apply between the Customer and Ares only where those Parties are the actual exporter and importer of the relevant restricted transfer and the selected clauses are legally available for that transfer. They do not deem a domestic transfer to be a restricted transfer. Ares shall separately ensure that onward transfers to Sub-processors are covered by a valid mechanism binding the actual exporter and importer, together with any required transfer assessment and supplementary measures. In this Annex:

“EU SCCs”: means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914;
“UK Addendum”: means the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner (template Addendum B.1.0).

For UK restricted transfers, the Parties use the UK Addendum with the EU SCCs as specified in Part B, including where only the UK GDPR applies; a separate UK IDTA is not incorporated by this Annex.

A. Transfers subject to the EU GDPR

Where the Customer transfers Customer Personal Data to Ares in a restricted transfer subject to the EU GDPR, and Decision (EU) 2021/914 permits use of the EU SCCs for that transfer, the EU SCCs are incorporated by reference and completed as follows:

(a)
Module Two (controller to processor) applies. The Customer is the data exporter and Ares is the data importer.
(b)
Clause 7 (the optional docking clause) does not apply.
(c)
Under Clause 9, Option 2 (general written authorisation) applies, and the notice period for changes to Sub-processors is as set out in clause 8.2 of this DPA.
(d)
Under Clause 11, the optional independent dispute-resolution language does not apply.
(e)
Under Clause 17, the EU SCCs are governed by the law of Ireland.
(f)
Under Clause 18(b), disputes are resolved before the courts of Ireland.
(g)
Annex I.A and Annex I.B of the EU SCCs are completed by Annex I of this DPA, including the Parties’ legal names, addresses and contacts in the Order Form, their relevant roles and activities, continuous transfer frequency, processing purposes and retention periods. Annex II is completed by Annex II of this DPA. For Annex I.C, the competent supervisory authority is determined under Clause 13: where the exporter is established in the EEA, the authority responsible for its compliance; where Article 3(2) applies and an Article 27 representative is appointed, the authority where that representative is established; or, where no representative is required, an authority in an EEA Member State where affected Data Subjects are located, identified by the Customer to Ares before the transfer. The Customer shall provide the relevant authority and any required representative details before a transfer relying on these clauses begins.
(h)
By entering into this DPA, the Parties are deemed to have signed the EU SCCs and their Annexes as of the effective date of the Agreement.

B. Transfers subject to the UK GDPR

For a restricted transfer of Customer Personal Data from the Customer to Ares subject to the UK GDPR, the EU SCCs as completed in Part A are incorporated and amended by the UK Addendum, whether or not the EU GDPR also applies. The UK Addendum takes precedence over inconsistent provisions for the UK transfer. Its Part 1 Tables are completed as follows:

(a)
Table 1: the start date is the effective date of the Agreement; the exporter is the Customer and the importer is Ares, with legal names, addresses, contact details and signatures as set out in Annex I and the Order Form. Table 2: the Approved EU SCCs are those annexed to Decision (EU) 2021/914, with Module Two and the selections in Part A; the optional docking and independent dispute-resolution clauses do not apply; general Sub-processor authorisation applies with the notice period in clause 8.2.
(b)
Table 3: the Appendix Information is supplied by Annexes I and II of this DPA and the Sub-processor register described in Annex III to the extent required by the selected module. Table 4: both the exporter and importer may end the UK Addendum in accordance with Section 19 of its Mandatory Clauses.
(c)
Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, are incorporated by reference. The Parties are deemed to have signed the UK Addendum when the Agreement is validly accepted. Ending the UK Addendum does not authorise continued transfers without a valid alternative mechanism.

C. Supplementary measures

In respect of any transfer under this Annex IV, Ares shall:

(a)
maintain, in accordance with good industry practice, measures to protect Customer Personal Data from interception, including encryption in transit and at rest;
(b)
use commercially reasonable efforts to resist, to the extent lawful, any overbroad or bulk government or law-enforcement request for Customer Personal Data, including any request under section 702 of the U.S. Foreign Intelligence Surveillance Act; and
(c)
unless legally prohibited, on receiving a legally binding government request for Customer Personal Data:
1. (i)
  notify the Customer without undue delay;
2. (ii)
  inform the requesting authority that Ares processes the data as a processor, and direct the request to the Customer; and
3. (iii)
  challenge the request where Ares has reasonable grounds to consider it unlawful.

Where Ares is legally prohibited from notifying the Customer, it shall use commercially reasonable efforts to obtain a waiver of that prohibition.