This UK Addendum to the Data Processing Agreement (the “UK DPA Addendum”) is entered into between the Customer and GreenSketch and supplements the Data Processing Agreement entered into between the parties in connection with the GreenSketch Platform and the EnergyBrain Platform(the “Main DPA”).

This UK DPA Addendum applies to the extent that UK Data Protection Laws (as defined below) apply to the processing of Customer Personal Data under the Main DPA.

Capitalised terms used but not defined in this UK DPA Addendum have the meanings given to them in the Main DPA. The Mandatory Clauses of the UK Transfer Addendum (as defined below) prevail over any conflicting provision of this UK DPA Addendum and may not be modified or amended. Subject to that, this UK DPA Addendum prevails over the Main DPA to the extent UK Data Protection Laws apply.

1. Definitions

1. “UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and as amended (including by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and the Data (Use and Access) Act 2025, in each case to the extent in force and applicable).
2. “Data Protection Act 2018” means the United Kingdom Data Protection Act 2018, as amended from time to time, to the extent in force and applicable.
3. “DUA Act 2025” means the United Kingdom Data (Use and Access) Act 2025, to the extent in force and applicable.
4. “UK Data Protection Laws” means all laws relating to data protection, privacy and the processing of personal data in force in the United Kingdom from time to time, including the UK GDPR, the Data Protection Act 2018 and the DUA Act 2025, in each case to the extent in force and applicable. The parties shall have regard to relevant ICO guidance where applicable to their obligations under UK Data Protection Laws.
5. “ICO” means the United Kingdom Information Commissioner’s Office (or its successor).
6. “UK Transfer Addendum” means the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses for international data transfers, Version B1.0, issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018, as amended or replaced from time to time.
7. “UK IDTA” means the International Data Transfer Agreement issued by the ICO under section 119A of the Data Protection Act 2018.
8. “UK Restricted Transfer” means a transfer of personal data to which Chapter V of the UK GDPR applies, identified by application of the ICO’s three-step test (as set out in the ICO’s guidance on international transfers updated on 15 January 2026).
9. “Data Protection Test” means the assessment required under Article 46 UK GDPR (as amended by the DUA Act 2025) that the standard of protection for data subjects following a UK Restricted Transfer is not materially lower than the standard required under UK Data Protection Laws. The ICO continues to refer to this assessment in its guidance as a “transfer risk assessment” or “TRA”.
10. “Main DPA” means the Data Processing Agreement entered into between the parties in connection with the relevant Platform, including its Appendices and Exhibits.

2. Application and incorporation of the Main DPA

1. Application. This UK DPA Addendum applies whenever and to the extent that UK Data Protection Laws apply to the processing of Customer Personal Data under the Main DPA, including where the Customer is established in the United Kingdom, offers goods or services to data subjects in the United Kingdom, or monitors the behaviour of data subjects in the United Kingdom.
2. Mutatis mutandis incorporation. Subject to clauses 2.3 and 2.4, the provisions of the Main DPA are incorporated into this UK DPA Addendum and apply mutatis mutandis to processing of Customer Personal Data subject to UK Data Protection Laws. References in the Main DPA to: (a) the “GDPR” shall be read as references to the equivalent provisions of the UK GDPR; (b) “European Data Protection Legislation” shall, where the context so requires, be read as references to UK Data Protection Laws; (c) the “supervisory authority” shall, where the context so requires, be read as references to the ICO; (d) “Union or Member State law” in section 3.2.2 of the Main DPA shall be read as references to “domestic law” within the meaning of the UK GDPR; and (e) Articles 32 to 34, 35, 36 and Chapter III of the GDPR shall be read as references to the equivalent provisions of the UK GDPR.
3. UK-specific modifications. Clauses 3 to 7 of this UK DPA Addendum modify, supplement or replace the corresponding provisions of the Main DPA to the extent UK Data Protection Laws apply. The remaining provisions of the Main DPA continue to apply unchanged.
4. Conflict. In the event of any conflict between (i) the Mandatory Clauses of the UK Transfer Addendum as set out in Schedule 1, (ii) this UK DPA Addendum and (iii) the Main DPA, the order of precedence shall be: (i), (ii), (iii). The Mandatory Clauses of the UK Transfer Addendum may not be modified or restricted.

3. Roles and compliance under UK Data Protection Laws

1. Where UK Data Protection Laws apply, the parties acknowledge and agree that: (a) GreenSketch is a processor of Customer Personal Data; (b) the Customer is a controller or, as applicable, a processor of Customer Personal Data; and (c) each party will comply with the obligations applicable to it under UK Data Protection Laws in respect of the processing of Customer Personal Data.
2. Where the Customer acts as a processor under UK Data Protection Laws, the Customer warrants that its instructions and actions, including its appointment of GreenSketch as another processor, have been authorised by the relevant controller.
3. No provision of this UK DPA Addendum or the Main DPA shall be construed as transferring to the processor any responsibility or liability that, as a matter of UK Data Protection Laws, rests with the controller, and vice versa.

4. Information Security Incidents and notification to the ICO

1. Allocation of notification responsibilities. Section 5.2 of the Main DPA applies to Information Security Incidents involving Customer Personal Data subject to UK Data Protection Laws, with the following clarifications: (a) the reference in section 5.2.3 of the Main DPA to “the competent supervisory authority” shall, where UK Data Protection Laws apply, be read as a reference to the ICO; (b) where the Customer acts as controller, the Customer remains responsible for determining whether notifications to the ICO and to data subjects are required under Articles 33 and 34 UK GDPR; and (c) where the Customer acts as processor, the Customer remains responsible for passing on relevant notifications and assistance to the relevant controller in accordance with its own obligations and the controller’s instructions.
2. Notification timing. The forty-eight (48) hour period set out in section 5.2.1 of the Main DPA reflects a contractual standard agreed between the parties. UK Data Protection Laws require notification by a processor to a controller “without undue delay” and do not prescribe a specific statutory minimum applicable to the processor.

5. International transfers under UK Data Protection Laws

1. Application of the three-step test. The parties shall apply the ICO’s three-step test to each transfer of Customer Personal Data subject to UK Data Protection Laws. A transfer constitutes a UK Restricted Transfer where: (a) UK Data Protection Laws apply to the processing of the personal data being transferred; (b) the transfer is to an organisation that is a separate legal entity established outside the United Kingdom; and (c) the transferring party initiates the transfer.
2. Acknowledged transfer flows. Without prejudice to clause 5.1, the parties acknowledge that: (a) transfers of Customer Personal Data from a Customer in the United Kingdom (or from UK-based end users) to GreenSketch are, at the date of this UK DPA Addendum, covered by UK adequacy regulations for the European Economic Area; and (b) the engagement of Chengdu Ousiwei Energy Technology Co., Ltd. in China as a Subprocessor (as set out in Exhibit 3 of the Main DPA) may involve a UK Restricted Transfer or onward transfer where UK Data Protection Laws apply, and such transfer must be assessed under this clause 5.
3. Adequacy. Where a UK Restricted Transfer is to a country, territory, sector or international organisation in respect of which UK adequacy regulations have been adopted, the transfer may be made on that basis without further transfer mechanism under this UK DPA Addendum.
4. Appropriate safeguards. Where a UK Restricted Transfer is not covered by UK adequacy regulations, the parties shall, in respect of any transfer carried out for the performance of the Main DPA, rely on the UK Transfer Addendum as set out in Schedule 1 to this UK DPA Addendum, which is incorporated into and forms part of this UK DPA Addendum. The UK Transfer Addendum operates by reference to, and in conjunction with, the EU Standard Contractual Clauses already incorporated into the Main DPA at Exhibit 4. For the avoidance of doubt, Schedule 1 governs UK Restricted Transfers between the Customer and GreenSketch only. Onward transfers by GreenSketch to its Subprocessors are governed by the onward-transfer restrictions under those clauses and, where required by the factual transfer flow, by a separate transfer mechanism entered into between GreenSketch and the relevant Subprocessor.
5. Data Protection Test. Where a UK Restricted Transfer is made on the basis of appropriate safeguards under clause 5.4, the party initiating the transfer shall complete and document a Data Protection Test in accordance with Article 46 UK GDPR (as amended by the DUA Act 2025). GreenSketch shall, in respect of UK Restricted Transfers initiated by GreenSketch in connection with its provision of the Services, complete a Data Protection Test and make the documented outcome available to the Customer on request. GreenSketch’s existing Transfer Impact Assessments under the Main DPA may satisfy the Data Protection Test where they substantively address the matters required under UK Data Protection Laws and applicable ICO guidance. For the avoidance of doubt, an EU transfer impact assessment shall not be deemed to satisfy the Data Protection Test merely because it was prepared for the purposes of EU GDPR.
6. Initiating party. The party that initiates a UK Restricted Transfer is responsible for compliance with Chapter V UK GDPR in respect of that transfer. The initiating party shall be determined by reference to the factual transfer flow, the relevant instructions and the processing chain. Without prejudice to the Customer’s responsibilities where the Customer initiates or instructs a transfer, GreenSketch shall be responsible for UK Restricted Transfers that GreenSketch initiates in connection with its appointment of Subprocessors or the operation of the Services.
7. Derogations. Reliance on a derogation under Article 49 UK GDPR shall be limited to circumstances in which neither adequacy regulations nor appropriate safeguards are available and shall not be relied upon for systematic or repetitive transfers.
8. Onward transfers. Section 9 of the Main DPA (Subprocessors) applies in full to onward transfers of Customer Personal Data subject to UK Data Protection Laws, supplemented by the requirements of this clause 5 and the safeguards set out in Schedule 2.

6. Disclosure of Confidential Information

1. Section 8.3 of the Main DPA applies, mutatis mutandis, to disclosures of Customer Confidential Information containing personal data subject to UK Data Protection Laws, with references to the Standard Contractual Clauses being read as references to the UK Transfer Addendum (and, where applicable, to the EU SCCs as modified by that UK Transfer Addendum).

7. Governing law and jurisdiction

1. The Mandatory Clauses of the UK Transfer Addendum, and the EU SCCs as incorporated and modified by that UK Transfer Addendum for the purposes of UK Restricted Transfers, are governed by the laws of England and Wales. Disputes arising out of or in connection with the UK Transfer Addendum shall be subject to the exclusive jurisdiction of the courts of England and Wales.
2. Save as set out in clause 7.1, this UK DPA Addendum is governed by the law and subject to the jurisdiction agreed in the Main DPA. For the avoidance of doubt, this clause 7 does not vary the governing law or jurisdiction of the Main DPA outside the scope of UK Restricted Transfers.

Schedule 1 — UK Transfer Addendum (Tables 1-4)

This Schedule completes Part 1 of the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses (Version B1.0) issued by the ICO and laid before Parliament under section 119A of the Data Protection Act 2018. Part 2 (Mandatory Clauses) of that UK Transfer Addendum is incorporated into this Schedule 1 by reference, may not be modified or amended (save in the limited circumstances permitted by the Mandatory Clauses themselves), and is publicly available in the ICO’s published version.

Table 1 — Parties

Table 2 — Selected SCCs, Modules and Selected Clauses

Table 3 — Appendix Information

The information in this Table 3 supplements, and is read together with, the Appendix Information of the EU SCCs set out at Exhibit 4 of the Main DPA.

Annex 1A — List of Parties: as set out in Exhibit 1 of the Main DPA and Table 1 above.

Annex 1B — Description of Transfer (UK-specific flows):

Categories of personal data, categories of data subjects, purposes, frequency, retention and the technical and organisational measures applicable to each transfer flow are as set out in Exhibits 1, 2 and 3 of the Main DPA, supplemented by the safeguards in Schedule 2 of this UK DPA Addendum.

Annex II — Technical and organisational measures: as set out in Exhibit 2 of the Main DPA, supplemented by Schedule 2 of this UK DPA Addendum.

Annex III — List of Sub-processors: as set out in Exhibit 3 of the Main DPA, as updated from time to time in accordance with section 9 of the Main DPA.

Table 4 — Ending this Addendum when the Approved Addendum changes

Mandatory Clauses (Part 2)

Part 2 (Mandatory Clauses) of the UK Transfer Addendum (Version B1.0) issued by the ICO and laid before Parliament in accordance with section 119A of the Data Protection Act 2018 on 2 February 2022 (entering into force on 21 March 2022), as it may be revised under Section 18 of those Mandatory Clauses, is incorporated into this Schedule 1 by reference and forms an integral part of this UK DPA Addendum. The current text of the Mandatory Clauses is publicly available in the ICO’s published version of the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses.

By entering into this UK DPA Addendum, each party signifies its agreement to be bound by the Mandatory Clauses.

Schedule 2 — Safeguards for UK Restricted Transfers

Please see Exhibit 2 of the Main DPA in respect the safeguards

Last updated 17 September 2026