Data Processing Addendum
Applicable to customers on any plan.
This Data Processing Addendum (“DPA”) supplements and forms part of the Customer Terms of Service, the Master Subscription Agreement, or other written agreement between Retool and Customer (the “Agreement”).
1. DEFINITIONS.
“Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under common control with the subject entity. “Control” for the purposes of this definition, means direct or indirect ownership or control of more than 50% of the voting interests of the subject entity.
“Controller” means the entity which determines the purposes and means of the Processing of Personal Data.
“Controller Affiliate” means any Customer Affiliate that (a) is authorized to use the Retool Platform, (b) on whose behalf Retool Processes Relevant Personal Data, and (c) is not the "Customer" under the Agreement.
“Customer Data” has the meaning given to that term in the Agreement.
“Data Protection Laws” means all data protection and privacy laws applicable to the respective Party in its role in the Processing of Relevant Personal Data under the Agreement, which may include, without limitation, EU Data Protection Laws, Swiss Data Protection Laws, US Data Protection Laws, and UK Data Protection Laws.
“Data Subject” means the identified or identifiable person to whom Personal Data relates.
“Data Subject Request” means any request from a Data Subject to exercise its rights under Data Protection Laws in respect of Relevant Personal Data.
“EU Data Protection Laws” means (a) the EU General Data Protection Regulation (2016/679) (GDPR); (b) the EU (Directive 2002/58/EC) (e-Privacy Directive); and (c) any and all EU Member State laws made under or pursuant to any of the foregoing; in each case as amended or superseded from time to time.
“Instructions” means any reasonable instructions provided by Customer (e.g., via email or support tickets) under this DPA that are consistent with the Agreement.
“Personal Data” means any data that relates to an identified or identifiable natural person, to the extent that such information is protected as “personal data” or “personal information” under Data Protection Laws.
“Personal Data Breach” means any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Relevant Personal Data.
“Process” or “Processing” means any operation or set of operations which is performed upon Personal Data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Processor” means the entity that Processes Personal Data on behalf of the Controller.
“Relevant Personal Data” means any Personal Data that is comprised in Customer Data.
“Regulator Correspondence” means any correspondence or communication received from a Supervisory Authority or other regulatory authority relating to Relevant Personal Data.
“Retool Group” means Retool and its Affiliates engaged in the Processing of Relevant Personal Data.
“Security Practices Page” means Retool’s Security Practices Page, as updated from time to time, and currently accessible at https://docs.retool.com/legal/security.
“Sub-processor” means any entity engaged by Retool or a member of the Retool Group to Process Relevant Personal Data in connection with the Retool Platform.
“Swiss Data Protection Laws” means the Swiss Federal Act on Data Protection and its implementing regulations as amended or superseded from time to time.
“Supervisory Authority” means an independent public authority tasked with the regulation and enforcement of Data Protection Laws, including (but not limited to) supervisory authorities established by an EU Member State pursuant to the GDPR, the UK Information Commissioner’s Office, and the Swiss Federal Data Protection and Information Commissioner.
“Third Party Request” means a written request from any third party for the disclosure of Relevant Personal Data, where compliance with such a request is required or purported to be required by applicable law or regulation.
“UK Data Protection Laws” means the Data Protection Act 2018 and the GDPR as saved into United Kingdom law by virtue of Section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 as amended or superseded from time to time.
“US Data Protection Laws” means all legislation and regulations in the United States relating to the protection of Personal Information, including (but not limited to) the Federal Trade Commission Act, Cal. Civ. Code §§ 1798.99.80 (“2019 CA Data Broker Law”), the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), and the Virginia Consumer Data Protection Act (“VCDPA”).
Capitalised terms used in this DPA but not defined in this Section 1 (Definitions) have the meaning given to them elsewhere in this DPA, the Agreement, or Data Protection Laws, unless otherwise specified.
2. PROCESSING OF RELEVANT PERSONAL DATA
2.1 Relationship of the Parties; Details of Processing.
With respect to the Processing of Relevant Personal Data, Customer is the Controller (or the Processor if Customer is acting on behalf of a third-party Controller) and Retool is the Processor or Sub-Processor. To the extent Relevant Personal Data includes personal information governed by the CCPA, Retool is the “service provider” and Customer is the “business,” as such terms are defined under the CCPA. The details of Processing are set forth in Schedule 1 of this DPA.
2.2 Customer Obligations.
Customer shall, in its use of the Retool Platform and provision of Instructions, Process Relevant Personal Data in accordance with Data Protection Laws. Customer is solely responsible for the accuracy, quality, and legality of Relevant Personal Data and the means by which it acquired such data. Customer is responsible for independently determining whether its use of the Retool Platform will meet its requirements and legal obligations under Data Protection Laws.
2.3 Retool's Processing of Relevant Personal Data.
2.3.1 Retool shall only Process Relevant Personal Data for the following purposes: (a) Processing in accordance with the Agreement and applicable Order Form(s); (b) Processing initiated by Customer or Authorised Users in their use of the Retool Platform; and (c) Processing to comply with the Instructions. Retool shall immediately inform Customer if, in Retool’s opinion, Customer’s Instructions infringe Data Protection Laws. Retool shall not Process Relevant Personal Data for any purpose other than those described in this DPA or as otherwise permitted under Data Protection Laws.
2.3.2 To the extent Relevant Personal Data includes personal information governed by the CCPA, Retool will not (a) “sell” or “share” such personal information, as those terms are defined under the CCPA; (b) combine such personal information with personal information that Retool receives from other sources, except as permitted by applicable Data Protection Laws; (c) retain, use, or disclose such personal information outside of the direct business relationship between Retool and Customer. Retool will promptly notify Customer if Retool determines it can no longer meet its obligations under the CCPA.
2.3.3 Retool shall (a) treat Relevant Personal Data as Customer’s Confidential Information under the Agreement and (b) ensure that all Retool personnel authorised to Process Relevant Personal Data are bound by appropriate confidentiality obligations.
3. SECURITY.
Retool shall maintain appropriate technical and organisational measures for the protection of the security, confidentiality, and integrity of Relevant Personal Data (including protection against unauthorised or unlawful Processing and against accidental or unlawful destruction, loss or alteration or damage, unauthorised disclosure of, or access to, Relevant Personal Data), as set forth in the Security Practices Page. Retool will not materially decrease the overall security of the Retool Platform during a subscription term.
4. SUB-PROCESSORS.
4.1 Authorization.
A current list of Retool’s Sub-processors is available at https://docs.retool.com/legal/subprocessors (the “Sub-processor List”). Customer hereby consents to these Sub-processors and provides its general authorization for Retool to engage, in accordance with the rest of this section, third-party service providers as new Sub-processors. Customer also acknowledges and agrees that Retool may engage its Affiliates as Sub-processors.
4.2 Sub-processor Requirements; Liability.
Before permitting a third-party Sub-processor to Process Relevant Personal Data, Retool or a Retool Affiliate will enter into a written agreement with the Sub-processor containing data protection obligations at least as protective of Relevant Personal Data as those in this DPA, to the extent applicable to the services the Sub-processor provides. Retool shall be liable for the acts and omissions of its Sub-processors to the same extent Retool would be liable if performing the services of each Sub-processor directly under the terms of this DPA.
4.3 New Sub-processors - Notifications and Customer's Right to Object.
4.3.1 The Sub-processor List contains a mechanism for Customer to provide an email address to subscribe to notifications of new Sub-processors (“Sub-processor Notifications”). Sub-processor Notifications will be sent to such email address provided by Customer in advance of any Relevant Personal Data being processed by a new Sub-processor.
4.3.2 To object to a new Sub-processor, Customer must, within ten (10) business days of receiving the Sub-processor Notification, send written notice to Retool stating Customer’s reasonable data-protection concerns about the new Sub-processor. Such notice must also include (a) if Customer has an enterprise-level subscription plan to the Retool Platform, a copy of its Retool Order Form for the current active subscription term or (b) if Customer has a non-enterprise level subscription plan to the Retool Platform, the account name associated with such subscription plan. Retool will use commercially reasonable efforts to make available to Customer a change in the Retool Platform or recommend a commercially reasonable change to Customer’s configuration or use of the Retool Platform to avoid Processing of Relevant Personal Data by the objected-to new Sub-processor without unreasonably burdening Customer. If Retool cannot do so within a reasonable period not exceeding thirty (30) days, either party may, by written notice, terminate the applicable Order Form(s) without penalty, but only as to those aspects of the Retool Platform that Retool cannot provide without the objected-to Sub-processor. Retool will refund any prepaid fees covering the remainder of the term of such Order Form(s) after the effective date of termination with respect to those terminated aspects of the Retool Platform.
5 REQUESTS FOR RELEVANT PERSONAL DATA.
5.1 Data Subject Requests.
Retool shall, to the extent legally permitted, promptly notify Customer if Retool receives a Data Subject Request. Taking into account the nature of the Processing, Retool shall assist Customer by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of Customer's obligation to respond to a Data Subject Request as required by Data Protection Laws. In addition, to the extent Customer, in its use of the Services, does not have the ability to address a Data Subject Request, Retool shall, upon Customer's request, provide commercially reasonable efforts to assist Customer in responding to such Data Subject Request, to the extent that Retool is legally permitted to do so and the response to such Data Subject Request is required under Data Protection Laws. To the extent legally permitted, Customer shall be responsible for any costs arising from Retool's provision of such assistance, including any fees associated with the provision of additional functionality.
5.2 Regulator Correspondence.
Retool shall promptly notify Customer on receipt of any Regulator Correspondence or Third Party Request, unless Retool is prohibited from so notifying Customer by applicable law. Retool will not disclose any Relevant Personal Data in response to such Regulator Correspondence or Third Party Request without first consulting with, and obtaining, Customer's prior written authorisation, unless legally compelled to do so.
6. PERSONAL DATA BREACH NOTIFICATION.
Retool shall notify Customer of any Personal Data Breach without undue delay or within the period required under Data Protection Law. The notification shall contain the following, to the extent Retool has the details: (a) a description of the nature of the Personal Data Breach (including, where possible, the categories and approximate number of Data Subjects and data records concerned); (b) a contact point for more information; and (c) its likely consequences and the measures taken or proposed to address it, including to mitigate its adverse effects. Retool may provide this information in phases. Retool shall provide commercially reasonable cooperation and assistance in identifying the cause of the Personal Data Breach and take commercially reasonable steps to remediate it, to the extent within Retool's control. Except as required by Data Protection Laws, these obligations do not apply to incidents caused by Customer, Authorised Users, or any Third-Party Services.
7. DATA PROTECTION IMPACT ASSESSMENTS.
Where applicable and upon Customer’s request, Retool shall provide Customer with reasonable cooperation and assistance needed to fulfil Customer’s obligation under the GDPR to carry out a data protection impact assessment related to Customer’s use of the Retool Platform, to the extent Customer does not otherwise have access to the relevant information, and to the extent such information is available to Retool. Retool shall provide reasonable assistance to Customer in cooperation or prior consultation with the Supervisory Authority, to the extent required under the GDPR.
8. DELETION OR RETURN OF RELEVANT PERSONAL DATA.
Upon termination of the Agreement, Retool shall, upon Customer’s request, and subject to the limitations described in the Agreement and the Security Practices Page, return all Relevant Personal Data in Retool’s possession to Customer or securely destroy such Relevant Personal Data and demonstrate to the satisfaction of Customer that it has taken such measures, unless applicable law prevents it from returning or destroying all or part of such Relevant Personal Data.
9. AUDITS.
Retool has obtained the third-party certifications and audits set forth in the Security Practices Page. Upon Customer’s request, and subject to the confidentiality obligations set forth in the Agreement, Retool shall make available to Customer (or Customer’s independent, third-party auditor) information regarding Retool’s compliance with the obligations set forth in this DPA in the form of the third-party certifications and audits set forth in the Security Practices Page. Retool shall also permit and contribute to audits of the processing activities covered by this DPA, at reasonable intervals or: (a) if there are indications, in Customer’s reasonable opinion, of non-compliance with this DPA; (b) where requested by a Supervisory Authority. To this end, Customer may contact Retool in accordance with notice provisions in the Agreement to request an on-site audit of Retool’s procedures relevant to the protection of Relevant Personal Data, but only to the extent required under Data Protection Laws. Before the commencement of any such on-site audit, Customer and Retool shall mutually agree upon the scope, timing, and duration of the audit, in addition to the reimbursement rate for which Customer shall be responsible. Customer shall reimburse Retool for any time expended for any such on-site audit at the Retool Group’s then-current rates, which shall be made available to Customer upon request. All reimbursement rates shall be reasonable, taking into account the resources expended by Retool. Customer shall promptly notify Retool with information regarding any non-compliance discovered during the course of an audit, and Retool shall use commercially reasonable efforts to address any confirmed non-compliance.
10. INTERNATIONAL TRANSFERS OF RELEVANT PERSONAL DATA.
Customer authorizes Retool and its Sub-processors to transfer Relevant Personal Data across international borders, including from the EEA, Switzerland, and/or the United Kingdom to the United States. Schedule 2 will apply to the extent Customer’s transfer of Relevant Personal Data to Retool is a Restricted Transfer (as defined in Schedule 2).
11. GENERAL PROVISIONS.
11.1 Relationship with the Agreement.
Subject to Schedule 2, if there is any conflict between this DPA and the Agreement, this DPA shall prevail to the extent that conflict relates to the Processing of Personal Data.
11.2 Liability.
Each Party’s and all of its Affiliates’ liability, taken together in the aggregate, arising out of or related to this DPA, and all DPAs between Controller Affiliates and Retool, whether in contract, tort or under any other theory of liability, is subject to the limitations and exclusions set out in the Agreement, and any reference to the liability of a Party means the aggregate liability of that Party and all of its Affiliates under the Agreement and all DPAs together. For the avoidance of doubt, Retool and its Affiliates’ total liability for all claims from Customer and all of its Controller Affiliates arising out of or related to the Agreement and each DPA shall apply in the aggregate for all claims under both the Agreement and all DPAs established under the Agreement, including by Customer and all Controller Affiliates, and, in particular, shall not be understood to apply individually and severally to Customer and/or to any Controller Affiliate that is a contractual party to any such DPA.
11.3 Updates to DPA.
In the event of changes to Data Protection Laws, including, but not limited to, the amendment, revision or introduction of new laws, regulations, or other legally binding requirements to which either Party is subject, the Parties agree to revisit this DPA, and negotiate any appropriate or necessary updates in good faith.
11.4 Governing Law.
This DPA will be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Data Protection Laws.
SCHEDULE 1: DESCRIPTION OF PROCESSING ACTIVITIES
Data subjects
Customer may submit Personal Data to the Retool Platform, the extent of which is determined and controlled by Customer, and which may include, but is not limited to, Personal Data relating to the following categories of data subjects:
Authorised Users; employees of Customer; consultants of Customer; contractors of Customer; agents of Customer; and/or third parties with which Customer conducts business.
Categories of data
The Personal Data transferred concerns the following categories of data:
Any Personal Data comprised in Customer Data, as defined in the Agreement, the extent of which is determined and controlled by Customer.
Special categories of data
Subject to the “HIPAA Compliance” section of the Agreement, Customer may submit Personal Data to Retool through the Retool Platform, the extent of which is determined and controlled by Customer in compliance with Data Protection Laws and which may concern the following special categories of data, if any:
Racial or ethnic origin; political opinions; religious or philosophical beliefs; trade-union membership; and sex life.
Processing operations
The Personal Data transferred will be processed in accordance with the Agreement and any Order Form and may be subject to the following processing activities:
Storage and other processing necessary to provide, maintain and update the Retool Platform provided to Customer; to provide customer and technical support to Customer; and disclosures in accordance with the Agreement, as compelled by law.
SCHEDULE 2: RESTRICTED TRANSFERS OF RELEVANT PERSONAL DATA
To the extent Customer’s transfer of Relevant Personal Data to Retool is a Restricted Transfer, the applicable Standard Contractual Clauses in this Schedule 2 shall apply to such transfer. The Parties agree to be bound by, observe, comply with, and perform the Standard Contractual Clauses as if the Standard Contractual Clauses were set out in, and incorporated into, this DPA. Retool and Customer are deemed to have executed and signed the Appendix to the Standard Contractual Clauses by entering into and signing this DPA. The Standard Contractual Clauses will prevail over this DPA and the Agreement to the extent there is any conflict or inconsistency.
All capitalized terms used in this Schedule 2 will have the meanings ascribed to them in Section 1 (Definitions) below. All other capitalized terms used but not otherwise defined in this Schedule 2 will have the meanings ascribed to them in the DPA or the Agreement.
1. DEFINITIONS.
“EU SCCs” means the clauses adopted pursuant to the European Commission’s decision (2021/914) of 4 June 2021 on Standard Contractual Clauses for the transfer of personal data to Processors established in third countries which do not ensure an adequate level of data protection pursuant to the GDPR.
“Restricted Transfer” means: (a) any transfer of Relevant Personal Data Processed under this DPA: (b) from the EU, the EEA, the United Kingdom, or Switzerland; (c) to countries which do not ensure an adequate level of data protection within the meaning of Data Protection Laws; and (d) subject to Data Protection Laws.
“Standard Contractual Clauses” means the EU SCCs, Swiss SCCs and the UK Addendum.
“Swiss SCCs” has the meaning ascribed to it in Section 3 below.
“UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses (version B.1.0) issued by the UK Information Commissioner’s Office in accordance with s119A of the UK Data Protection Act 2018 which came into force on 21 March 2021.
2. Restricted Transfers from the European Economic Area.
With respect to Restricted Transfers of Relevant Personal Data protected by the GDPR, the EU SCCs, as completed below, will apply.
2.1 Modules.
Where Customer is the controller of Relevant Personal Data, the Module Two clauses (Controller to Processor Clauses) shall apply. Where Customer is the processor of Relevant Personal Data, the Module Three clauses (Processor to Processor Clauses) shall apply.
2.2 Instructions.
The DPA and the Agreement are Customer’s complete and final instructions at the time of execution of the DPA for the Processing of Relevant Personal Data. Any additional or alternate instructions must be consistent with the terms of this DPA and the Agreement. For the purposes of Clause 8.1, the instructions by Customer to process Personal Data are set out in clause 2.2 of the DPA and include onward transfers to a third party located outside of the EEA for the purpose of the performance of the Retool Platform.
2.3 Docking clause.
The option under Clause 7 shall not apply.
2.4 Certification of Deletion.
The Parties agree that the certification of deletion of Relevant Personal Data that is described in Clauses 8.5 and 16(d) shall be provided by Retool to Customer only upon Customer’s written request.
2.5 Documentation and Compliance.
Customer agrees that the audits described in Clause 8.9 of the Controller to Processor Standard Contractual Clauses shall be carried out in accordance with Section 9 of the DPA. For the purposes of Clause 8.9 of the Processor to Processor Clauses, all enquiries from the relevant Controller shall be provided to Retool by Customer. If Retool receives an enquiry directly from a Controller, it shall forward the enquiry to Customer and Customer shall be solely responsible for responding to any such enquiry from the relevant Controller where appropriate.
2.6 Use of Sub-processors.
Option 2 under Clause 9 shall apply. Pursuant to Clause 9(a), Customer acknowledges and expressly agrees that Retool may engage new Sub-processors as described in Section 4.3 of the DPA. Retool shall inform Customer of any changes to Sub-processors following the procedure provided for in Section 4.3 of the DPA.
2.7 Redress.
The option under Clause 11 shall not apply.
2.8 Liability.
Retool’s liability under Clause 12(b) shall be limited to any damage caused by its Processing where Retool has not complied with its obligations under the GDPR specifically directed to Processors, or where it has acted outside of or contrary to lawful instructions of Customer, as specified in Article 82 GDPR.
2.9 Supervision.
Clause 13 shall apply as follows:
2.9.1 where Customer is established in an EU Member State, the Supervisory Authority with responsibility for ensuring compliance by Customer with the GDPR as regards the data transfer shall act as competent Supervisory Authority;
2.9.2 where Customer is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) and has appointed a representative pursuant to Article 27(1) of the GDPR, the Supervisory Authority of the Member State in which the representative within the meaning of Article 27(1) of the GDPR is established shall act as competent Supervisory Authority;
2.9.3 where Customer is not established in an EU Member State, but falls within the territorial scope of application of the GDPR in accordance with its Article 3(2) without however having to appoint a representative pursuant to Article 27(2) of the GDPR, the Irish Data Protection Commission shall act as competent Supervisory Authority; or
2.9.4 where Customer is established in the United Kingdom, the UK Information Commissioner’s Office shall act as competent Supervisory Authority.
2.10 Notification of Government Access Requests.
Customer agrees that, for the purposes of Clause 15(1)(a), the notification of government access requests shall be carried out in accordance with Section 5.2 of this DPA. Customer shall be solely responsible for promptly notifying the Data Subject as necessary.
2.11 Governing Law; Choice of Forum and Jurisdiction.
The governing law for the purposes of Clause 17 shall be laws of Ireland. For the purposes of Clause 18, any dispute arising from the EU SCCs shall be resolved by the Irish courts.
2.12 Appendix
The Appendix shall be completed as follows:
2.12.1 the Customer shall be the Controller or Processor (as applicable) and data exporter of Relevant Personal Data and Retool shall be the Processor and data importer of Relevant Personal Data for the purposes of Annex I.A to the EU SCCs and the contact information for each shall be as set out in the Agreement;
2.12.2 the contents of Schedule 1 shall form Annex I.B to the EU SCCs; and
2.12.3 the contents of the Security Practices Page shall form Annex II to the EU SCCs.
2.13 Third Party Beneficiary Rights.
Insofar as Retool owes obligations to a Data Subject as a third party beneficiary by virtue of agreeing to in substance Process Relevant Personal Data in accordance with the data protection obligations that are imposed by the EU SCCs, Retool’s third-party liability shall be limited to its own processing operations under this DPA.
2.14 Alternative transfer mechanisms
The Parties agree that the data export solution identified in Section 10 of the DPA will not apply if and to the extent that Customer adopts an alternative data export solution for Restricted Transfers, in which event, Retool shall take any action (which may include execution of documents) required to give effect to such solution and the alternative transfer mechanism will apply instead.
3. Restricted Transfers from Switzerland.
With respect to transfers of Relevant Personal Data protected by Swiss Data Protection Laws, the EU SCCs as implemented above with apply with the following adaptations:
3.1 General and specific references in the EU SCCs to Regulation (EU) 2016/679 or “that Regulation” or EU or Member State law have the same meaning as the equivalent reference in Swiss Data Protection Laws;
3.2 The term “Member State” will not be interpreted in such a way as to exclude Data Subjects in Switzerland from the possibility of suing for their rights in their place of habitual residence (Switzerland) in accordance with Clause 18(c) of the EU SCCs;
3.3 The details of the transfer as those specified in Schedule 1 where Swiss Data Protection Laws apply to the transfer;
3.4 The EU SCCs also apply to the transfer of information relating to an identified or identifiable legal entity where such information is protected similarly as “Personal Data” under Swiss Data Protection Laws until such laws are amended to no longer apply to a legal entity; and
3.5 The Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for the purposes of Clause 13 of the EU SCCs.
4. Restricted Transfers from the United Kingdom.
With respect to transfers of Relevant Personal Data protected by the UK GDPR, the UK Addendum, with the adaptations below, will apply. For such transfers, the UK Addendum is deemed entered into by Customer and Retool and is incorporated into this Addendum by reference.
4.1 Table 1 and Table 3 of the UK Addendum are deemed to have been completed with the corresponding details set out in this DPA and, for the purposes of Table 1 of the UK Addendum: (1) the "Start Date" is the DPA Effective Date; and (2) the official company registration numbers (where applicable) of the Parties are as set out in the Agreement;
4.2 For the purposes of Table 2 of the UK Addendum, the Approved EU SCCs, applicable Modules, and selected clauses are as described in Section 2 of this Schedule 2; and
4.3 For purposes of Table 4, the "Importer" may end the UK Addendum in accordance with its terms.