Watchtower

Legal

UK GDPR Addendum

Status: EffectiveVersion: 1.0.0Effective date: 2026-06-15

This Addendum modifies the watchtower Data Processing Agreement ("DPA") and Privacy Policy for transfers, processing, or rights involving the United Kingdom. It applies to Customers established in the UK or whose end users include UK data subjects.

1. Application

This Addendum applies in addition to the DPA. To the extent of any conflict between this Addendum and the DPA, this Addendum controls solely with respect to UK matters.

2. References to GDPR

Every reference in the DPA to:

  • "GDPR" or "Regulation (EU) 2016/679" shall be read as referring also to the UK GDPR (the retained EU GDPR as it forms part of UK domestic law under the European Union (Withdrawal) Act 2018, read together with the Data Protection Act 2018). The UK GDPR and the DPA 2018 are distinct but complementary instruments, not the same Act.
  • "Supervisory authority" shall be read as referring also to the Information Commissioner's Office (ICO) for UK matters.
  • "Member State law" shall be read as referring also to UK law for UK matters.

3. International transfers (UK to outside the UK)

For transfers from a UK exporter to a watchtower processor:

  • Watchtower's principal infrastructure is in Germany (EEA). UK-to-EEA transfers are permitted under the UK GDPR adequacy decision for the EEA.
  • Transfers to Sentry, Inc. (US) are governed by the UK Addendum to the EU Standard Contractual Clauses as published by the ICO, which is incorporated into Sentry's DPA. The Transfer Impact Assessment extends to UK transfers.
  • For other US sub-processors (currently none beyond Sentry + transparency entries), the same UK Addendum to the EU SCCs applies, plus the supplementary measures described in the TIA.

4. Data subject rights

UK data subjects have rights equivalent to those in the EU GDPR. Watchtower's response procedure (Privacy Policy Section 8) applies without modification.

UK data subjects may lodge a complaint with the ICO (https://ico.org.uk).

5. Data Protection Officer / UK Representative

Watchtower is not currently required to appoint a UK Representative under Article 27 of the UK GDPR. Watchtower has not appointed a UK Article 27 representative. It will appoint and list one here if and when it offers goods or services to, or monitors, data subjects in the United Kingdom in a manner that triggers Article 27.

6. Children

In the UK, the age of consent for information society services under the Age Appropriate Design Code is 13 (lower than the EU default of 16). Watchtower's services are not intended for children regardless, per Privacy Policy Section 9.

7. References

This addendum modifies the watchtower base legal pack (Data Processing Agreement, Privacy Policy, sub-processor list).