Middle East and Africa Addendum

Last updated: 5 November 2026

Saudi Arabia

To the extent that either party transfers personal data from the Kingdom of Saudi Arabia (“KSA”) to the other party located outside the KSA, unless the parties may rely on an alternative transfer mechanism or basis under the Data Protection Laws, the parties will be deemed to have entered into the Standard Contractual Clauses for Personal Data Transfer approved by the Saudi Data & Artificial Intelligence Authority available at https://sdaia.gov.sa/Documents/StandardContractualClausesForPersonalDataTransferEN.pdfopens in new tab/window (“KSA SCC”) in respect of such transfer, whereby:

1. the receiving party is the “Personal Data Importer” and the other party is the “Personal Data Exporter”;

2. to the extent that each party acts as a Controller, the First Template applies and the Second, Third and Fourth Templates are omitted;

3. to the extent that Subscriber acts as a Controller and Elsevier acts as a Processor, the Second Template applies and the First, Third and Fourth Templates are omitted;

4. to the extent that each party acts as a Processor, the Third Template applies and the First, Second and Fourth Templates are omitted; and

5. if there is any conflict between the terms of the Agreement and the KSA SCC, the KSA SCC will prevail.

South Africa

To the extent that Elsevier is processing as an operator any personal information in scope of the South African Protection of Personal Information Act, No. 4 of 2013 (POPIA) for Subscriber as responsible party, Elsevier will further establish and maintain the security measures referred to in section 19 of POPIA and will notify Subscriber immediately where there are reasonable grounds to believe that the personal information of a data subject has been accessed or acquired by any unauthorized person.

Türkiye

To the extent that either party transfers personal data from the Türkiyeto the other party located outside Türkiye, unless the parties may rely on an alternative transfer mechanism or basis under the Data Protection Laws, the parties will be deemed to have entered into the Standard Contract for the Transfer of Personal Data Abroad approved by the Personal Data Protection Board of Türkiye with its decision dated June 4, 2024 and numbered 2024/959 available at https://www.kvkk.gov.tr/Icerik/7938/Standart-Sozlesmeler-ve-Baglayici-Sirket-Kurallarina-Iliskin-Dokumanlar-Hakkinda-Kamuoyu-Duyurusuopens in new tab/window) (“TürkiyeSC”) in respect of such transfer, whereby:

1. the receiving party is the “data importer” and the other party is the “Personal Data Exporter”;

2. to the extent that each party acts as a Controller, the “Data Controller to Data Controller” contract applies shall apply and the optional provision in Clause 9(a) and Clause 15 are omitted;

3. to the extent that Customer acts as a Controller and Elsevier acts as a Processor, the “Data Controller to Data Processor” contract shall apply and Clause 8 Option 1, the optional provision in Clause 10(a) and Clause 16 are omitted and the time period in Clause 8 Option 2 is 14 days;

4. to the extent that each party acts as a Processor, the “Data Processor to Data Controller” contract shall apply and Clause 8 Option 1, the optional provision in Clause 10(a) and Clause 16 are omitted and the time period in Clause 8 Option 2 is 14 days;

5. the Customer shall notify the Personal Data Protection Authority as required under the TürkiyeSC;

6. the appendix is completed with the information set out in the DPA and the Agreement; and

7. if there is any conflict between the terms of the Agreement and the TürkiyeSC, the TürkiyeSC will prevail.