{
  "id": "POL-133",
  "slug": "pol-133",
  "title": "A brand handling EU or UK data needs a GDPR addendum",
  "statement": "The privacy policy must carry a GDPR addendum naming the controller, the legal bases, transfers, withdrawal of consent and the right to complain.",
  "rationale": "A US messaging programme picks up EU or UK subjects the moment it has customers who travel or move, and the addendum is what makes the same document work for them. The withdrawal-of-consent element is the one that overlaps with messaging directly: it has to describe the same route the SMS terms describe, or the two documents disagree about how to leave.",
  "layer": "POLICY_PAGE",
  "layerSlug": "policy-page",
  "object": "privacy policy body",
  "severity": "MEDIUM",
  "detectability": [
    "AI_FORM"
  ],
  "failureClass": "TERMINAL_POLICY",
  "artifact": "privacy_policy",
  "authorities": [
    "GDPR"
  ],
  "applicabilityText": "Applies to every 10DLC registration.",
  "universal": true,
  "remediation": "Add the addendum as its own section rather than weaving it through the document, and make its consent-withdrawal route the same one the SMS terms give. Done when each element is present and the two documents agree.",
  "example": "For visitors in the EU and UK: the controller is Acme Coffee Co, LLC. We rely on your consent to send marketing texts; you can withdraw it at any time by replying STOP or emailing privacy@acmecoffee.com, and you may complain to your local supervisory authority.",
  "notes": "Absorbs POL-132, which states the legal-bases element on its own — one element of the addendum rather than a separate obligation. Conditional on the brand processing EU or UK data, which no applicability dimension expresses; the criteria pass immediately where nothing indicates it.",
  "catalogIds": [
    "POL-132"
  ],
  "phase": "approval",
  "automated": true,
  "url": "https://ekas.io/rules/10dlc/policy-page/pol-133/",
  "markdown": "https://ekas.io/rules/10dlc/policy-page/pol-133.md",
  "registry": "https://ekas.io/rules/10dlc/",
  "updated": "2026-07-25",
  "licence": "CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/"
}