Standard Contractual Clauses (SCCs) — TEMPLATE

⚠️ LEGAL REVIEW REQUIRED. This is an engineering placeholder, not legal advice and not an

executed instrument. The operative SCC text is the official set adopted by the European Commission

(and the UK Addendum); it must not be paraphrased. This file only records which modules/annexes

apply and links the parties' details — all to be confirmed by qualified legal counsel.

• Status: legal-review-required
• Incorporated by: the Data Processing Agreement § 6.

Applicable instruments

• EU SCCs: Commission Implementing Decision (EU) 2021/914 — incorporate the official Annex text verbatim.
• UK International Data Transfer Addendum: ICO IDTA / Addendum to the EU SCCs, as applicable.

Modules

• Module Two (Controller → Processor): applies where the Customer is the Controller and the

Provider is the Processor (the default for OMGQA). [Confirm.]

• Module Three (Processor → Processor): applies between the Provider and its subprocessors. [Confirm.]

Annex I — Parties, description of transfer

• Data exporter: the Customer (Controller). [Name, address, contact.]
• Data importer: [OMGQA legal entity] (Processor). [Name, address, contact.]
• Categories of data subjects / data, frequency, nature, purpose: as described in the

DPA § 2 and the subprocessor register.

Annex II — Technical and organizational measures

As described in the DPA § 4 and the Trust Center: per-organization database

isolation, encrypted secrets, tamper-evident audit log, scoped API keys, OTP authentication.

Annex III — List of subprocessors

The authorized subprocessors are the machine-readable subprocessor register,

rendered on the Trust Center.

---

*Generated as an engineering artifact for the Trust Center (E22 S06). The official SCC Annex text must be

attached verbatim and executed under legal review.*