# Clavenar SCC Election and Appendix

Version 1.0.0 · execution schedule, not a replacement for official clauses

## 1. Official clauses

When the completed Order Form selects this schedule, the parties incorporate
the unmodified standard contractual clauses in the Annex to European
Commission Implementing Decision (EU) 2021/914 of 4 June 2021:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj

This schedule completes elections and appendices but does not reproduce,
shorten, or alter the official clauses. The signed agreement must include or
provide durable access to the official text. No SCC becomes operative unless
the Order Form completes the relevant fields and makes the clauses binding.

## 2. Module and options

The Order Form selects exactly one applicable module:

- Module 2 when Customer is controller/exporter and Vanteguard is
  processor/importer; or
- Module 3 when Customer is processor/exporter and Vanteguard is
  subprocessor/importer.

The docking clause in Clause 7 applies. Clause 11 optional independent redress
applies. Under Clause 9, Option 2 general written authorization applies with
thirty days’ advance notice. The optional language in Clause 17 must be
completed with the EU Member State named in the Order Form. Clause 18 courts
are those of that same Member State. Customer is the exporter contact and
Vanteguard Labs LLC is the importer contact unless the Order Form states a
lawful alternative.

## 3. Annex I.A — parties

The legal names, addresses, contacts, roles, signatures, and effective date in
the executed Order Form are incorporated as Annex I.A.

## 4. Annex I.B — transfer description

The DPA Annex I and completed Order Form are incorporated as Annex I.B,
including data subjects, categories, sensitive-data restrictions, frequency,
nature, purpose, duration, retention, and subject matter. The competent
supervisory authority is the authority determined under Clause 13 and
identified in the Order Form.

## 5. Annex II — technical and organizational measures

The executed Security and Data Schedule is incorporated as Annex II. It
includes access control, workload identity, encryption, customer-controlled
secure exchange, tenant isolation, approval and policy enforcement, evidence
integrity, vulnerability handling, incident response, resilience, backup,
restore-time erasure, deletion, and assurance boundaries.

## 6. Annex III — subprocessors

The reviewed processor inventory and any customer-specific subprocessors
identified in the Order Form are incorporated as Annex III.

## 7. UK transfers

The EU SCCs alone are not represented as a UK transfer mechanism. If UK law
requires a restricted-transfer safeguard, the parties must attach and complete
the then-current official ICO International Data Transfer Addendum, including
its tables and mandatory clauses, or another valid mechanism, and complete any
required transfer-risk assessment before the transfer begins:

https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/what-are-standard-data-protection-clauses-the-uk-idta-and-the-addendum/

## 8. Supplementary measures and conflict

The Order Form records transfer assessment and supplementary measures. The
customer-controlled dual-recipient envelope, encryption in transit and at
rest, least privilege, tenant isolation, key separation, access evidence,
bounded retention, and restore-time erasure are available measures but do not
replace the exporter’s assessment. The official clauses control any conflict
for the restricted transfer.