International Transfers and SCC Annex
Contractual template — applies when accepted in the service order. Use your browser’s print command to save this complete version as PDF.
This annex identifies the contractual transfer chain and supplies the official EU SCC text as an actual accompanying file. It must be read with the DPA and subprocessor register. It does not claim that an unsigned annex binds a provider or that EU application hosting removes all international transfers.
1 AI transfer chain
For the standard intended EEA arrangement, Customer instructs QEDARA S.R.L. in Romania, and Qedara procures API inference under the applicable OpenAI agreement. OpenAI’s published DPA effective 1 January 2026 identifies OpenAI Ireland Ltd. for EEA customers. Section 4.1 provides for onward transfers by that entity under agreements containing SCCs or an adequacy decision. Confirm the Qedara account’s legal customer and agreement before relying on that route.
The transfer assessment must cover contract text, prompts and output, provider abuse review and remote access as well as computing location. The reviewed QCM configuration does not establish an EU-residency project or ZDR. Relevant API-provider countries in OpenAI’s public register include Ireland, the United States, the United Kingdom, Japan and other infrastructure and moderation locations. The actual account scope must be recorded; a supplier’s global country list is not a list of locations used for every request.
2 Email transfer chain
QCM sends transactional email to Plus Five Five, Inc. (Resend), United States. The current published Resend DPA incorporates EU SCCs and identifies Module 3 when Customer acts as processor, as Qedara does for customer content. Confirm the applicable account agreement and complete transfer particulars for actual email templates and retention. Do not infer storage location from the chosen sending region.
3 Included official clauses
The folder 03_Official_SCC contains EU_SCC_2021_914_Official_EN.doc, downloaded without textual changes from the European Commission on 19 October 2026. It is the Annex to Commission Implementing Decision (EU) 2021/914. The package manifest records its SHA-256 digest and official download URL.
Select the applicable module and complete the annexes when a transfer agreement is required. For a direct Qedara processor to overseas subprocessor transfer, Module 3 is the usual role pairing; Module 2 applies where the exporter is controller and importer is processor. Do not insert a Qedara signature into an OpenAI Ireland onward-transfer agreement or claim that a supplier signed this generic copy. The supplier’s incorporated terms determine its binding transfer arrangements.
Official source: https://commission.europa.eu/publications/publications-standard-contractual-clauses-sccs_en. Core SCC text must remain unchanged except for permitted selections and completion of appendices. Additional clauses may not contradict SCC protections.
4 Transfer particulars and completion record
| Required element | Prepared entry or evidence needed |
|---|---|
| Exporter and role | QEDARA S.R.L., Romania, CUI 54412264; processor for Customer Content. Contact office@qedara.com. Registered address is taken from the executed service order. |
| Importer and role | Identify the actual contracting importer for each flow from the accepted supplier agreement. OpenAI Ireland is an EEA recipient; its onward importers are covered by its transfer arrangements. Resend’s published contracting entity is Plus Five Five, Inc., US. |
| Subjects data purpose frequency | Use DPA Annex A, narrowed to relevant AI input/output or transactional email payload. Repeated user-triggered and authorised automated transactions during the service. |
| Retention and security | QCM-RET-001 and DPA Annex B apply to Qedara. Attach applicable supplier retention and technical measures; Qedara measures must not be presented as the importer’s controls. |
| SCC selections | Use the selections in the applicable executed supplier DPA. For a separately negotiated Module 3 transfer, record clauses 7, 9, 11, 13, 17 and 18 and all Annex I–III particulars before execution. |
| Authority and governing law | Determine from the actual exporter and SCC framework. For a Romania-established exporter, assess ANSPDCP competence. The supplier agreement may select another permitted EU law and courts; do not overwrite it silently. |
| Evidence and owner | Retain accepted DPA version, account entity, SCC incorporation, relevant subprocessor list, assessment, region/retention settings and approval date. Service owner maintains the record. |
5 Transfer assessment and supplementary measures
Before approval, assess the destination law and practice, public-authority access, onward recipients, enforceable rights and practical risk for the actual data. Evaluate minimisation, redaction of irrelevant data, TLS, access controls, retention limits and available regional or no-retention options. Encryption in transit does not prevent provider access to plaintext needed for inference. A BYOK key does not remove that access either.
Record residual risk and approval, not a generic claim that SCCs make every transfer safe. Reassess when country, provider, service feature, law or access risk materially changes. Suspend the affected transfer if the required safeguards cannot be maintained. This package supplies the clauses and completed processing description; account-contract proof, supplier-specific annexes and the final transfer assessment remain activation requirements.