Schedule 5: Cross-Border Transfers

[PRIVACY_4] Created on: 01.01.2024 - Last modified / reviewed: 15.09.2025

PART 1 – EEA Cross Border Transfers

1. The parties agree that the terms of the Standard Contractual Clauses are hereby incorporated by reference and shall apply to an EEA Transfer.

2. Module Two (Controller to Processor) of the Standard Contractual Clauses shall apply where the EEA Transfer is effectuated by Customer as the data Controller of the Personal Data and Scaleflex is the data Processor of the Personal Data.

3. Specifications. The following clauses of the Standard Contractual Clauses, have either been amended in accordance with the applicable Privacy Regulation, or require additional specifications as set forth below:

Clause 7	(Docking Clause) shall not apply.
Clause 9	Section 6 of the DPA specifies the procedure for appointing Sub-Processors and the timeframe for providing prior notice of any changes related to the Sub-Processors list, set forth in Schedule 2 of this DPA.
Clause 17	These Clauses shall be governed by the law of one of the EU Member States, provided such law allows for third-party beneficiary rights. The Parties agree that this shall be the same governing law stated in the Agreement, as long as it is the law of one of the EU Member States allowing for third-party beneficiary rights, otherwise, the governing law will be the law of France.
Clause 18(b)	Disputes and Complaints will be resolved before the courts of the EU Member State, listed in Clause 17.
Annex I.A	Shall be completed according to Schedule 4, I. List of Parties, Data exporter(s) of the DPA.
Annex I.B	Shall be completed according to Schedule 4, I. List of Parties, Data importer(s) of the DPA.
Annex I.C	In accordance with Clause 13, the data exporter’s competent Supervisory Authority will be determined in accordance with the GDPR.
Annex II	The Technical and Organisational Measures, as mentioned in the Data Processing Agreement (DPA) under Annex A, are incorporated as Annex II in the Standard Contractual Clauses.

1. To the extent there is any conflict between the Standard Contractual Clauses and any other terms in this DPA, the provisions of the Standard Contractual Clauses will prevail.

PART 2 – UK Cross Border Transfers

I. Part one: Tables

Table 1	The Parties: as stipulated in Schedule 4, I. List of Parties of this DPA.
Table 2	Selected SCCs, Modules and Selected Clauses: as stipulated in Schedule 5, Part 1 – EEA Cross Border Transfers, of this DPA.
Table 3	Appendix Information: means the information which must be provided for the selected modules as set out in the Appendix of the EU SCCs, and which for this Part 2 is set out in Schedule 5, Part 1 – EEA Cross Border Transfers, of this DPA.
Table 4	Ending this Addendum when the Approved Addendum changes. The Parties that may end this Addendum as set out in Section 19: ☒ Importer ☐ Exporter ☐ neither Party

II. Part two: Mandatory Clauses Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament in accordance with s119A of the Data Protection Act 2018 on 2 February 2022, as it is revised under Section 18 of those Mandatory Clauses, shall apply.

Specifications. The following clauses of the Standard Contractual Clauses, have either been amended in accordance with the applicable Privacy Regulation, or require additional specifications as set forth below:

Part I, clause 16

Shall not apply. For the avoidance of doubt, these Clauses are governed by the laws of England and Wales. Any dispute arising from these Clauses shall be resolved by the courts of England and Wales. A data subject may also bring legal proceedings against the data exporter and/or data importer before the courts of any country in the UK. The Parties agree to submit themselves to the jurisdiction of such courts.

Part I, clause 17

The Parties are deemed to have accepted the format of this UK cross Border Transfer schedule, as of the Effective Date of the Agreement.