A multinational retailer headquartered in the EU is expanding its customer analytics platform by contracting a cloud-based marketing processor located in a country that does not have a European Commission adequacy decision. The retailer's Data Protection Officer must ensure that personal data of EU customers can lawfully be transferred to this processor while providing enforceable rights and effective legal remedies for data subjects. Which mechanism is the MOST appropriate to authorize this international data transfer under the GDPR?