International data transfers

As a rule, we process personal data within the European Economic Area, and we keep services provided from Poland within its borders. For an organisation subject to EU regulation, this means there is no transfer mechanism to negotiate, no need to monitor adequacy, and no standard contractual clauses to maintain in respect of this work.

A transfer outside the EEA may occur exceptionally, if a specific service or tool requires processing by an entity or in infrastructure located outside the EEA. In such a case, the transfer takes place only using an appropriate mechanism provided for in Chapter V of the GDPR, of which we inform the data subjects concerned.

As the basis for a transfer, we apply, in the order appropriate to the case: a European Commission adequacy decision for the destination country, for example the EU-US Data Privacy Framework decision for certified entities, standard contractual clauses adopted by the Commission, or binding corporate rules. In the absence of these bases, a transfer may rely only on the derogations set out in Article 49 GDPR, applied strictly and to a limited extent.

Before a transfer based on standard contractual clauses, we assess whether the law and practice of the destination country undermine the effectiveness of the safeguards, in particular as regards access to data by public authorities. If the assessment indicates a risk, we implement additional supplementary measures of a technical, organisational or contractual nature, or we forgo the transfer.

We also treat as a transfer a situation in which a processor or its sub-processor accesses data from outside the EEA, including in connection with remote support or administration. We therefore verify the location of sub-processors and the place from which access to systems occurs, and take this into account in our transfer assessment.

We disclose the existence of a transfer outside the EEA, its legal basis, and how to obtain information about the safeguards applied, in the Privacy Notice and on request. For data covered by a transfer, you have the rights described in the Privacy Notice, including the right to lodge a complaint with the President of the Personal Data Protection Office.