if the European Commission or UK authority has decided that the country outside of the UK/EEA to which your personal data are transferred has an adequate level of protection, which corresponds to the level of protection afforded by the UK GDPR. This means for example that the personal data is still protected from unauthorised disclosure, and that you may still exercise your rights in relation to your personal data.

In particular, transfers to the United States may be made where the recipient is certified under the EU–US Data Privacy Framework, together with the UK Extension. This adequacy framework is an opt-in certification scheme for US companies, administered by the US Department of Commerce. It includes a set of enforceable principles and requirements that participating companies must certify to and comply with, ensuring that your personal data continues to be sufficiently protected.

The European Commission’s standard clauses (with required UK addendums) have been entered into between blumepay and the recipient of the personal data outside the UK/EEA. This means that the recipient guarantees that the level of protection for your personal data afforded by the UK GDPR still applies, and that your rights are still protected. In these cases, we also assess whether there are laws in the recipient country that affect the protection of your personal data. This is done by carrying out a transfer risk assessment. Where necessary, we take technical and organisational measures so that your data remains protected during the transfer to the relevant country outside the UK/EEA.