International Transfers

Some of our processors (the providers who store, process, or transmit personal data on our behalf) are based outside the UK and the European Economic Area. Where we transfer personal data outside those areas, we rely on one or more of the legal mechanisms set out in UK GDPR Articles 44-49 and EU GDPR Articles 44-49.

• UK adequacy decisions - for countries the UK has assessed as offering essentially-equivalent data protection (Articles 45 UK GDPR). The list is maintained by the ICO and currently includes the EEA, Switzerland, the Channel Islands, Andorra, Argentina, Canada (commercial organisations under PIPEDA), Faroe Islands, Guernsey, Isle of Man, Israel, Japan, Jersey, New Zealand, the Republic of Korea, and Uruguay.
• UK International Data Transfer Agreement (IDTA) - for transfers to countries without an adequacy decision. The IDTA is the UK's standalone transfer agreement, kept available as a fallback for any processor whose terms do not already incorporate the EU SCCs with the UK Addendum (all our current processors' terms do).
• UK Addendum to the EU Standard Contractual Clauses (SCCs) - used in parallel with the EU SCCs for processors operating across the UK and EU.
• EU SCCs (2021 modules) - for transfers from the EEA to countries outside the EEA. We use the controller-to-processor module with our processors.
• EU-US Data Privacy Framework (DPF) and its UK Extension (the UK-US "Data Bridge") - for US providers that hold an active DPF certification covering the relevant services, this operates as an adequacy-based route; we still keep SCCs / the UK Addendum in place contractually as a fallback.

Snapshot of our internal processor register, which is the source of truth.

The platforms in the last row are not processors acting on our behalf: they are independent services you choose to connect, and your data moves to them only on your instruction (see section 5 of the Privacy Policy; for PHI, its section 16). They are included here so the full journey of your data is visible in one place.

• Everything we store is encrypted at rest in our UK systems (AES-256 at the platform layer, plus application-level AES-256-GCM envelope encryption - whose keys live in Azure Key Vault in the UK - for files, credentials and sensitive fields). A third-country processor receives only the transient, minimum fields needed for its task - never our encryption keys and never database access.
• TLS in transit everywhere; a two-year HSTS policy (includeSubDomains, preload-ready) in production.
• Minimum-necessary fields shared with each processor - e.g. Stripe receives your email address and name for subscription billing (card details go directly to Stripe's own checkout page) but never your date of birth or profile data; Resend receives only the recipient address and the message content.
• A written Data Processing Agreement (UK GDPR Article 28) is in place with every processor - incorporated in its service terms or signed separately - with dates and document references recorded in our internal processor register.
• We rely on adequacy-based routes wherever a provider offers one (the UK-US Data Bridge for our US providers), keep the SCCs / UK Addendum in place as the contractual fallback, and review our processors' transfer arrangements at least annually.
• These transfer safeguards sit on top of the full security programme in section 8 of the Privacy Policy (field-level encryption, multi-factor authentication, tamper-evident audit logs, least-privilege access, dependency-vulnerability monitoring), which applies wherever the data is processed.

You can request a copy of the SCCs / IDTA / Addendum we rely on for any specific processor by emailing privacy@partnerme.net. We will provide a copy with any commercially sensitive information redacted, within one month (UK GDPR Article 12(3)).