1. Overview
Keeptrusts is operated from Barcelona, Spain (European Economic Area). We may transfer personal information across borders to provide the service. This page describes our approach to international data transfers and the safeguards we apply.
2. Transfer mechanisms
The applicable transfer mechanism depends on the data's origin, destination, recipient, and governing agreement. For restricted transfers, safeguards may include the European Commission's Standard Contractual Clauses for EEA data, the UK International Data Transfer Agreement or UK Addendum for UK data, and recognized Swiss safeguards or adapted clauses for Swiss data, together with any required transfer assessment.
The European Commission's EU-US Data Privacy Framework adequacy decision has applied since 10 July 2023 and permits EEA personal data to flow to participating certified US organizations. Keeptrusts does not represent that it is certified and does not rely on the framework for its own transfers. Where a recipient's participation is relied on, its active certification must be verified at the time of the transfer; otherwise the recipient-specific mechanism is assessed under the governing agreement and applicable law.
3. Safeguards
In addition to contractual protections, Keeptrusts applies technical and organizational measures to protect transferred data, including encryption in transit, encryption at rest, role-based access controls, and audit logging.
For website analytics services: Google Analytics 4 data may be transferred to the United States under Google's data processing terms, which include Standard Contractual Clauses where applicable. Microsoft Clarity session data may be transferred to the United States under Microsoft's data processing terms and applicable transfer safeguards. Google Search Console and Bing Webmaster Tools provide aggregated search-performance and crawl/indexing reports without direct visitor identifiers.
4. Customer controls
Keeptrusts supports operator-managed regional deployments and region-pinned publication for eligible configurations. Availability and control ownership depend on the plan and deployment model; customers with specific data sovereignty requirements should contact sales for a verified deployment plan.
5. Contact
For questions about international transfers or to request a Data Processing Agreement, contact privacy@keeptrusts.com.