International Data Transfers

How we safeguard personal data when it moves outside the UK, including the EU-US Data Privacy Framework (UK Extension), the UK IDTA, and Standard Contractual Clauses.

Last updated: 11 August 2026

1. Why transfers happen

To run the service, OnchainSuite uses infrastructure and vendors that may be located outside the United Kingdom, including in the United States and the European Economic Area (EEA). When personal data moves outside the UK, UK GDPR requires an approved safeguard. This page explains the mechanisms we rely on. A list of recipients and their locations is on our Sub-processors page.

2. Our role on transfers

Where we transfer personal data we process on behalf of customers, we act as exporter under the customer’s instructions. Note that OnchainSuite Ltd is a UK company and does not itself self-certify under the EU-US Data Privacy Framework, DPF certification applies to organisations in the United States that receivepersonal data. We rely on our recipients’ certifications and on the mechanisms below.

3. Transfer mechanisms we rely on

  • Adequacy, where the destination has UK “adequacy” (for example, the EEA), no additional safeguard is required.
  • EU-US Data Privacy Framework, UK Extension (the “UK-US data bridge”), for transfers to US vendors that are self-certifiedunder the EU-US DPF and its UK Extension, we rely on that certification as the safeguard. We check a recipient’s active status on the official Data Privacy Framework list before relying on it.
  • UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU SCCs, for transfers to recipients not covered by adequacy or the DPF, we put the IDTA (or the EU Standard Contractual Clauses with the UK Addendum) in place.
  • EU Standard Contractual Clauses, for any EEA-origin personal data subject to the EU GDPR.

4. Transfer risk assessments & supplementary measures

Where we rely on the IDTA or SCCs, we carry out a transfer risk assessment and, where needed, apply supplementary measures (such as encryption in transit and at rest, access controls, and data minimisation) to ensure protection essentially equivalent to that under UK law.

5. Onward transfers

We require sub-processors to apply equivalent safeguards to any onward transfer of personal data they make on our behalf.

6. Your rights and complaints

You may ask for information about the safeguards applied to a specific transfer by contacting privacy@onchainsuite.com. You can also complain to the UK ICO at ico.org.uk. Where a transfer relies on a recipient’s DPF certification, that framework provides additional redress mechanisms in the United States.

7. Changes

We will update this page as our vendors, their certifications, or the applicable transfer rules change. See the “last updated” date above.