International Transfers

EU/EEA and UK data

For personal data subject to the GDPR or UK GDPR, cross-border transfers rely on:

1. the EU Standard Contractual Clauses (with the UK Addendum or IDTA where the UK GDPR applies) incorporated into our processors’ data processing agreements;
2. the EU-US Data Privacy Framework, where a processor is certified under it; and
3. for transfers between Cuesoft Inc. and Cuesoft Nigeria Limited, our intra-group arrangement applying the same safeguards.

The advertising platforms are the exception, and deliberately so. Google Ads, Meta, LinkedIn and X receive data as independent businesses under their own policies, not as our processors, so the clauses above are not the mechanism and we cannot offer them on those companies’ behalf: see processors and platforms. Those disclosures happen only where you have opted in through a site’s consent banner.

Which mechanism applies depends on the recipient, and the distinction matters because one of them is ordinary and the other is exceptional:

• Where the platform is certified under the EU-US Data Privacy Framework and the transfer falls inside its certification, the transfer rests on the European Commission’s adequacy decision for the Framework (Art. 45). Nothing exceptional is involved, and the platform’s certification is what makes it available. You can check any company’s current status on the Data Privacy Framework list. If the UK GDPR applies to you, the Commission’s decision is not the one that counts: the transfer relies on the UK’s data bridge, and the recipient has to participate in the UK Extension to the Framework specifically. Certification for the EU alone does not carry a UK transfer, and where the recipient is not in the UK Extension the consent route below is what applies.
• Otherwise, the transfer rests on your explicit consent (Art. 49(1)(a)), which is a derogation rather than a safeguard. That article allows it only once you have been told the risks, so plainly: there is no adequacy decision and no Article 46 safeguard we can offer on that company’s behalf. Your data may reach a country whose law gives you weaker protection than the GDPR, where an authority may be able to access it, and where you may have no equivalent route to a remedy or to a supervisory authority.

Where Google signals lets Google use a visit for its own ads personalisation, Google is not acting on our instructions for that part, so it takes the same route as the advertising platforms above: Google LLC’s certification under the Data Privacy Framework, and the UK Extension for UK visitors, which means that transfer rests on adequacy rather than on the consent derogation. Check its current status on the Data Privacy Framework list.

Decline and no such transfer happens at all. Withdrawing through Cookie preferences stops any further transfer from the moment you withdraw, but it cannot recall what was already sent: that data stays with those platforms under their own policies, which is why the choice is off by default and why we ask before loading anything. Google Analytics is different again, and now sits on both sides of this line. For our measurement it acts as our processor, so that part is covered by the clauses above and a deletion request through the rights page reaches it.

You can ask for information about the safeguards applied to a specific transfer via hello@cuesoft.io.

Nigerian data

Where the NDPA applies, transfers out of Nigeria follow its adequacy and safeguard provisions and the NDPC’s implementing instruments: see the Nigeria page.

Cueprise™

Transfer terms for licensee data are stated in each licensing agreement: see the Cueprise™ Privacy Notice.