//Data Privacy Framework

International Data Transfer Compliance

International Data Transfers

How personal data moves from the EEA, the UK and Switzerland to the United States when you use UpliftOS.

1. What We Do Not Claim

This page previously stated that UpliftOS was certified under the EU-US Data Privacy Framework and that its certification status was active.

That claim has been removed. We are not relying on the Data Privacy Framework.

A participant in the Framework is required to publish specific things: the independent recourse mechanism handling complaints, a statement that it is subject to the investigatory and enforcement powers of the Federal Trade Commission, and a public register entry anyone can check. A certification claim without those is not a certification claim. If we hold a current certification we will say so here and publish all of them.

2. The Mechanism We Actually Rely On

We are established in the United States and the platform operates from there, so using it involves a transfer of personal data out of the EEA, the UK and Switzerland.

The mechanism is the Standard Contractual Clauses, incorporated and completed in our Data Processing Addendum — module selection, the docking clause, governing law and forum, the UK International Data Transfer Addendum for UK transfers, and the Swiss reading for Swiss ones. That document is the operative one, and it is where the detail lives.

3. What We Commit To Regardless

These commitments stand on their own, independent of any framework:

  • Notice. We tell people what we collect and what we use it for.
  • Choice. We offer an opt-out for secondary uses and disclosures.
  • Onward transfers. Every transfer to an outside company is written down before the call is made, and the records are chained so an edited past shows. Your organization can additionally restrict which destinations are allowed, and refuse the rest. See our Security Statement and Subprocessor list.
  • Security. Encryption at rest and in transit, access scoped by role, and a recorded trail of what left and where it went.
  • Data integrity. We limit collection to what is relevant and hold to the purpose it was collected for.
  • Access. People can access and correct their data, and export it themselves.
  • Recourse. Complaints reach a human. Contact details are below.

4. Related Documents

Data Privacy Operations

Privacy: [email protected]