Transferring your information outside of the European Economic Area*

It may be necessary to transfer your personal information to other group companies or service providers located in countries outside of the EEA. This may happen where our servers or suppliers and service providers are based outside of the EEA or where you use our services and products while visiting countries outside of the EEA.

Where the data protection and other laws of these countries may not be as comprehensive as those in the UK or the EU, we will take steps to ensure that your privacy rights are respected. To do this we take the following steps:

• Define the specific security measures that we require from them to protect our personal information.
• Require them to sign a contract guaranteeing to comply with those security requirements and agreeing that we can audit them to ensure that they do comply with those security requirements.
• Where they are based outside of the EEA, our security teams may require a security audit to be carried out before they are provided with personal information.
• During the lifetime of the contract we will monitor for ongoing compliance with the defined security measures.

*The European Economic Area (EEA) currently comprises the Member states of the European Union plus Norway, Iceland and Liechtenstein