The policy discloses that personal information may be processed in the United States or other countries where Brex or its affiliates and service providers operate, and that standard contractual clauses are used as the transfer mechanism for EEA, Swiss, and UK personal data transfers.
This analysis describes what Brex's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that Brex relies on standard contractual clauses as the primary legal mechanism for transferring EEA, Swiss, and UK personal data to the United States, which is a recognized GDPR Chapter V transfer mechanism but requires that the clauses be implemented in conjunction with a transfer impact assessment where applicable.
Interpretive note: The policy states that standard contractual clauses are used but does not specify the version of clauses in use or whether transfer impact assessments have been conducted, creating uncertainty about full GDPR Chapter V compliance.
Under this clause, personal information of EU, Swiss, and UK users may be transferred to and processed in the United States, with standard contractual clauses stated as the applicable transfer safeguard. EU and UK data subjects may request information about the specific clauses in use by contacting Brex.
Cross-platform context
See how other platforms handle International Data Transfers and Standard Contractual Clauses and similar clauses.
Compare across platforms →"Personal information we collect may be stored and processed in your region, in the United States or in any other country where we or our affiliates or service providers maintain facilities, operate, or provide services. We maintain primary data centers in the United States. For personal information transferred from the European Economic Area, Switzerland or the United Kingdom, we will provide appropriate safeguards, such as through the use of the relevant standard contractual clauses.Excerpt from Brex's Privacy Policy
(1) REGULATORY LANDSCAPE: GDPR Chapter V governs international transfers of personal data from the EEA, requiring either an adequacy decision, standard contractual clauses, binding corporate rules, or other approved mechanisms.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes that Brex relies on standard contractual clauses as the primary legal mechanism for transferring EEA, Swiss, and UK personal data to the United States, which is a recognized GDPR Chapter V transfer mechanism but requires that the clauses be implemented in conjunction with a transfer impact assessment where applicable.
Under this clause, personal information of EU, Swiss, and UK users may be transferred to and processed in the United States, with standard contractual clauses stated as the applicable transfer safeguard. EU and UK data subjects may request information about the specific clauses in use by contacting Brex.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Brex.