When Checkout.com sends personal data to countries outside the EU or UK, it uses legal transfer mechanisms such as Standard Contractual Clauses or adequacy decisions to provide a baseline level of data protection.
This analysis describes what Checkout.com's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
International data transfers mean personal financial and identity data may be processed in countries with different privacy laws, and the adequacy of protection depends on the specific mechanisms used and whether they remain legally valid under current rulings.
Interpretive note: The adequacy of specific transfer mechanisms depends on the destination country and supplementary measures in place, which the policy does not enumerate in detail; practical protection levels vary by transfer route.
The updated policy establishes formal complaint procedures for UK and Australia users, requiring Checkout to acknowledge complaints within 30 days and respond without undue delay. For UK users specifically, the policy clarifies that complaints must first be raised with Checkout before escalating to the Information Commissioner's Office. The policy also discloses that transaction information collection now includes country data alongside currency and amount. For Australia users, the policy clarifies that identity verification is a legal requirement and cannot be provided anonymously or pseudonymously. Users in these jurisdictions can submit data protection complaints through Checkout's designated process and escalate to their respective regulatory authorities if dissatisfied with Checkout's response.
View change record →Expanded to emphasize global operations and explicitly mention Checkout group companies as transfer recipients, while using vaguer language about 'appropriate measures' instead of specifically naming SCCs and adequacy decisions.
View full change record →EU and UK users' personal and financial data may be transferred to countries outside the EU/UK, including the United States, relying on Standard Contractual Clauses whose practical effectiveness depends on the transfer destination and any supplementary measures in place.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
"Where we transfer personal data outside the UK or EEA, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or UK International Data Transfer Agreements, or we rely on an adequacy decision.Excerpt from Checkout.com's Privacy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
International data transfers mean personal financial and identity data may be processed in countries with different privacy laws, and the adequacy of protection depends on the specific mechanisms used and whether they remain legally valid under current rulings.
EU and UK users' personal and financial data may be transferred to countries outside the EU/UK, including the United States, relying on Standard Contractual Clauses whose practical effectiveness depends on the transfer destination and any supplementary measures in place.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Checkout.com.