The notice states that personal data may be transferred internationally to Checkout group companies or third-party service providers, with EU SCC and UK Addendum mechanisms and transfer impact assessments used for transfers from the UK or EEA to countries without an adequacy decision.
This analysis describes what Checkout.com's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes the legal transfer mechanisms Checkout relies on for cross-border data flows from the UK and EEA, and discloses that transfer impact assessments are conducted, which are operationally significant for GDPR and UK GDPR compliance purposes.
The updated policy explicitly states that Checkout.com uses recordings of calls with merchants for training, product development, and marketing purposes. The policy also clarifies that merchant customer contact, cardholder, transaction, and technical information is processed to deliver payment services, detect fraud, and comply with legal obligations. Merchants and their customers should review the updated disclosure to understand how their communications and transaction data are used.
View change record →Under these terms, personal data may be transferred to countries outside a user's home country without equivalent data protection laws, with EU SCCs, UK Addendum clauses, and transfer impact assessments cited as the protective measures applied to UK and EEA data subject transfers.
Cross-platform context
See how other platforms handle International Data Transfers and SCCs and similar clauses.
Compare across platforms →"Checkout is a global business and in the provision of our services personal data may be transferred to Checkout group companies or third-party service providers located in a different country than your home country. We will implement appropriate measures to ensure that your personal data remains protected and secure when it is transferred, and we will only transfer your personal data in accordance with applicable laws and regulations. Where data is transferred from the UK or EEA to a third country that is not deemed by the EU Commission or UK Secretary of State to have adequate protections in place, we rely on the EU Standard Contractual Clauses (SCCs) or contractual clauses approved by the ICO (such as the UK Addendum to the EU SCCs) respectively, to transfer your data to that third country and ensure it remains secure. We also carry out transfer impact assessments before transferring your personal data, to assess the level of risk to you and your rights and protections in that third country.Excerpt from Checkout.com's Privacy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
Get the weekly coverage letter
Companies change their terms without announcing it. We capture governance documents, compare each new version with the last, and publish what changed, with the source text behind it. One email a week on what we found and what we could not reach.
This provision establishes the legal transfer mechanisms Checkout relies on for cross-border data flows from the UK and EEA, and discloses that transfer impact assessments are conducted, which are operationally significant for GDPR and UK GDPR compliance purposes.
Under these terms, personal data may be transferred to countries outside a user's home country without equivalent data protection laws, with EU SCCs, UK Addendum clauses, and transfer impact assessments cited as the protective measures applied to UK and EEA data subject transfers.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Checkout.com.