Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Intuit states it reserves the right to store and process personal information in the United States and any other country where Intuit or its service providers operate, acknowledging that some destination countries may have less protective data protection laws than the user's home country.
This analysis describes what Intuit's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes Intuit's claimed authority to transfer personal information to any country where its affiliates or service providers operate, with the document acknowledging variable levels of data protection in destination countries. Legal teams should confirm that applicable transfer mechanisms, including EU-U.S. Data Privacy Framework certification, standard contractual clauses, or adequacy decisions, are in place and current for each relevant transfer pathway.
Interpretive note: The document text was truncated before the full description of transfer mechanisms for each Intuit group company and recipient category, limiting assessment of the complete transfer framework.
The updated terms establish new procedures for handling personal data complaints related to international data transfers under the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks. Users from these jurisdictions now have access to defined complaint and dispute resolution mechanisms, including referral to TRUSTe as an alternative dispute provider at no cost, and binding arbitration under certain conditions. Additionally, the policy now requires that before personal data is used for a materially new purpose or shared with external parties not covered as processors, Mailchimp will offer users the opportunity to opt out through appropriate means or collect opt-in consent.
View change record →Under this provision, personal information collected in any jurisdiction may be transferred to and processed in the United States or other countries where Intuit or its service providers are located, subject to applicable legal transfer safeguards described in the policy. US Tax Return Information is specifically stated to be processed and stored in the United States unless consent is provided for other transfers.
Cross-platform context
See how other platforms handle International Data Transfers and similar clauses.
Compare across platforms →Monitoring
Intuit has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 20 platforms.
"With the exception noted above, Intuit reserves the right to store and process your personal information in the United States and in any other country where Intuit or its affiliates, subsidiaries, or service providers operate facilities in accordance with and as permitted by applicable laws and regulations. Some of these countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective).Excerpt from Intuit's Privacy Statement
(1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V governing international transfers, including requirements for adequacy decisions, standard contractual clauses, and the EU-U.S. Data Privacy Framework. UK GDPR imposes analogous transfer restrictions, as does Swiss data protection law. The document references the EU-U.S. DPF, UK Extension, and Swiss-U.S. DPF as applicable transfer mechanisms. Relevant enforcement authorities include EU supervisory authorities, the UK ICO, and the Swiss FDPIC. (2) GOVERNANCE EXPOSURE: Medium. The document identifies specific transfer mechanisms but the truncated text prevents full assessment of which mechanisms apply to which Intuit group company and recipient country combinations. The acknowledgment that some destination countries may not be as protective as the user's home country requires that adequate transfer safeguards are verified and documented for each transfer pathway. (3) JURISDICTION FLAGS: EU and UK users face the highest exposure given GDPR and UK GDPR Chapter V requirements. The document's reliance on the EU-U.S. DPF requires that Intuit's DPF certification is current and covers all relevant data categories and processing activities. Service provider transfers to countries without adequacy decisions require standard contractual clauses or binding corporate rules. (4) VENDOR IMPLICATIONS: Service providers operating in countries without adequacy decisions must be covered by standard contractual clauses or equivalent transfer mechanisms. Procurement teams should confirm that all third-party service providers receiving EU or UK personal information have executed appropriate transfer agreements with Intuit. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should maintain a current record of transfer mechanisms for each Intuit group company and each category of third-party recipient receiving personal information from EU and UK users. DPF certification should be verified annually and any lapse addressed immediately given reliance on that framework as a transfer mechanism. Standard contractual clauses with service providers in non-adequate countries should be reviewed following any updates to EU Commission SCCs or UK equivalents.
This provision establishes Intuit's claimed authority to transfer personal information to any country where its affiliates or service providers operate, with the document acknowledging variable levels of data protection in destination countries. Legal teams should confirm that applicable transfer mechanisms, including EU-U.S. Data Privacy Framework certification, standard contractual clauses, or adequacy decisions, are in place and current for each relevant …
Under this provision, personal information collected in any jurisdiction may be transferred to and processed in the United States or other countries where Intuit or its service providers are located, subject to applicable legal transfer safeguards described in the policy. US Tax Return Information is specifically stated to be processed and stored in the United States unless consent is provided …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Intuit.