The policy states that personal information may be transferred to and processed in multiple countries globally, and that Standard Contractual Clauses and the UK International Data Transfer Addendum are used as the legal mechanism for cross-border transfers of EEA, Swiss, and UK personal data.
This analysis describes what Windsurf's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision identifies Standard Contractual Clauses and the UK IDAD as the stated transfer mechanisms for EEA, Swiss, and UK personal data, consistent with GDPR Chapter V requirements. The policy notes that third-party partners and service providers are also included in the scope of cross-border transfers.
Interpretive note: The policy states SCCs are used 'in some cases,' without specifying which transfer relationships or data categories are covered, creating uncertainty about the completeness of transfer mechanism coverage.
Under this clause, personal information of EEA, Swiss, and UK users may be transferred to and processed in countries outside those regions, including the United States, with Standard Contractual Clauses cited as the operative legal mechanism. Users may request a copy of or further information about the transfer mechanisms by contacting privacy@cognition.ai.
How other platforms handle this
Whenever we transfer personal data internationally, we use tools and transfer agreements to: make sure the data transfer complies with applicable law; and help to give your data the same level of protection as it has in the EU...
we also transfer personal information to all other countries in which Adobe or its affiliates, providers, and partners operate. We carry out these transfers in compliance with applicable laws – for example, by putting data transfer agreements in place...
we may share data between our affiliates for the safety and security of our users and may take necessary actions if we believe you have violated these Terms, including banning you from our Services and/or our affiliates' services...
"To facilitate our operations, Cognition, our third-party partners, and service providers may transfer, store, and process your personal information throughout the world, including the EU, UK and the US. If you reside in the EEA, Switzerland, or the United Kingdom, we rely upon certain legal mechanisms to facilitate these transfers of your personal information, including in some cases the European Commission's Standard Contractual Clauses and relevant local clauses (e.g., the UK's International Data Transfer Addendum) to facilitate the international and onward transfer of European personal data to third countries.Excerpt from Windsurf's Privacy Policy
1.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Search "[your state] attorney general consumer complaint" to find your state's direct complaint form
ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.
Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision identifies Standard Contractual Clauses and the UK IDAD as the stated transfer mechanisms for EEA, Swiss, and UK personal data, consistent with GDPR Chapter V requirements. The policy notes that third-party partners and service providers are also included in the scope of cross-border transfers.
Under this clause, personal information of EEA, Swiss, and UK users may be transferred to and processed in countries outside those regions, including the United States, with Standard Contractual Clauses cited as the operative legal mechanism. Users may request a copy of or further information about the transfer mechanisms by contacting privacy@cognition.ai.
ConductAtlas has identified this type of provision across 288 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Windsurf.