The Data Controller may transfer personal data to third countries, i.e. countries located outside the European Economic Area. Users data may be transferred solely to third countries or third parties which were recognised by a decision of the European Commission as offering an adequate level of data protection. The list of countries confirmed by a decision of the European Commission to offer an adequate level of protection can be found at the link. If no decision of the European Commission confirming an adequate level of protection referred to in Article 45(3) of the GDPR has been issued, Users personal data may be transferred to a third country solely on the basis of: binding corporate rules, standard data protection clauses adopted by the European Commission, standard data protection clauses adopted by a Polish supervisory authority and approved by the Commission, an approved code of conduct, or an approved certification mechanism (Article 46 of the GDPR).
If no decision of the European Commission confirming an adequate level of protection referred to in Article 45(3) of the GDPR has been issued and in the absence of the safeguards listed in Article of the 46 of the GDPR, including binding corporate rules, Company will ask Users to grant his/her express consent for a transfer to a third country or international organisation after advising Users about the possible risks of such transfer pursuant to Article 49(1)(a) of the GDPR.
In connection with the transfer of Users data outside the EEA Users may request information about safeguards used in this respect, obtain a copy of such safeguards or information about the place in which they are shared by contacting the Data Controller.