International Data Transfer Information

Lycia Limited is a UK-based company. Personal data is primarily processed within the United Kingdom and European Economic Area (EEA). However, some of our service providers may transfer or process data outside the UK. This page explains the transfer mechanisms, risk assessments and safeguards we apply.

Where personal data is transferred outside the UK, we rely on one or more of the following mechanisms as required by UK GDPR Chapter V:

Before engaging a service provider that may transfer data internationally, Lycia conducts a Transfer Risk Assessment (TRA) to evaluate the legal framework, technical safeguards and organisational measures in place. The assessment considers:

• The laws and practices of the destination country regarding government access to personal data;
• The technical and organisational measures implemented by the provider;
• The availability of effective legal remedies for data subjects;
• Whether supplementary measures are needed to bring the level of protection up to UK GDPR standards.

Transfer Risk Assessments are maintained in our internal registers and reviewed when the provider's circumstances change or at least annually.

Where a transfer requires supplementary measures beyond the transfer mechanism, Lycia applies one or more of:

• Strong encryption of personal data both in transit and at rest;
• Pseudonymisation or anonymisation where feasible;
• Access controls limiting processing to authorised personnel only;
• Contractual commitments regarding government access requests;
• Regular audits of provider compliance.

Details of current international transfers, including provider names, destination countries, transfer mechanisms and risk levels, are maintained in our International Transfer Register and reviewed by our Compliance team. Key transfers include:

Provider locations and transfer mechanisms can change as infrastructure and contractual arrangements change. Lycia therefore maintains the current authoritative details in its controlled transfer register and reviews material changes before use.

You have the right to be informed about international transfers of your personal data and the safeguards applied. If you wish to exercise this right, please contact our Privacy Team via the Contact the Privacy Team page.

For more information about your rights, see our Data Subject Rights page.

We will update this page when new transfers are established, existing transfer mechanisms change, or when required by changes to UK law or guidance from the Information Commissioner's Office (ICO).