Transfer Impact Assessment

Customers who use Numative on sites with visitors in the EEA, the UK or Switzerland transfer personal data to Numative in the United States under the Standard Contractual Clauses in our Data Processing Agreement. Clause 14 of those Clauses requires both parties to assess whether the laws and practices of the destination country could stop the importer from meeting its obligations. This is Numative's assessment, following the six steps of European Data Protection Board Recommendations 01/2020. Customers may rely on it in their own records. We review it every year and whenever the processing, our subprocessors or the relevant law changes.

• Exporter and importer. The customer (controller) exports to Numative (processor), Illinois, United States. Numative onward-transfers to the subprocessors in Annex III of the DPA, all of which process the data in the United States.
• Data. Website analytics about visitors to the customer's sites: a visitor hash that changes every day and cannot be reversed, a random visit id, page addresses, referrers, campaign tags, browser and OS family, device type, screen-size bucket, approximate location, engagement time and the events the customer chooses to send. IP addresses and user agents are used in memory to derive these and are not stored. No names, email addresses, account identifiers, payment data or special categories of data are intended or needed.
• Purpose and format. Aggregate analytics for the customer. Data travels over TLS and is stored encrypted at rest by the hosting providers.

The EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two, or Module Three where the customer is itself a processor; for the UK, the ICO International Data Transfer Addendum; for Switzerland, the Clauses as adapted for the FADP. Numative is not currently certified under the EU-US Data Privacy Framework, so the Clauses are the mechanism relied on.

The laws relevant to public authority access are Section 702 of the Foreign Intelligence Surveillance Act (FISA 702), Executive Order 12333, and ordinary law enforcement process such as subpoenas and warrants.

• FISA 702 allows targeted collection of the communications of non-US persons from "electronic communication service providers". Numative's cloud providers may fall within that definition, and Numative itself could be argued to. Collection must target specific selectors (such as an email address or phone number) for foreign intelligence purposes; it is not a power to take bulk data.
• Executive Order 12333 governs intelligence activity outside the United States, such as interception of data in transit. It does not compel companies to provide data.
• Executive Order 14086 (October 2022) added necessity and proportionality limits to US signals intelligence and created a redress mechanism, the Data Protection Review Court, available to people in the EU, the UK and Switzerland. In its July 2023 adequacy decision for the Data Privacy Framework, the European Commission found these safeguards apply to all personal data transferred to the United States, whichever transfer tool is used, including the Clauses.

The question is whether, in practice, these laws are likely to be applied to this data in a way that undermines the Clauses. We consider that unlikely, for reasons specific to the data:

• It identifies no one. FISA 702 works by selectors tied to a known person, and Numative stores nothing a selector could match: no names, emails, phone numbers, account ids, raw IP addresses or user agents.
• It cannot be followed over time. The visitor hash changes every day and differs per site, so even complete access would not show what one person did across days or across sites.
• It has little intelligence value. Page views, referrers and approximate locations of anonymous website visitors are not the communications content these powers exist to obtain.
• Numative has received no request from any public authority for customer analytics data.

• Technical. Nothing stored on the visitor's device; no raw IP or user agent stored; a daily-rotating, per-site one-way visitor hash; query strings and URL fragments dropped by default; coarse browser, device and location data; TLS in transit and encryption at rest; organization-scoped access control.
• Contractual. The DPA obliges Numative to notify the customer of any government request unless legally prohibited, to challenge unlawful or overbroad requests, to disclose only the minimum required, and never to give an authority direct access to its systems. The Clauses add the importer's Clause 15 obligations.
• Organizational. Requests are handled by Numative's leadership with legal review; access to production data is limited to the people who run the service.

With the Clauses, the safeguards of Executive Order 14086 and the measures above, we conclude that the transferred data is protected to a level essentially equivalent to that in the EEA, the UK and Switzerland, and that nothing in US law or practice is likely to prevent Numative from meeting its obligations under the Clauses for this data. We will review this assessment by November 2027, or sooner if the processing, our subprocessors or the relevant law changes. Questions: support@numative.com.