International data transfers

Laya is operated from the United Kingdom and hosted in the United States. Personal data therefore leaves the UK and the EEA, and this page explains the basis on which it does so.

Where data is processed

Transfer mechanisms

• EEA to United States — the European Commission’s Standard Contractual Clauses (2021/914), Module Two (controller to processor) or Module Three (processor to processor) as applicable.
• UK to United States — the UK International Data Transfer Addendum to the EU SCCs, issued by the ICO.
• Our sub-processor agreements incorporate the equivalent clauses onward, so the chain of protection is unbroken.

Supplementary safeguards

• Encryption in transit on all traffic, and encryption at rest for credentials and secrets.
• Data minimisation — we hold the fields the service needs, and read connected-board comments live from the source tool rather than warehousing them.
• Access to production data is limited to those who need it to operate and support the service.
• We do not voluntarily disclose customer data to government or law enforcement. Where a legally valid demand is received, we assess it, seek to narrow it, and — unless legally prohibited — notify the affected customer so they can seek to challenge it.

Transfer impact assessments

If your organisation must complete a transfer impact assessment, the facts above are the inputs you need: the categories of data, the destination country, the mechanism relied on, and the technical measures applied. Where you need an answer we have not published, ask at privacy@laya.net rather than assuming — we would rather answer a specific question than have an assessment guess.