What applies to data transfer to third countries?

We also transfer data to service providers outside the EU or EEA (so-called third countries). We have selected these service providers based on our legitimate interests in a proper and economical internal organisation.

These service providers or their processors have the necessary infrastructure in the third countries mentioned below to fulfil the purposes of data processing. You can find the purposes of the respective data processing sorted by services here.

Your rights are protected by the fact that the data transfer to the following countries, in cooperation with the following service providers, is based on an adequacy decision of the EU Commission pursuant to Art. 45 (1), (3) GDPR:

Service Provider	Service	Country
OpenStreetMap Foundation	OpenStreetMap	United Kingdom
Trusted Shops AG	Trusted Shops	Israel
Trusted Shops AG	Trusted Shops Trustbadge	Israel
Atlassian	Jira Service Desk	United States of America
Automattic Inc.	WordPress.org	United States of America
Cloudflare Inc.	Cloudflare	United States of America
Google Ireland Ltd.	Google Analytics	United States of America
Google Ireland Ltd.	Google Analytics 4	United States of America
Google Ireland Ltd.	Google Optimize	United States of America
Google Ireland Ltd.	Google Ads Remarketing	United States of America
Google Ireland Ltd.	Conversion Linker	United States of America
Google Ireland Ltd.	Google Ads Conversion Tracking	United States of America
Google Ireland Ltd.	Google Tag Manager	United States of America
Google Ireland Ltd.	Google Maps	United States of America
Google Ireland Ltd.	reCAPTCHA	United States of America
Google Ireland Ltd.	YouTube Video	United States of America
Google Ireland Ltd.	Google Firebase	United States of America
Meta Platforms Ireland Ltd.	Facebook Pixel	United States of America
Microsoft Ireland Operations Ltd.	Microsoft Clarity	United States of America
Microsoft Ireland Operations Ltd.	Microsoft Advertising	United States of America
New Relic Inc.	New Relic	United States of America
Zapier Inc.	Zapier	United States of America

As there are either no adequacy decisions for data transfers to the following service providers or the service providers are based in the USA, we or our service providers have agreed with these service providers to protect your data (in the case of the USA: in addition to the adequacy decision) on the basis of the Commission's standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, and, where technically possible, have taken additional technical measures such as anonymisation or pseudonymisation of data:

Service Provider	Service	Country
Atlassian	Jira Service Desk	United States of America, Australia
Automattic Inc.	WordPress.org	United States of America
Cloudflare Inc.	Cloudflare	United States of America
Functional Software, Inc. dba Sentry	Sentry	United States of America
Google Ireland Ltd.	Google Analytics	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	Google Analytics 4	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	Google Optimize	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	Google Ads Remarketing	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	Conversion Linker	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	Google Ads Conversion Tracking	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	Google Tag Manager	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	Google Maps	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	reCAPTCHA	United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	YouTube Video	worldwide, esp. United States of America, Singapore, Taiwan, Chile
Google Ireland Ltd.	Google Firebase	worldwide, esp. United States of America, Singapore, Taiwan, Chile
Meta Platforms Ireland Ltd.	Facebook Pixel	worldwide, esp. United States of America, Singapore
Microsoft Ireland Operations Ltd.	Microsoft Clarity	United States of America
Microsoft Ireland Operations Ltd.	Microsoft Advertising	worldwide, esp. United States of America, Singapore
New Relic Inc.	New Relic	worldwide, esp. United States of America
OpenAI Ireland Ltd.	OpenAI	United States of America
Trusted Shops AG	Trusted Shops	United States of America
Trusted Shops AG	Trusted Shops Trustbadge	United States of America
Zapier Inc.	Zapier	United States of America

We would like to point out, as a precaution, that despite the agreement of the Commission's standard contractual clauses, it cannot be completely ruled out that

• government (US) authorities may make requests for information to our service provider, and thus government (US) authorities may access your personal data. This is generally in line with European legal regulations, e.g. for the purpose of averting danger. However, the threshold for the admissibility of such data processing is higher in the EU than in the USA;
• there is a risk that you may not be able to enforce your rights under the GDPR against the (US) authorities in the event of access to your personal data, or only to a limited extent.