International Data Transfers
D-08 · v1.0 · published
| Field | Value |
|---|---|
| Document code | D-08 |
| Document name | International Data Transfers |
| Version | v1.0 |
| Publication date | 2026-09-25 |
| Legal basis | Chapter V GDPR (Articles 44–49) |
| Where shown | Annex to D-06 · International data transfers page · link in the cookie banner |
| Status | v1.0 published (2026-09-25) |
1. Purpose of this document
When personal data is transferred from the European Union to a country outside it (a «third country»), the rules of Chapter V of the GDPR (Articles 44–49) apply. The operation of mybusyness does involve transfers outside the European Union. This document shows openly which data goes to whom, for what purpose and on what basis.
Customer data of the Netherlands region is stored and backed up on servers in the Netherlands (European Union) and does not leave the European Union; the only exceptions are listed exhaustively in D-08. These exceptions are the transfers listed in section 4; there are no others.
2. Terms (defined once)
- Transfer outside the European Union: Sending personal data to a person or a server outside the European Union, or making it accessible from outside the European Union.
- Adequacy decision: A decision of the European Commission that a third country ensures an adequate level of protection (Article 45 GDPR).
- Appropriate safeguards: Contractual safeguards where there is no adequacy decision, in particular Standard Contractual Clauses (Article 46(2)(c) GDPR).
- Masking: Replacing identification data with placeholders such as
[BSN-001]before the external call.
3. Legal framework
Level 1 — Adequacy decision (Article 45 GDPR). If the European Commission has decided that a third country ensures an adequate level of protection, transfers to that country are permitted.
Level 2 — Appropriate safeguards (Article 46(2)(c) GDPR). Without an adequacy decision, personal data may be transferred if appropriate safeguards are in place, in particular the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
Level 3 — Derogations (Article 49(1)(a) GDPR). Without an adequacy decision and without appropriate safeguards, a transfer is permitted only in the cases provided for by law, including the explicit consent of the data subject after being informed of the possible risks.
How this applies here: The transfer to cloud language models is ongoing; the Standard Contractual Clauses (level 2) are therefore decisive. The transfer through measurement cookies is based on the consent of the visitor and does not take place at all without consent.
4. Inventory of transfers
4.1 Cloud language models
| Topic | Content |
|---|---|
| What goes out | Text sent to a model to prepare a job — masked only and only content of classes D0–D2 |
| What does not go out | Content of classes D3 and D4 (local model only), content of class D5 (no model), the masked identification data itself, the masking lookup table |
| Purpose | A limited number of job types, for example summarising text, extracting contract clauses, answering questions from departments |
| Recipient | The provider of the model; it follows from the product's model configuration and is not fixed in the code. The providers currently used are based in the United States. |
| Mechanism | Level 2 — Standard Contractual Clauses. Without concluded Standard Contractual Clauses, this transfer does not take place. |
| Frequency | Ongoing (during use) |
RISK-REDUCING MEASURES (measured in the code):
- Masking before the call: Turkish identity number, AHV number, BSN and IBAN with check-digit validation; in addition, telephone, e-mail, tax number, card number and key-like strings.
- Classification D0–D5 and routing; D5 goes to no model.
- The lookup table is stored encrypted and destroyed after 24 hours; it never leaves the system.
- A task meant for a local model produces a visible error if there is no local model; there is no silent switch to the cloud.
- A large part of the product's work uses no model; no transfer takes place for that work.
- When data is imported via Excel or CSV, not a single row leaves the system.
AN HONEST LIMIT: Masking removes identification data but does not anonymise free text. A contract paragraph or correspondence may still contain personal data after masking and may make a person identifiable through the context. This transfer is therefore treated as a transfer of personal data.
4.2 Website server in Türkiye
| Topic | Content |
|---|---|
| What | Page requests to the website (including the pages under /nl), server access log with masked IP address, consent record (consent identifier, time, document code + version + region, salted IP hash — never the raw IP address, browser summary (browser family and platform), choice), e-mails to us |
| How | The website is served from a server in Türkiye; your browser sends its requests directly to this server |
| Purpose | Operation of the website, security, proof of consent, answering enquiries |
| Recipient | Topluyıldız Danışmanlık A.Ş. as the controller, with its registered office in Türkiye |
| Not affected | The application's customer data — it stays on the servers in the Netherlands |
4.3 Google Analytics
| Topic | Content |
|---|---|
| What | IP address, device and browser information, browsing data, cookie identifier |
| Purpose | Measuring how the website is used |
| Recipient | Google Ireland Limited and Google LLC (United States) |
| Mechanism | Level 3 — explicit consent of the visitor (D-04; Article 49(1)(a) GDPR). Without consent, the tag is not loaded and no transfer takes place. |
| Additional measure | The tag starts with all consent signals set to «denied» |
4.4 E-mail sending
| Topic | Content |
|---|---|
| Today | No third-party provider is currently used for sending e-mails; no transfer takes place along this route. |
| In future | If a provider is selected, this document is updated before it is put into use. |
4.5 Operation and maintenance from Türkiye
| Topic | Content |
|---|---|
| What | Access to the system data on the servers in the Netherlands, as far as needed for operation, maintenance and support |
| How | Remote access from Türkiye; the data remains stored on the servers in the Netherlands |
| Recipient | Topluyıldız Danışmanlık A.Ş. (Türkiye) |
| Mechanism | Level 2 — Standard Contractual Clauses as part of the Data Processing Agreement (D-07 Article 10). Without concluded Standard Contractual Clauses, this transfer does not take place. |
4.6 Services connected by the customer
| Topic | Content |
|---|---|
| What | Only the records of the integration concerned |
| Who decides | The customer connects a service with its own key and thereby decides on this transfer itself. If the service is based outside the European Union, the customer, as controller, is responsible for the basis under Chapter V GDPR. |
5. Checklist before every transfer
Before a transfer begins, the following must be met:
| # | Check | Applies to |
|---|---|---|
| 1 | Standard Contractual Clauses have been concluded with the recipient | 4.1, 4.5 |
| 2 | The transfer is listed by recipient and purpose in D-01, D-02 and D-09 | All |
| 3 | If the transfer is based on consent, that consent was obtained and recorded under D-04 | 4.3 |
| 4 | The retention period and the method of destruction at the recipient are recorded in writing | 4.1 |
| 5 | A new recipient is first added to this inventory | All |
6. Changes
6.1. New recipients, a change of recipient or additional categories of data require this document to be updated.
6.2. When it is updated, the version number is increased, the privacy notices are adjusted and — where necessary — new Standard Contractual Clauses are concluded.
6.3. No personal data is transferred to recipients that are not in this inventory.
7. Your rights
Your rights under the GDPR also apply to transfers outside the European Union, in particular the right to be informed of the recipient countries and of the safeguards (Article 15 GDPR). Please send requests using D-13 · Data Subject Request Form or by e-mail to sales@mybusyness.com; we respond within one month (Article 12(3) GDPR). You have the right to lodge a complaint with the Autoriteit Persoonsgegevens (Article 77 GDPR).
If a transfer is based on your consent, you can withdraw it at any time; from the moment of withdrawal, the transfer ends.
This document describes the behaviour of mybusyness as measured in the code. This is not legal advice.