International Transfers & DPF

1. Clear status of this notice

InnuCloud Experts Inc. is a Canadian company. This page does not assert that InnuCloud or MigiHub is certified or listed under the EU–U.S., UK Extension or Swiss–U.S. Data Privacy Framework (“DPF”). It does not designate a hypothetical U.S. affiliate or an unappointed dispute-resolution provider.

DPF participation is entity-specific. A U.S. vendor’s active listing does not certify InnuCloud, MigiHub, all affiliates or all transfers. Any reliance on DPF must be verified against the official list, the covered entity, data categories and applicable framework.

2. Understand the actual data flow

A cross-border assessment considers storage, backups, support access, subprocessors and customer-selected integrations. A hosting region alone is not a complete transfer inventory. The agreement and current service-provider information identify the relevant locations and roles.

The customer should identify the information involved, originating jurisdiction, destination, recipients, access needs and sensitivity before enabling a connection or sharing data.

3. Select the applicable transfer mechanism

• EEA: determine whether an adequacy decision covers the actual recipient and processing. Canada’s recognition concerns the covered commercial organizations; it is not a blanket exemption for every Canadian transfer.
• Other EEA transfers: use an applicable lawful mechanism, such as the relevant SCC module, with a transfer assessment and supplementary safeguards where required.
• United Kingdom: assess the applicable adequacy rules or use the UK IDTA or UK Addendum as appropriate.
• Switzerland: assess Swiss requirements and make the necessary contractual adaptations.
• Quebec: complete the required privacy impact assessment and contractual arrangements before an applicable disclosure outside Quebec.

4. Onward transfers and safeguards

Service providers are assessed according to their role and receive appropriate contractual restrictions on purposes, confidentiality, safeguards and further processing. The DPA governs authorization, advance notices and objections for subprocessors.

Technical and organizational safeguards can include minimization, least-privilege access, encryption and restricted support access. Lawful authority requests are assessed under applicable law and communicated where legally permitted.

5. Questions, rights and changes

Use info@innucloud.com for transfer questions, requests for the applicable DPA or service-provider details, and privacy complaints. Organization-managed requests may be routed to the responsible customer.

If a future entity-specific DPF notice is issued, it must identify the verified listed entity, covered framework, scope, contact and recourse arrangements. No DPF-specific arbitration or independent-recourse entitlement is created by a future-intent statement on this page.