Data Transfers

1. Processing roles and locations

This notice concerns processing by PicHit.Me International AB (Swedish company registration number 559609-7484) from its operational takeover of Pickit, planned for 10 November 2026. The recipients, processing and access locations, and safeguards depend on the purpose and service configuration.

Customer processing. The Data Processing Agreement incorporated into the customer's contract governs processing on its behalf, including any authorized subprocessors. The applicable provider register identifies their legal entities, purposes, processing and access locations, and transfer safeguards. The international DPA page and US DPA page are reference copies. The version incorporated into the customer's contract governs.

Pickit's own processing. The Privacy Policy covers activities for which Pickit determines the purposes and means, such as website inquiries and billing administration. The website uses SendGrid to deliver form email. Where used for Pickit's own activities, email delivery, CRM and accounting services are handled under Pickit's controller arrangements. A provider's role can differ when it handles customer personal data on the customer's instructions.

Customer-selected services. An independent destination or assistant that the customer connects, such as a storage integration or AI assistant, processes the data it receives under its applicable terms. The customer's selection of a service does not by itself make that service a Pickit subprocessor. Pickit remains responsible for the processing and disclosures it carries out under the applicable agreement and law.

Pickit uses Microsoft Azure for platform hosting. One production media storage account uses Azure West Europe as its primary region and North Europe for geo-redundant replication. Storage regions do not establish the location of every service or where authorized personnel and providers can access data.

2. Transfer safeguards

Transfers of personal data outside the EEA that are subject to GDPR Chapter V require a valid safeguard. Where an adequacy decision does not cover the transfer, Pickit applies an available lawful mechanism, including the European Commission's Standard Contractual Clauses under Decision (EU) 2021/914 where applicable, with the appropriate module, completed annexes, transfer assessment and necessary supplementary safeguards. Transfers covered by an adequacy decision rely on that decision only where its scope and conditions are met. Reliance on the EU–US Data Privacy Framework requires the recipient to hold eligible, current certification covering the relevant processing at the time of transfer. The former EU–US Privacy Shield is not a valid transfer mechanism. Applicable UK and Swiss requirements are addressed separately where relevant.

See the European Commission's adequacy decisions, EU–US Data Privacy Framework information and transfer clauses. The US Department of Commerce maintains the list of participating organizations.

3. Information and contact

Contact privacy@pickit.com for information about relevant recipients, locations and transfer safeguards, including a copy of applicable safeguards subject to protection of confidential information.