Transferring data out of the EAA: The personal data we collect is stored in a country operating outside of the EAA. Under the GDPR transferral of personal data from the EAA to a country outside of the EAA should only take place where the European Commission has decided that the country in question has an adequate level of protection.