In addition, when transferring personally identifying information that is subject to the European Union’s General Data Protection Regulations (GDPR), we require a GDPR-approved transfer mechanism to be in place, such as Binding Corporate Rules or Privacy Shield Certification.</p> <p>ITHAKA does not sell or share personal information about or the purchasing history of individual users, except as set forth above and in the following circumstances:</p> <ul> <li>In certain situations, ITHAKA may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements;</li> <li>