In other words, you should know that as a data controller, SCCs impose heavy obligations on you. The SCCs entrust the responsibility for compliance with data protection standards to you, signatories to the treaty. In accordance with the statement of the European Data Protection Board: Before embarking on subcontractors, Google conducts a review of the security and data protection practices of subcontractors to ensure that subcontractors offer a level of security and data protection commensurate with their access to data and the scope of the services they provide. Once Google has assessed the risks posed by the processor, the processor will be required to enter into appropriate privacy, confidentiality and confidentiality terms, subject to the requirements set out in point 11.3 (Requirements for the involvement of subcontractors). Google Analytics and Google Analytics for Firebase remain transformers for analytics data that is not shared and used as part of this setting. Google has also included new GDPR terms in the default contract, in which it defines itself as a «data processor» when it comes to Analytics and Analytics 360. In its Help Center, Google states that in its «European User Consent Directive,» Google explicitly states that «you must ensure that certain disclosures are transmitted to and consent to end users in the European Economic Area and the United Kingdom.» If this policy applies to you and you do not comply with it, Google may restrict or suspend your use of the Google product and/or terminate your agreement. So make sure, before using Google products, that you fulfill the obligations you have accepted by using only these products, i.e. Google`s terms of service. Infrastructure. Google has geographically distributed data centers.

Google stores all production data in physically secure data centers. To conclude, let`s talk about Data Residency. Google Analytics users have dispersed their data into randomly selected public cloud data centers, most of which are in the United States. They have also updated their data processing agreements to take into account the new obligations of controllers and data processors. The DPA (Data Processing Agreement) can be viewed and accepted in Google Analytics or Double Click accounts. 9.2.1 Customer`s Responsibility for Requests. If Google`s cloud data protection team receives a request from a data subject regarding the customer`s personal data over the lifetime and identifies the request to the customer, Google will ask the data subject to address the request to the customer. The Customer is responsible for responding to such a request, including, if necessary, using the functionality of the Services….