International Transfers of Personal Data

Date: April 2026

NALA is an international business and your personal data may be transferred to and processed in countries outside your country of residence — including Uganda, Tanzania, Rwanda, the United Kingdom, the United States, and other countries where our service providers and partners operate.

Where such transfers take place, we ensure that appropriate safeguards are in place before the transfer occurs:

• Adequacy decisions — transfers to countries recognised by the relevant authority as providing an adequate level of data protection
• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA
• UK International Data Transfer Agreement (IDTA) — approved by the ICO for transfers from the United Kingdom
• Transfer Impact Assessments (TIAs) conducted for transfers to high-risk destination countries

Request transfer details

A list of the countries to which we transfer personal data and the specific safeguard applicable to each transfer is available on request from our DPO at dpo@nala.money

Adequacy decision

Countries formally recognised as providing adequate data protection — no further safeguard required. List of adequate countries maintained by the ICO (UK): https://ico.org.uk

Standard Contractual Clauses (SCCs)

Used for transfers to non-adequate countries from the EEA. European Commission approved clauses. See: https://commission.europa.eu/law/law-topic/data-protection_en

UK IDTA

UK International Data Transfer Agreement — used for transfers from the United Kingdom. ICO guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/

Transfer Impact Assessment (TIA)

Conducted before any transfer to a high-risk destination country to assess whether SCCs or IDTA provide sufficient protection in practice. Available on request from dpo@nala.money

‍