↓ Skip to main content
Altera - Matrixify-Compatible Import & Export Tool for Shopify
  1. EU Data Protection/

Transfer Impact Assessment (TIA)

Table of Contents

Last Updated: February 6, 2026

Overview
#

This Transfer Impact Assessment (“TIA”) summarizes Abnoba LLC’s evaluation of the risks associated with transferring personal data from the European Economic Area (EEA) to third countries in connection with the Altera services.

This assessment is conducted in accordance with the recommendations of the European Data Protection Board (EDPB) and the requirements under the General Data Protection Regulation (GDPR), particularly following the “Schrems II” decision (Case C-311/18).

Purpose of This Assessment
#

The TIA evaluates:

  1. The legal framework and practices in third countries where data may be transferred
  2. Whether supplementary measures are necessary to ensure adequate protection
  3. The effectiveness of safeguards implemented by Abnoba

Data Transfers Overview
#

Primary Transfer Locations
#

Abnoba LLC processes data in the following jurisdictions:

United States

  • Primary data processing location
  • Use of Standard Contractual Clauses (SCCs) as transfer mechanism
  • Infrastructure hosted with certified cloud service providers

Canada

  • Shopify Inc. (a key Sub-processor) is located in Canada
  • Shopify API access involves data processing in Canadian jurisdiction
  • Canada has an EU adequacy decision (European Commission Decision 2002/2/EC), meaning transfers to Canada are treated as having adequate protection

Nature of Data Transferred
#

Data transferred includes:

  • Shopify store data (products, customers, orders, inventory, etc.)
  • Account information of Altera users
  • Operational and support data

Data is processed temporarily during import/export operations and is not retained beyond what is necessary for service delivery and legal compliance.

Legal Framework Assessment#

United States
#

Legal Regime:

  • Primary federal privacy law: Various sector-specific laws (no comprehensive federal law)
  • State-level privacy laws: California Consumer Privacy Act (CCPA/CPRA), Virginia CDPA, Colorado CPA, and others
  • Government access: FISA 702, Executive Order 12333, CLOUD Act

Evaluation:

Government Access to Data:

  • Abnoba has assessed the risk of government access under U.S. surveillance laws
  • Our services are not subject to FISA 702 as we are not an “electronic communication service provider” as defined under 50 U.S.C. § 1881(b)(4)
  • We have not received any national security orders or FISA requests
  • We commit to transparency in government data requests where legally permitted

Procedural Safeguards:

  • Any lawful government requests must be specific and proportionate
  • We review all requests for legal validity
  • We notify affected customers unless legally prohibited

Canada
#

Legal Regime:

  • Federal privacy law: Personal Information Protection and Electronic Documents Act (PIPEDA)
  • Provincial privacy laws in certain provinces (e.g., Quebec’s Law 25)
  • EU adequacy decision in place (European Commission Decision 2002/2/EC)

Evaluation:

Adequacy Decision:

  • Canada benefits from an EU adequacy decision, meaning the European Commission has determined that Canada provides an adequate level of data protection
  • Transfers to Canada do not require supplementary measures beyond the adequacy decision
  • The adequacy decision covers transfers to recipients subject to PIPEDA

Supplementary Measures
#

Beyond Standard Contractual Clauses, Abnoba implements the following supplementary technical and organizational measures:

Technical Measures
#

1. End-to-End Encryption

  • Data encrypted in transit using TLS 1.2 or higher
  • Data encrypted at rest using AES-256
  • Encryption keys managed separately from data

2. Data Minimization

  • Only process data necessary for the requested operations
  • Temporary processing data deleted within 30 days
  • No unnecessary data retention

3. Pseudonymization and Anonymization

  • Where possible, data is pseudonymized during processing
  • Internal identifiers used instead of direct identifiers

4. Access Controls

  • Strict role-based access control
  • Multi-factor authentication required
  • Logging and monitoring of all data access

5. Secure Infrastructure

  • Hosting with SOC 2 Type II certified providers (GCP)
  • Geographic distribution to minimize single points of failure

Organizational Measures
#

1. Data Protection Governance

  • Designated Data Protection Contact
  • Data protection by design and by default

2. Vendor Management

  • All Sub-processors undergo security assessments
  • Contractual obligations requiring GDPR-level protection
  • Regular audits of Sub-processor compliance

3. Incident Response

  • Incident response plan with defined escalation procedures
  • Breach notification procedures compliant with GDPR Article 33

4. Transparency and Documentation

  • Public documentation of data practices
  • Regular updates to privacy policies and data transfer documentation
  • Transparent sub-processor list

5. Data Subject Rights

  • Procedures to facilitate data subject rights requests
  • Commitment to respond within GDPR timelines
  • Tools for customers to export or delete data

Risk Assessment
#

Risk Level: Low to Moderate
#

Rationale:

  1. Limited Government Access Risk: Abnoba’s services do not fall under the primary surveillance frameworks (FISA 702). Any government access would require individualized legal process.

  2. Strong Technical Protections: End-to-end encryption and data minimization significantly reduce the risk of unauthorized access, even if compelled by government authorities.

  3. Transparent Operations: We maintain transparency about our data handling practices and any government requests received (subject to legal restrictions).

  4. Contractual Safeguards: Use of SCCs provides enforceable rights for data subjects and obligates Abnoba to challenge disproportionate data requests.

Residual Risks
#

Despite supplementary measures, some theoretical risks remain:

  • Possibility of classified government demands that prevent transparency
  • Potential future changes to U.S. surveillance laws

We continuously monitor legal developments and will update our transfer mechanisms and supplementary measures as necessary.

Monitoring and Review
#

This TIA is reviewed and updated:

  • At least annually
  • When there are material changes to data processing activities
  • Following changes to applicable laws or legal precedents
  • After any data security incidents

Last Review Date: February 6, 2026 Next Scheduled Review: February 2027

Conclusion
#

Based on this assessment, Abnoba has concluded that the combination of Standard Contractual Clauses and the supplementary technical and organizational measures described above provides an adequate level of protection for personal data transferred from the EEA to third countries.

We will continue to monitor the legal and factual situation in third countries and take additional measures as necessary to ensure ongoing compliance with GDPR requirements.

Related Documentation#

Contact Information
#

For questions about this Transfer Impact Assessment:

Abnoba LLC Email: privacy@getaltera.com