Information is shared within Pinterest's companies and moved to countries like the US
Pinterest says Non-User information will be shared with its family of companies. As a result it will be transferred to, or stored and processed in, countries outside the EEA, Switzerland or UK (such as the United States) for the purposes described in the notice.
Supporting quotations
Your information will be shared with our families of companies.
third countries (like the United States) outside of the EEA, Switzerland, or UK for the purposes described.
Qualifications & exceptions
The transfer is for "the purposes described" in this notice.
Not stated here
The companies in the family of companies are not named, other than Pinterest Europe Ltd. and Pinterest, Inc. as joint controllers.
The full list of destination countries is not given.
Sharing & Disclosure · Company practice
Transfers rely on adequacy decisions or standard contractual clauses
Pinterest lists safeguards it relies on for transfers. It transfers information to some countries that have a European Commission adequacy decision (or an equivalent decision under other laws). For transfers to third parties in countries without an adequacy decision, it relies on standard contractual clauses approved by the European Commission and their UK and Swiss equivalents. The notice also says it relies on the Data Privacy Frameworks for transfers to the US (separate card).
Supporting quotations
Safeguards which we rely on in ensuring your information benefits from an adequate level of protection includes the following:
to some countries with such adequacy decisions
We rely on standard contractual clauses to transfer information as described in “How we use the info we collect” to third parties in countries without an adequacy decision.
Qualifications & exceptions
The SCC statement refers to transfers "to third parties", which indicates recipients beyond Pinterest's own companies, but the notice does not identify them.
The SCC transfers are described "as described in “How we use the info we collect”", a section title that does not appear in this notice; the nearest section is "How do we use a Non-User’s information?".
Not stated here
The linked list of adequacy countries is not supplied.
Which third parties receive data under SCCs is not stated.
The cited GDPR articles (45 and 46) are named, not supplied or interpreted.
Sharing & Disclosure · Company commitment
Pinterest relies on the EU, UK and Swiss Data Privacy Frameworks for US transfers
For transfers of personal data of EEA, Swiss and UK (and Gibraltar) residents to the US, Pinterest says it relies on, and has certified to the U.S. Department of Commerce that it adheres to, the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. It says Pinterest Inc. complies with them. Questions or complaints about data received under these frameworks should first go to Pinterest Inc. at privacy-support@pinterest.com, with further steps described below in the notice.
Supporting quotations
For transfers of personal data of EEA, Switzerland, and UK (and Gibraltar) residents to the U.S., Pinterest relies and has certified to the U.S. Department of Commerce that it adheres to
Pinterest Inc. complies with Data Privacy Frameworks.
should first contact Pinterest Inc. at privacy-support@pinterest.com.
Qualifications & exceptions
The frameworks cover transfers of EEA, Swiss and UK (and Gibraltar) residents' data to the US.
Not stated here
The certification and program site are linked but not supplied.
Sharing & Disclosure · Company practice
Disclosure to law enforcement, government and researchers
Pinterest may share Non-User information with law enforcement agencies, government agencies, researchers or other parties in compliance with laws, rules or regulations. It says it only discloses information in response to such requests if it believes disclosure is reasonably necessary to comply with a law, regulation or legal request; to protect the safety, rights or property of the public, any person or Pinterest; or to detect, prevent or otherwise address fraud, security or technical issues. It may also share information if it believes this is necessary to prevent imminent and serious bodily harm to a person in an emergency. Separately, it may share publicly accessible information with independent researchers who meet certain criteria, to combat societal harms.
Supporting quotations
We may also share your information with law enforcement agencies, government agencies, researchers, or other parties in compliance with laws, rules, or regulations.
We only disclose information in response to such requests if we believe that disclosure is reasonably necessary to comply with a law, regulation or legal request; to protect the safety, rights, or property of the public, any person, or Pinterest; or to detect, prevent, or otherwise address fraud, security or technical issues.
We may also share information if we believe it is necessary to prevent imminent and serious bodily harm to a person in emergency situations.
We may share your publicly accessible information with independent researchers who meet certain criteria, to combat societal harms.
Qualifications & exceptions
The disclosure test is Pinterest's own belief that disclosure is reasonably necessary for one of the listed reasons.
Researcher sharing is limited to publicly accessible information and to independent researchers who meet certain criteria, for combating societal harms.
Not stated here
The researcher criteria are not described.
The Law Enforcement Guidelines are linked but not supplied.
The notice does not say whether Non-Users are notified of disclosures.
Sharing & Disclosure · Restriction or exception
Some transfers rely on legal exemptions instead of standard contractual clauses
Transfers to countries without an adequacy decision typically rely on standard contractual clauses, but in certain circumstances they can rely on exemptions provided under data protection law. The notice's example is sharing with law enforcement in emergency situations where Pinterest learns that a person's life is at risk.
Supporting quotations
While transfers to countries that don’t have an adequacy decision typically take place on the basis of SCCs, in certain circumstances, transfers can also take place on the basis of exemptions provided under data protection law.
For example, sharing with law enforcement, in emergency situations where we learn that a person’s life is at risk.
We rely on standard contractual clauses to transfer information as described in “How we use the info we collect” to third parties in countries without an adequacy decision.
These are decisions issued from the European Commission under Article 45 GDPR (or equivalent decisions under other laws) where they recognise that a country offers an adequate level of data protection.
Qualifications & exceptions
"In certain circumstances": exemptions are not the default basis; the example given is an emergency where a life is at risk.
Not stated here
Which data protection law exemptions are used is not specified.
Cross-references
narrows (model-proposed): Transfers rely on adequacy decisions or standard contractual clauses — exception_to: In certain circumstances, such as life-at-risk emergencies involving law enforcement, transfers to countries without an adequacy decision rely on legal exemptions instead of standard contractual clauses.