GDPR: Transfer mechanism for personal data sent to Twitch via the API (EU-based developers)

API
1

Hi,

I’ve checked existing posts for answers regarding this topic, but couldn’t find any that match my case.

I’m an EU-based developer. Our application sends personal data to Twitch via the Helix API on behalf of authenticated broadcasters (e.g. user IDs in API requests, messages sent by our chat bot, moderation actions).

As an EU controller, we need a transfer mechanism under Chapter V GDPR for transfers to Twitch Interactive, Inc. in the US. As far as I can tell, the Privacy Notice doesn’t name one, and the Developer Services Agreement contains no Standard Contractual Clauses or other data protection terms.

Twitch Support referred me to this forum, so I’m asking here:

  1. Is Twitch Interactive, Inc. covered by Amazon.com, Inc.’s EU-U.S. Data Privacy Framework certification?
  2. Does Twitch offer data protection terms or Standard Contractual Clauses for developers?
  3. If neither, is there an official Twitch contact for this topic? I have already written to privacy@twitch.tv, but haven’t received a response yet.

I’d also be interested in how other EU developers handle and document this.

Thanks!

2

That would be the one to contact. They’ll just take however long it takes to respond depending on their queue.

That would be a safe assumption. (sure it is not listed under “Other Covered Entites” but as a subsidary makes common sense to me)

From your described use case, thats just a mimic of what people do using the site “normally”. (Arguments over if an UserID on it’s own is PII or not withstanding) Transacting via Helix instead of the “nomral website” is the same operation.