Fubra Limited T&C Analysis: Uncovering Legal Risks and Compliance Gaps | Erayaha

## When Legal Ambiguity Meets Regulatory Fines: Fubra Limited’s T&C Under the Microscope

Imagine a scenario where a single ambiguous clause in your privacy policy could expose your company to GDPR fines of up to €20 million or 4% of annual global turnover. Our analysis of Fubra Limited’s Terms & Conditions reveals several such high-stakes risks—each with the potential to trigger regulatory scrutiny, litigation, or significant business losses.

1. International Data Transfers: Insufficient User Consent and Notification Fubra’s policy allows for data storage outside the EEA but only references Privacy Shield and Model Clauses. Critically, it lacks explicit user notification and consent for such transfers, which is a GDPR requirement (Articles 44-49). This gap could result in regulatory action and reputational harm, especially after the invalidation of Privacy Shield by the CJEU in 2020. Potential fines: up to €20 million.

Legal Analysis

critical Risk

Removed

Added

7.3 Some of your data may be stored outside of the European Economic Area (“"the EEA”") (The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein). You are deemed to accept and agree to this by using Our Site and submitting information to Us. If We do storeWhere data outside the EEAis transferred internationally, Wewe will take all reasonable steps to ensure thatobtain your data is treated as safelyexplicit consent and securely as it would be within the UK and under theprovide clear notice prior to such transfers, in accordance with GDPR including: 7Articles 44-49.3.1 Ensuring We will ensure that any US based companiesinternational transfers are based on valid mechanisms such as Standard Contractual Clauses (SCCs) or adequacy decisions, and will not rely on Privacy Shield Certified and their Model Contract clauses fully meet the requirements under the GDPR, which is no longer valid.

Legal Explanation

The original clause does not require explicit user consent or notice for international transfers and references Privacy Shield, which was invalidated in 2020. The revision ensures GDPR compliance by requiring explicit consent, notice, and use of valid transfer mechanisms.

2. Business Transfers: Absence of Advance User Notification The clause on business transfers states that users will not be contacted in advance if their data is transferred to a new owner. GDPR (Articles 13 & 14) and UK Data Protection Act 2018 require transparent communication about changes in data controllers. Failure to notify can lead to complaints, regulatory investigations, and fines.

Legal Analysis

high Risk

Removed

Added

9.2 In the event that any of your data is to be transferred in suchas part of a mannerbusiness transfer, youwe will not be contacted inprovide you with advance notice and informed ofclear information about the changesnew data controller, in accordance with GDPR Articles 13 and 14.

Legal Explanation

GDPR requires transparency and user notification when data controllers change. The original clause violates this principle and exposes the company to regulatory action. The revision ensures compliance and user trust.

3. Data Retention: Vague Basis for Retention Periods While Fubra specifies some retention periods, the policy also allows for data retention “as long as necessary,” which is overly broad. GDPR (Article 5(1)(e)) mandates that personal data should not be kept longer than necessary for the purposes for which it is processed. Ambiguity here risks non-compliance and potential enforcement action.

Legal Analysis

medium Risk

Removed

Added

7.1 We only keep yourretain personal data only for as long as We need tothe specific periods outlined in order to use it as described above in section 6this policy, and/or where a lawful basis exists, and will regularly review and securely delete data that is no longer necessary for as long as We have your permission to keepthe purposes for which it was collected, in compliance with GDPR Article 5(1)(e).

Legal Explanation

The original clause is vague and lacks specificity, which is required under GDPR. The revision provides a clear, reviewable standard for data retention and deletion.

4. Third-Party Processors: Incomplete Safeguards for International Transfers The policy states that US-based processors must be Privacy Shield certified, but Privacy Shield is no longer valid. There is no mention of Standard Contractual Clauses (SCCs) as currently required by the European Commission. This exposes Fubra to legal challenges and possible suspension of data flows.

Legal Analysis

high Risk

Removed

Added

8.3.1 EnsuringWe ensure that any US-based companies processing your data are Privacy Shield Certified; 8.3.2 Putting Data Processing Agreementssubject to Standard Contractual Clauses (SCCs) or other valid transfer mechanisms, where applicableas required by the European Commission, EU Model Contractsand that Data Processing Agreements are in place with all third-party processors.

Legal Explanation

Privacy Shield is no longer a valid transfer mechanism. The revision updates the clause to reflect current legal requirements and enforceability under GDPR.

---

Conclusion: Proactive Redlining for Legal Resilience Our examination shows that even well-intentioned privacy policies can contain hidden risks with major financial implications. Addressing these issues now can prevent costly fines, litigation, and reputational damage. Is your business prepared for the next regulatory audit? Are your data transfer mechanisms up to date with the latest legal requirements? How often do you review your contracts for enforceability and compliance?

This analysis is for educational purposes only and does not constitute legal advice. For actual legal guidance, consult with a licensed attorney. This assessment is based on publicly available information and professional legal analysis. See erayaha.ai’s terms of service for liability limitations.