Can the Sensitive Data be stored outside the EEA?