kolsetu.com privacy policy — score 85/100 (low risk)
Viimati analüüsitud
See aruanne on üle 28 päeva vana. See näitab selle poliitika viimati salvestatud analüüsi — värskenda, et uuesti laadida reaalajas leht ja uuendada skoori.
Aruande sisu (kokkuvõte, leitud asjaolud, tsitaadid) on genereeritud inglise keeles ja seda pole lokaliseeritud.
Aruande üksikasjad
low riskKolsetu generally respects EU privacy rules, but it over‑collects usage data, lacks a public DPO, and provides limited detail on some international transfers.
Kolsetu’s Product, Website, and Data Processing Agreement policies are detailed, reference GDPR articles, and include rights, security measures, and transfer mechanisms. They explicitly exclude user data from AI model training and rely on SCCs or adequacy decisions for cross‑border flows. However, the policies retain extensive technical logs, do not name a Data Protection Officer, and keep legitimate‑interest assessments behind a request barrier, which reduces transparency.
Kategooriate kaupa hinnang
Poliitika jaotus peamistele vastavusaladele. Hea = tugev, keskmine = segane, nõrk = muret tekitav.
Collects extensive usage logs (IP, device IDs) retained for 12 months, which may exceed what is needed for a B2B admin platform.
Policies are comprehensive and cite GDPR articles, but legitimate‑interest assessments are only available on request.
Shares data with many sub‑processors; most are EEA‑based, but some US entities (LiveKit) rely on SCCs without detailed safeguards.
Uses adequacy decisions, SCCs, and the EU‑U.S. Data Privacy Framework; however, the exact scope of SCCs for each sub‑processor is not listed.
Explicitly prohibits using Platform User data for AI model training and includes contractual AI training exclusions.
Provides full GDPR rights, clear contact details, and response timelines; some statutory retention limits are noted.
Peamised leitud asjaolud
Märkimisväärsed klauslid, probleemid või head tavad (kriitilised esimesena)
Broad technical data collection and retention
The policy logs IP addresses, device identifiers, browser type, OS, and retains usage logs for 12 months, which may be disproportionate for a business‑to‑business admin tool.
No appointed Data Protection Officer (DPO)
The Website Privacy Policy states Kolsetu has not formally appointed a DPO, despite processing large volumes of personal data across multiple services.
US‑based sub‑processor LiveKit lacks disclosed safeguards
LiveKit (US) processes real‑time audio; the policy only mentions SCCs but provides no detail on encryption, data minimisation, or audit rights for this sub‑processor.
Limited transparency on legitimate‑interest assessments
Legitimate‑interest assessments are said to be “available on request” but are not published, reducing accountability for the Art. 6(1)(f) basis.
Kokkuvõte kasutajale
Kolsetu’s privacy stance is solid overall, but users should ask for more detail on how long technical data is kept and what safeguards apply to US‑based sub‑processors.
Vastavusseisund
Kolsetu demonstrates a proactive compliance posture with documented legal bases, rights mechanisms, and security certifications (ISO 27001, GDPR). Yet, some gaps in transparency and data minimisation could be tightened.
EL-i ülekanded
All primary processing occurs in the EEA. Transfers to non‑EEA sub‑processors (e.g., LiveKit in the US) are covered by Standard Contractual Clauses, and adequacy decisions are used where available. Transfer impact assessments are performed but not publicly disclosed.
Tuvastatud signaalid
Tekstis tuvastatud konkreetsed andmed ja tavad
Tõendite väljavõtted
Otsesed tsitaadid poliitikast nende leidude toetuseks
We collect and process only the personal data that is necessary for the purposes described in this Policy (Art. 5(1)(c) GDPR - data minimisation).
We do not use Platform User data for advertising, behavioural profiling, or AI model training.
All financial transactions are completed on the payment provider's own infrastructure; Kolsetu's data exposure is limited to the confirmation event.
Kolsetu implements and maintains appropriate technical and organisational measures (TOMs) in accordance with Art. 32 GDPR to protect Platform User data.
We do not derive biometric identifiers or voiceprints from voice recordings... and does not process voice recordings as biometric data within the meaning of Art. 9 GDPR.
Google Analytics data is processed by Google Ireland Limited... transferred to the United States for processing on Google LLC infrastructure. This transfer is protected by EU Standard Contractual Clauses.
Puudub või ebaselge
- No publicly available Data Protection Impact Assessment (DPIA) for voice‑recording processing.
- No explicit statement on the method of IP‑address anonymisation.
- No detailed description of how the legitimate‑interest assessment is documented or reviewed.
Küsimused, mida küsida
- Can Kolsetu provide the documented legitimate‑interest assessment for processing usage logs and IP addresses?
- What technical and contractual safeguards are in place for the US‑based sub‑processor LiveKit?
- How is IP‑address anonymisation performed before any cross‑border transfer?
- Why has Kolsetu not appointed a Data Protection Officer, and how are DPO responsibilities covered?
- Is there a publicly available DPIA for the processing of demo‑call recordings and transcripts?
Jaga seda analüüsi
Igaüks, kellel on see link, saab ülalolevat tulemust vaadata.
DentroChati loodud
100% Euroopa tehisintellektivestlus kõigile
Vestle tehisintellektiga, tööta failidega, loo pilte ja otsi veebist. Andmed jäävad Euroopasse.