free.fr privacy policy — score 58/100 (medium risk)
Dernière analyse
Le contenu du rapport (résumé, constats, citations) a été généré en anglais et n'est pas localisé.
FREE S.A.S. · free.fr
Détails du rapport
medium risqueFree collects a vast and vaguely defined array of personal data—including profiling scores and detailed usage metrics—shares it widely with ad networks and the Iliad group, and transfers some outside the EU, though it does clearly outline standard GDPR rights.
The privacy policy of Free S.A.S. is structured around GDPR principles but suffers from overly broad data categories, particularly regarding 'personal life data' and 'profiling'. While legal bases are generally identified, the reliance on legitimate interest for commercial prospection and the broad sharing of data with unspecified partners and ad agencies raise concerns. International transfers to the US and Morocco are acknowledged with a mention of SCCs, but specific safeguards are lacking. User rights are well-documented, but the policy is entirely silent on AI/algorithmic training and automated decision-making.
Évaluation par catégorie
Répartition de la politique selon les principaux domaines de conformité. Bon = solide, moyen = mitigé, faible = préoccupant.
Categories like 'personal life data' and 'profiling data' are excessively broad and vaguely defined, conflicting with the principle of collecting only what is necessary.
The policy clearly lists purposes and legal bases, but lacks specificity on exactly who the third-party partners are and is silent on AI training.
Data is shared widely within the Iliad group, with unspecified 'advertising agencies', and security partners, without a detailed sub-processor list.
Transfers outside the EU (USA, Morocco) are disclosed with a mention of Standard Contractual Clauses, but supplementary measures or specific transfer impact assessments are not detailed.
The policy is completely silent on whether user data is used for AI or algorithmic model training, which is a significant gap.
All standard GDPR rights are clearly explained, including conditions for erasure and portability, along with specific contact details for the DPO.
Constats clés
Clauses notables, problèmes ou bonnes pratiques identifiées (critiques en premier)
Overly Broad and Vague Data Categories
The policy lists 'Données liées à la vie personnelle' (Personal life data) as 'any justificatory document relating to your personal situation' and 'Données issues du profilage' (Profiling data) as 'Profile, score, client segmentation'. These definitions are unbounded and fail the GDPR's data minimization principle.
Silence on Automated Decision-Making and AI
While 'profiling' is mentioned, there is no information on automated decision-making (Article 22 GDPR) or whether data is used to train AI models, leaving users in the dark about algorithmic impacts.
Profiling for Fraud and Unpaid Debts
Free explicitly uses profiling for security, fraud, and unpaid debt prevention based on 'legitimate interest'. Profiling for financial risk is a high-risk processing activity that often requires more robust justification and transparency than a generic legitimate interest claim.
Commercial Prospection Based on Legitimate Interest
For commercial communications and prospection, Free claims 'Your consent or our legitimate interest' as the legal basis. Relying on legitimate interest for direct marketing is permissible but often contested; the policy does not explain the balancing test conducted.
Vague Third-Party Sharing
Data is shared with 'advertising agencies and specialized agencies' and 'companies in charge of security'. Without a specific list of sub-processors or partners, users cannot truly understand who has access to their data.
Synthèse pour l'utilisateur
Free tracks a lot of what you do, including building a 'profile' and 'score' about you, and shares this with advertisers and its parent company. You can say no to targeted ads and commercial emails, but you have to actively opt out.
Posture de conformité
The policy attempts to comply with GDPR by listing purposes and legal bases, but it falls short on data minimization and specificity regarding third-party processors and international transfer safeguards.
Transferts UE
Data is transferred outside the EU (specifically to the USA and Morocco). The policy states that Standard Contractual Clauses are used for non-adequate countries, but it does not mention supplementary measures or specific safeguards for US transfers post-Schrems II.
Signaux détectés
Données et pratiques spécifiques identifiées dans le texte
Extraits probants
Citations directes de la politique à l'appui de ces constats
Données liées à la vie personnelle : tout document justificatif relatif à votre situation personnelle (justificatif de domicile, courriers, justificatifs d'une situation personnelle etc.)
Données issues du profilage : Profil, score, segmentation client
Lutter contre la fraude, y compris par le profilage
Les destinataires de vos données sont situés dans l'Union Européenne et en dehors de l'Union Européenne (États-Unis, Maroc etc.).
Communications commerciales et prospection [...] Votre consentement ou notre intérêt légitime
Manquant ou flou
- No specific list of sub-processors or third-party partners
- No detail on supplementary measures for international transfers
- No information on automated decision-making logic or safeguards
- No explicit mention of AI model training
- No detail on the criteria for the 'profiling score'
Questions à poser
- What specific types of documents fall under 'personal life data' and how is collection strictly limited to what is necessary?
- How does Free justify 'legitimate interest' for commercial prospection, and what specific opt-out mechanisms exist beyond the general right to object?
- What supplementary technical and organizational measures are in place for data transfers to the USA and Morocco beyond Standard Contractual Clauses?
- Is any user data used for training AI models or algorithms, and if so, how can users opt out?
- What specific logic, criteria, and consequences apply to the 'profiling' and 'scoring' mentioned in the data categories?
Partager cette analyse
Toute personne disposant de ce lien peut consulter le résultat ci-dessus.
Conçu par DentroChat
Chat IA 100 % européen pour tous
Discutez avec l'IA, travaillez avec des fichiers, générez des images et cherchez sur le web. Les données restent en Europe.