kolsetu.com privacy policy — score 85/100 (low risk)
Ultima analisi
Questo report ha più di 28 giorni. Mostra l'ultima analisi salvata per questa informativa — aggiorna per recuperare la pagina live e rinnovare il punteggio.
Il contenuto del report (sintesi, risultati, citazioni) è stato generato in inglese e non è localizzato.
Dettagli del report
low rischioKolsetu generally respects EU privacy rules, but it over‑collects usage data, lacks a public DPO, and provides limited detail on some international transfers.
Kolsetu’s Product, Website, and Data Processing Agreement policies are detailed, reference GDPR articles, and include rights, security measures, and transfer mechanisms. They explicitly exclude user data from AI model training and rely on SCCs or adequacy decisions for cross‑border flows. However, the policies retain extensive technical logs, do not name a Data Protection Officer, and keep legitimate‑interest assessments behind a request barrier, which reduces transparency.
Valutazione per categoria
Suddivisione dell'informativa nelle principali aree di conformità. Buono = solido, discreto = misto, scarso = preoccupante.
Collects extensive usage logs (IP, device IDs) retained for 12 months, which may exceed what is needed for a B2B admin platform.
Policies are comprehensive and cite GDPR articles, but legitimate‑interest assessments are only available on request.
Shares data with many sub‑processors; most are EEA‑based, but some US entities (LiveKit) rely on SCCs without detailed safeguards.
Uses adequacy decisions, SCCs, and the EU‑U.S. Data Privacy Framework; however, the exact scope of SCCs for each sub‑processor is not listed.
Explicitly prohibits using Platform User data for AI model training and includes contractual AI training exclusions.
Provides full GDPR rights, clear contact details, and response timelines; some statutory retention limits are noted.
Risultati chiave
Clausole rilevanti, problemi o buone pratiche individuate (critici per primi)
Broad technical data collection and retention
The policy logs IP addresses, device identifiers, browser type, OS, and retains usage logs for 12 months, which may be disproportionate for a business‑to‑business admin tool.
No appointed Data Protection Officer (DPO)
The Website Privacy Policy states Kolsetu has not formally appointed a DPO, despite processing large volumes of personal data across multiple services.
US‑based sub‑processor LiveKit lacks disclosed safeguards
LiveKit (US) processes real‑time audio; the policy only mentions SCCs but provides no detail on encryption, data minimisation, or audit rights for this sub‑processor.
Limited transparency on legitimate‑interest assessments
Legitimate‑interest assessments are said to be “available on request” but are not published, reducing accountability for the Art. 6(1)(f) basis.
Sintesi per l'utente
Kolsetu’s privacy stance is solid overall, but users should ask for more detail on how long technical data is kept and what safeguards apply to US‑based sub‑processors.
Postura di conformità
Kolsetu demonstrates a proactive compliance posture with documented legal bases, rights mechanisms, and security certifications (ISO 27001, GDPR). Yet, some gaps in transparency and data minimisation could be tightened.
Trasferimenti UE
All primary processing occurs in the EEA. Transfers to non‑EEA sub‑processors (e.g., LiveKit in the US) are covered by Standard Contractual Clauses, and adequacy decisions are used where available. Transfer impact assessments are performed but not publicly disclosed.
Segnali rilevati
Dati e pratiche specifiche identificate nel testo
Estratti probatori
Citazioni dirette dall'informativa a supporto di questi risultati
We collect and process only the personal data that is necessary for the purposes described in this Policy (Art. 5(1)(c) GDPR - data minimisation).
We do not use Platform User data for advertising, behavioural profiling, or AI model training.
All financial transactions are completed on the payment provider's own infrastructure; Kolsetu's data exposure is limited to the confirmation event.
Kolsetu implements and maintains appropriate technical and organisational measures (TOMs) in accordance with Art. 32 GDPR to protect Platform User data.
We do not derive biometric identifiers or voiceprints from voice recordings... and does not process voice recordings as biometric data within the meaning of Art. 9 GDPR.
Google Analytics data is processed by Google Ireland Limited... transferred to the United States for processing on Google LLC infrastructure. This transfer is protected by EU Standard Contractual Clauses.
Mancante o poco chiaro
- No publicly available Data Protection Impact Assessment (DPIA) for voice‑recording processing.
- No explicit statement on the method of IP‑address anonymisation.
- No detailed description of how the legitimate‑interest assessment is documented or reviewed.
Domande da porre
- Can Kolsetu provide the documented legitimate‑interest assessment for processing usage logs and IP addresses?
- What technical and contractual safeguards are in place for the US‑based sub‑processor LiveKit?
- How is IP‑address anonymisation performed before any cross‑border transfer?
- Why has Kolsetu not appointed a Data Protection Officer, and how are DPO responsibilities covered?
- Is there a publicly available DPIA for the processing of demo‑call recordings and transcripts?
Condividi questa analisi
Chiunque abbia questo link può visualizzare il risultato sopra.
Realizzato da DentroChat
Chat IA 100% europea per tutti
Chatta con l'IA, lavora con file, genera immagini e cerca sul web. I dati restano in Europa.