robotstxt.es privacy policy — score 68/100 (medium risk)
Sist analysert
Denne rapporten er mer enn 28 dager gammel. Den viser den sist lagrede analysen for denne erklæringen — oppdater for å hente den live siden og fornye poengsummen.
Rapportinnholdet (sammendrag, funn, sitater) er generert på engelsk og er ikke lokalisert.
Rapportdetaljer
medium risikoRobotstxt generally respects EU privacy but lacks clear details on legal bases, third‑party processors and AI use.
Robotstxt states compliance with the GDPR, limits data collection to minimal identifiers, keeps data in Spain, and lists user rights. However, the policy is vague on the exact legal bases for processing, does not disclose specific third‑party processors, and omits any reference to AI/model training or profiling. Consent procedures are mentioned only superficially.
Vurdering per kategori
Oppdeling av erklæringen på viktige compliance-områder. God = sterk, rimelig = blandet, dårlig = bekymringsfull.
Claims to collect only minimal identifiers, but does not publish a concrete list of data fields.
Provides purpose tables but omits legal basis per activity and detailed processing steps.
Admits providers (gestoría, hosting, lawyers) may access data without naming them or the exact data shared.
Explicitly states data is stored in Spain and no cross‑border transfers occur.
No mention of using personal data for AI, profiling, or automated decision‑making.
Comprehensive rights list, contact details, and 30‑day response commitment.
Viktige funn
Bemerkelsesverdige klausuler, problemer eller gode praksiser (kritiske først)
Insufficient third‑party processor disclosure
It states "no comunicamos datos a terceros" yet acknowledges that providers such as the gestoría, hosting, and lawyers may have access, without naming them or describing safeguards.
Vague legal basis for processing
The policy says data is processed for contractual and legal obligations but does not map each purpose to a specific GDPR legal basis (e.g., consent, legitimate interest).
No AI or profiling clause
The document never addresses whether personal data is used for machine‑learning model training, profiling, or automated decision‑making, leaving a compliance gap.
Consent mechanism not described
While the text mentions that consent will be requested, it provides no details on how consent is obtained, recorded, or withdrawn.
Oppsummering for brukeren
The company appears privacy‑friendly but you should ask for more detail on who actually sees your data and how it might be used beyond the service.
Compliance-stilling
Mixed – good on data localisation and user rights, weaker on transparency of processing grounds and third‑party disclosures.
EU-overføringer
No international transfers are performed; data is hosted in Spain.
Oppdagede signaler
Spesifikke datapunkter og praksiser identifisert i teksten
Bevisutdrag
Direkte sitater fra erklæringen som støtter disse funnene
Normalmente, nada más te vamos a pedir datos mínimos identificativos en función de si eres cliente, proveedor, nos haces una consulta, o nos envías un CV.
No comunicamos datos a terceros, es decir, que no cedemos tu información; pero sí trabajamos con algunos proveedores que pueden tener acceso a datos (nuestra gestoría, el hosting, abogados, etc. que nos dan servicio y tienen acceso a los datos).
Tu información está alojada en España, y no realizamos ninguna transferencia internacional.
El derecho a estar informado/a sobre cómo se usa tu información personal (¡como este aviso!); El derecho a acceder a la información personal tuya que mantengamos; … El derecho a retirar tu consentimiento a cualquier tratamiento de datos basado en un consentimiento en cualquier momento.
Mangler eller uklart
- Explicit legal basis per processing activity
- Full list of third‑party processors with data categories
- Statement on AI/model training, profiling, or automated decision‑making
- Detailed consent capture and withdrawal procedure
Spørsmål å stille
- What specific GDPR legal basis (e.g., consent, legitimate interest) do you rely on for each processing category listed?
- Can you provide a complete list of all third‑party processors, the exact data they receive, and the contractual safeguards in place?
- Do you use any personal data for AI model training, profiling, or automated decision‑making, and if so, how can users opt out?
- How is consent obtained, recorded, and managed for the different processing activities?
- If a future cross‑border transfer becomes necessary, what mechanisms (e.g., SCCs, BCRs) will you employ?
Del denne analysen
Alle med denne lenken kan se resultatet ovenfor.
Bygget av DentroChat
100 % europeisk AI-chat for alle
Chat med AI, jobb med filer, generer bilder og søk på nettet. Data forblir i Europa.