policies.tinder.com privacy policy — score 48/100 (high risk)
Ostatnia analiza
Treść raportu (podsumowanie, ustalenia, cytaty) została wygenerowana po angielsku i nie jest zlokalizowana.
Tinder (MTCH Technology Services Limited) · tinder.com
Szczegóły raportu
high ryzykoTinder collects a massive amount of highly sensitive personal data—including sexual orientation, biometric face data, and precise location—and shares it widely across Match Group companies and advertising partners, making it a concerning privacy choice despite offering standard EU rights.
Tinder's privacy policy reveals extensive data collection and sharing practices that go well beyond what is strictly necessary for a dating application. While the policy is transparent about its practices and provides clear mechanisms for exercising GDPR rights, the sheer volume of sensitive data collected, the broad sharing with Match Group affiliates and advertisers, and the use of data for machine learning without clear opt-out mechanisms raise significant privacy concerns under EU law.
Ocena według kategorii
Podział polityki na kluczowe obszary zgodności. Dobry = silny, umiarkowany = mieszany, słaby = niepokojący.
Collects highly sensitive categories (sexual life, biometrics, precise location) and generates broad 'insights and inferences' that go well beyond what is strictly necessary for the service.
The policy is clearly written and structured, but uses broad language around purposes like 'improving services' and 'legitimate business purposes' that lack specificity.
Extensive sharing with Match Group affiliates for vague purposes, advertising partners using tracking technologies, and joint data control with Meta, creating a wide data dissemination footprint.
Acknowledges transfers to the US and cites SCCs, but is silent on supplementary technical or organizational measures required to ensure effective protection post-Schrems II.
Explicitly reserves the right to use data for machine learning and developing new technologies, but offers no information on safeguards or an opt-out mechanism for users.
Clearly outlines GDPR rights (access, portability, deletion, objection, restriction) and provides direct links and contact details for the DPO and data protection authorities.
Kluczowe ustalenia
Istotne klauzule, problemy lub dobre praktyki (krytyczne na początku)
Excessive Collection of Special Category Data
The policy explicitly collects highly sensitive data categories like sexual orientation, sexual life, health, and political beliefs under 'Profile Data', and biometric 'Face Data', which goes far beyond what is strictly necessary for a dating service's core functionality and requires explicit consent under GDPR Article 9.
Broad and Vague Affiliate Data Sharing
Data is broadly shared with 'Affiliates' (other Match Group companies) for purposes as vague as 'corporate / consolidated audit, analysis and reporting' and 'enhance marketing and advertising campaigns', which may fail the GDPR's purpose limitation and compatibility tests.
No Opt-Out for AI/ML Training
The policy states they may maintain and use de-identified data 'to improve our service and create new features, technologies and services, including through machine learning', but is completely silent on any opt-out mechanism or specific safeguards for this use.
Incomplete International Transfer Safeguards
While the policy mentions relying on Standard Contractual Clauses for transfers to third countries like the USA, it lacks specifics on the supplementary measures implemented to ensure adequate protection post-Schrems II.
Disproportionate Data Retention Periods
Data retention periods are excessively long for certain categories, such as keeping customer care exchanges for 6 years and profile data for 1 year after closure 'in anticipation of potential litigation', which appears disproportionate under the GDPR's storage limitation principle.
Podsumowanie dla użytkownika
Your most intimate data is collected, inferred, and shared widely within the Match Group corporate family and with third-party advertisers, with limited ability to prevent its use in AI training.
Postawa zgodności
Mixed compliance posture: Strong on transparency and user rights mechanisms, but weak on data minimization and purpose limitation for sensitive data categories.
Transfery UE
Acknowledges reliance on Standard Contractual Clauses for US transfers but is silent on supplementary measures required post-Schrems II.
Wykryte sygnały
Konkretne dane i praktyki zidentyfikowane w tekście
Fragmenty dowodowe
Bezpośrednie cytaty z polityki potwierdzające te ustalenia
Some of this data may be considered sensitive or special in certain countries, such as details about sexual orientation, sexual life, health, or political beliefs. If you choose to provide this data, you consent to us using it as laid out in this Privacy Policy.
Where appropriate and as legally permitted, we may maintain and use data that, by itself, cannot identify or be attributed specifically to you... including through machine learning, and keep Match Group services safe.
We share data about you with our Affiliates and they share data about you with us... For other legitimate business purposes including corporate / consolidated audit, analysis and reporting.
we keep customer care exchanges with you for 6 years from the date of the communication; customer care records and supporting data... for five years in support of our safety efforts... profile data for one year in anticipation of potential litigation
We rely on such mechanisms to transfer personal data to our Affiliates... and to third parties for the purposes outlined in Section 5 in countries without adequacy decisions, such as the United States of America.
Brakujące lub niejasne
- No mention of a Data Protection Impact Assessment (DPIA) for the high-risk processing of biometric and sexual life data
- No details on supplementary measures for US data transfers despite acknowledging the US lacks an adequacy decision
- No opt-out mechanism or specific safeguards described for the use of personal data in machine learning/AI model training
- No clear explanation of how 'insights and inferences' are generated or specific examples of what these inferences might be
- No information on automated decision-making and profiling safeguards beyond a link to an external FAQ
Pytania do zadania
- What specific supplementary technical and organizational measures have you implemented alongside SCCs to protect EU data transferred to the US?
- How can users opt out of having their data used for machine learning and AI model training, as mentioned in your retention section?
- Can you provide the results of the DPIA conducted for processing special category data (sexual orientation, biometrics) and automated profiling?
- What exactly constitutes 'insights and inferences' generated from user data, and are these used to make automated decisions that significantly affect users?
Udostępnij tę analizę
Każda osoba z tym linkiem może zobaczyć wynik powyżej.
Stworzone przez DentroChat
100% europejski czat AI dla wszystkich
Rozmawiaj z AI, pracuj z plikami, generuj obrazy i przeszukuj sieć. Dane pozostają w Europie.