free.fr privacy policy — score 58/100 (medium risk)
Última análise
O conteúdo do relatório (resumo, conclusões, citações) foi gerado em inglês e não está localizado.
FREE S.A.S. · free.fr
Detalhes do relatório
medium riscoFree collects a vast and vaguely defined array of personal data—including profiling scores and detailed usage metrics—shares it widely with ad networks and the Iliad group, and transfers some outside the EU, though it does clearly outline standard GDPR rights.
The privacy policy of Free S.A.S. is structured around GDPR principles but suffers from overly broad data categories, particularly regarding 'personal life data' and 'profiling'. While legal bases are generally identified, the reliance on legitimate interest for commercial prospection and the broad sharing of data with unspecified partners and ad agencies raise concerns. International transfers to the US and Morocco are acknowledged with a mention of SCCs, but specific safeguards are lacking. User rights are well-documented, but the policy is entirely silent on AI/algorithmic training and automated decision-making.
Avaliação por categoria
Repartição da política pelas principais áreas de conformidade. Bom = sólido, razoável = misto, fraco = preocupante.
Categories like 'personal life data' and 'profiling data' are excessively broad and vaguely defined, conflicting with the principle of collecting only what is necessary.
The policy clearly lists purposes and legal bases, but lacks specificity on exactly who the third-party partners are and is silent on AI training.
Data is shared widely within the Iliad group, with unspecified 'advertising agencies', and security partners, without a detailed sub-processor list.
Transfers outside the EU (USA, Morocco) are disclosed with a mention of Standard Contractual Clauses, but supplementary measures or specific transfer impact assessments are not detailed.
The policy is completely silent on whether user data is used for AI or algorithmic model training, which is a significant gap.
All standard GDPR rights are clearly explained, including conditions for erasure and portability, along with specific contact details for the DPO.
Conclusões principais
Cláusulas relevantes, problemas ou boas práticas identificadas (críticas primeiro)
Overly Broad and Vague Data Categories
The policy lists 'Données liées à la vie personnelle' (Personal life data) as 'any justificatory document relating to your personal situation' and 'Données issues du profilage' (Profiling data) as 'Profile, score, client segmentation'. These definitions are unbounded and fail the GDPR's data minimization principle.
Silence on Automated Decision-Making and AI
While 'profiling' is mentioned, there is no information on automated decision-making (Article 22 GDPR) or whether data is used to train AI models, leaving users in the dark about algorithmic impacts.
Profiling for Fraud and Unpaid Debts
Free explicitly uses profiling for security, fraud, and unpaid debt prevention based on 'legitimate interest'. Profiling for financial risk is a high-risk processing activity that often requires more robust justification and transparency than a generic legitimate interest claim.
Commercial Prospection Based on Legitimate Interest
For commercial communications and prospection, Free claims 'Your consent or our legitimate interest' as the legal basis. Relying on legitimate interest for direct marketing is permissible but often contested; the policy does not explain the balancing test conducted.
Vague Third-Party Sharing
Data is shared with 'advertising agencies and specialized agencies' and 'companies in charge of security'. Without a specific list of sub-processors or partners, users cannot truly understand who has access to their data.
Resumo para o utilizador
Free tracks a lot of what you do, including building a 'profile' and 'score' about you, and shares this with advertisers and its parent company. You can say no to targeted ads and commercial emails, but you have to actively opt out.
Postura de conformidade
The policy attempts to comply with GDPR by listing purposes and legal bases, but it falls short on data minimization and specificity regarding third-party processors and international transfer safeguards.
Transferências UE
Data is transferred outside the EU (specifically to the USA and Morocco). The policy states that Standard Contractual Clauses are used for non-adequate countries, but it does not mention supplementary measures or specific safeguards for US transfers post-Schrems II.
Sinais detetados
Dados e práticas específicas identificadas no texto
Fragmentos de evidência
Citações diretas da política que suportam estas conclusões
Données liées à la vie personnelle : tout document justificatif relatif à votre situation personnelle (justificatif de domicile, courriers, justificatifs d'une situation personnelle etc.)
Données issues du profilage : Profil, score, segmentation client
Lutter contre la fraude, y compris par le profilage
Les destinataires de vos données sont situés dans l'Union Européenne et en dehors de l'Union Européenne (États-Unis, Maroc etc.).
Communications commerciales et prospection [...] Votre consentement ou notre intérêt légitime
Em falta ou pouco claro
- No specific list of sub-processors or third-party partners
- No detail on supplementary measures for international transfers
- No information on automated decision-making logic or safeguards
- No explicit mention of AI model training
- No detail on the criteria for the 'profiling score'
Perguntas a fazer
- What specific types of documents fall under 'personal life data' and how is collection strictly limited to what is necessary?
- How does Free justify 'legitimate interest' for commercial prospection, and what specific opt-out mechanisms exist beyond the general right to object?
- What supplementary technical and organizational measures are in place for data transfers to the USA and Morocco beyond Standard Contractual Clauses?
- Is any user data used for training AI models or algorithms, and if so, how can users opt out?
- What specific logic, criteria, and consequences apply to the 'profiling' and 'scoring' mentioned in the data categories?
Partilhar esta análise
Qualquer pessoa com esta ligação pode ver o resultado acima.
Criado pela DentroChat
Chat de IA 100% europeu para todos
Converse com IA, trabalhe com ficheiros, gere imagens e pesquise na web. Os dados permanecem na Europa.