Intuity's Privacy Policy Explained

The privacy policy lacks a clear and explicit statement regarding the purpose of data collection for each processing activity, particularly for navigation data and analytics cookies, making it difficult to assess necessity and proportionality.

The policy states that data may be transferred to the US, and in the absence of adequacy decisions or safeguards, transfer will occur only with explicit consent under Article 49 of the GDPR. Relying on consent for regular data transfers to the US is highly problematic as it may not constitute a valid legal basis for systematic transfers, and the policy does not detail the specific risks to data subjects.

The legal basis for processing is vaguely described as being for pre-contractual measures or consent, but the policy does not clearly link each specific data processing activity (like using Google Analytics) to its precise legal basis, such as legitimate interest or consent.

While the policy mentions data may be shared with third parties for service provision, it does not provide a specific list of these third parties or categories of recipients, such as the specific cloud providers or Google LLC for Analytics, which is a transparency requirement.

The information about data retention is generic, stating data is kept for the "strictly necessary" time with annual reviews, but it fails to specify concrete retention periods for different data categories, like analytics data or server logs.

The policy mentions using Google Analytics cookies but does not explicitly state whether these are used only in a privacy-enhanced mode (like with IP anonymization) or for profiling, and the initial setup described does not clearly require prior user consent for these analytics cookies, potentially conflicting with the requirement for prior consent for such tracking tools.

The contact information for exercising data subject rights is provided, but the policy does not specify the procedure or the response timeframe for such requests, which should be within one month.

The policy states that navigation data could be used to establish liability in case of cybercrimes against the site, but it does not specify the retention period for this purpose or the balancing of this interest with the rights of data subjects.

The English version of the policy appears to be a direct translation of the Italian version without clear indication of which version is legally authoritative, which could lead to inconsistencies.

The policy structure and formatting are inconsistent and messy, with irregular spacing and alignment, which hinders readability and could be seen as lacking professionalism, potentially affecting the clarity of information presented.