Privacy-and-policy

{"company_name":"Wise (formerly TransferWise)","company_context":"Wise is a financial technology company specializing in international money transfers, multi-currency accounts, and business payment solutions. It operates under strict financial regulations and serves over 16 million customers globally.","industry":"FinTech","report":{"data_collection":["Personal Data: Wise collects full name, date of birth, address, government-issued ID (for verification), email, phone number, and financial transaction data (including recipient details and payment amounts).","Device Data: IP address, device type, browser, and operating system are logged for security and fraud prevention.","Behavioral Data: Usage patterns, transaction history, and interactions with the app/website are tracked to improve services and personalize marketing communications."],"storage_and_security":["Data is stored in encrypted databases across multiple jurisdictions, with primary servers in the EU and US. Wise states that data is retained for as long as necessary to fulfill legal obligations or provide services.","Transaction data is pseudonymized after 6 years, while personal identifiers (e.g., ID scans) are deleted after 5 years.","Encryption: AES-256 for data at rest and TLS 1.2+ for data in transit. Two-factor authentication (2FA) is mandatory for all accounts."],"third_party_sharing":["Service Providers: Data is shared with third-party processors (e.g., cloud providers like AWS, payment networks like Visa/Mastercard) for operational purposes. All vendors are GDPR-compliant and bound by data processing agreements.","Legal Compliance: Wise may disclose data to regulators, law enforcement, or courts if required by law (e.g., anti-money laundering (AML) regulations).","Affiliates: Data is shared with Wise’s parent company and subsidiaries for cross-border service delivery, but users can opt out of marketing communications.","Third-Party Advertisers: Wise uses cookies and tracking pixels for marketing, but users can opt out via their account settings or browser preferences."],"user_rights":["Access: Users can request a copy of their personal data via the Wise app or website (Settings > Privacy > Data Request).","Rectification: Users can update personal details in their account dashboard, but ID documents require manual verification.","Erasure: Users can request data deletion, though Wise may retain transaction records for legal/regulatory compliance (e.g., 6 years for AML).","Portability: Transaction history and account details can be exported in CSV format.","Objection: Users can opt out of marketing emails and third-party data sharing for advertising purposes."],"ambiguous_or_concerning_language":["Data Retention: The policy states data is kept 'as long as necessary,' but does not define 'necessary' for different data types (e.g., transaction vs. behavioral data). This could lead to prolonged retention.","Cross-Border Transfers: While Wise mentions data transfers to the US and other regions, it does not specify which safeguards (e.g., Standard Contractual Clauses) are used for non-EU transfers.","Automated Decision-Making: The policy vaguely mentions 'automated systems' for fraud detection but does not clarify if these decisions are subject to human review or appeal.","Third-Party Risks: The policy lists vendors but does not provide a full list or risk assessments for high-risk processors (e.g., cloud providers handling sensitive financial data)."],"industry_deviations":["AML Compliance: Wise’s retention of transaction data for 6 years aligns with financial regulations but exceeds the standard 5-year requirement for most FinTech companies.","Consent Language: The policy includes broad consent language ('you agree to this Privacy Policy by using the Services'), which may not meet the strict 'freely given' standard under GDPR for some data processing activities.","Marketing Opt-Out: While Wise allows opting out of marketing, it does not explicitly mention the right to object to profiling (e.g., for credit scoring or personalized ads), which is a requirement under GDPR Article 21.","Children’s Data: The policy does not address how Wise ensures compliance with COPPA (Children’s Online Privacy Protection Act) or similar regulations, despite serving users under 18 in some regions."],"compliance_gaps":["Lack of a dedicated Data Protection Officer (DPO) contact in the policy, despite Wise’s size and regulatory obligations.","No clear timeline for responding to data subject requests (e.g., 'within 30 days' is not specified).","The policy does not mention whether Wise conducts Data Protection Impact Assessments (DPIAs) for high-risk processing activities (e.g., automated fraud detection)."],"summary":"Wise’s privacy policy is generally transparent and aligns with financial industry standards, but it contains gaps that could pose compliance risks, particularly around data retention timelines, cross-border transfers, and automated decision-making. Users should pay close attention to the 'Data Retention' and 'Third-Party Sharing' sections, as these may impact their privacy rights. Wise should consider adding more granular details on DPIAs, DPO contact, and objection rights to fully comply with GDPR and other regional regulations."}}