2. of Transfer I
The application uses an API, which makes it our data processor, but we don’t know whether this is reflected in our API contract.
|
Threat |
|
|
|
You’re using a third-party service to profile your customers and, although your privacy policy states that you perform profiling, you don’t know whether your privacy policy has been updated to reflect the use of a third party. |
|
GDPR |
Chapter 2, Art 5. - (a) |
|
CCPA & CPRA |
CCPA 1798.100. General Duties of Businesses that Collect Personal Information (d) CPRA SEC. 3. Purpose and Intent. (A)(1) |
|
OECD |
Paragraph 15(a)(i) |
|
Mitigations |
|
|
| |
