GDPR अनुपालन परीक्षक

इनपुट

डेटा प्रक्रियाएं / गोपनीयता नीति

We collect user email, name, and usage analytics. Data is stored on AWS Frankfurt. We use Stripe for payments and Intercom for support chat. No explicit cookie consent banner yet; privacy policy mentions data is 'kept securely' but no retention period or DPO contact. Users can delete accounts by emailing support.

व्यवसाय प्रकार

SaaS / वेब एप्लिकेशन

जाँच प्रकार

त्वरित अनुपालन स्कोर

आउटपुट (अंश)

GDPR Quick Check — 3 critical gaps found. 1) Missing lawful basis statement: specify consent/legitimate interest per processing purpose (Art. 6). 2) No cookie consent mechanism despite analytics — add a banner with granular opt-in (ePrivacy). 3) Data retention undefined: state how long data is kept (Art. 5). Strengths: EU data residency (Frankfurt) and a self-service deletion path support data subject rights. Recommended next: appoint/identify a DPO contact and add a Records of Processing entry.

इनपुट

डेटा प्रक्रियाएं / गोपनीयता नीति

Privacy policy: 'We collect your name, address, payment, and browsing data to fulfil orders and improve our store. We share data with shipping and payment partners. We may send marketing emails. Contact us with questions.' Built on Shopify, sells across the EU.

व्यवसाय प्रकार

ई-कॉमर्स

जाँच प्रकार

गोपनीयता नीति की समीक्षा

आउटपुट (अंश)

Privacy Policy Review. Coverage: moderate. Present: data categories, purposes, third-party sharing. Missing for GDPR compliance: (1) named legal basis for each purpose; (2) explicit list of recipients/processors and any non-EU transfers with safeguards; (3) data subject rights (access, erasure, portability, objection) and how to exercise them; (4) marketing opt-in/withdrawal mechanism; (5) retention periods; (6) identity and contact of the data controller. Add these sections to reach compliance.

इनपुट

डेटा प्रक्रियाएं / गोपनीयता नीति

We run paid ad campaigns and email marketing for clients. We import client customer lists into our CRM (HubSpot), build lookalike audiences in Meta Ads, and use cookie-based retargeting pixels on client sites. We store lead data indefinitely and sometimes reuse lists across clients.

व्यवसाय प्रकार

मार्केटिंग / एजेंसी

जाँच प्रकार

पूर्ण अनुपालन ऑडिट

आउटपुट (अंश)

Full GDPR Audit — high risk. Critical: reusing client lists across accounts likely violates purpose limitation and lawful basis (Art. 5, 6) — each dataset needs documented consent or contract scope. Indefinite retention breaches storage limitation; define retention schedules. Lookalike/retargeting pixels require valid consent and a controller-processor DPA with each client. Action items: sign DPAs, implement per-client data segregation, add consent records, and create a deletion workflow. Compliance score: 38/100.