The privacy policy names other vendors than the site uses

Checks

• Vendor in use but not named vendor_observed_but_not_named
• Vendor named but no longer used vendor_named_but_gone
• Transfer country not mentioned transfer_country_not_mentioned
• Policy older than newest vendor policy_older_than_newest_vendor
• Policy says no third parties policy_says_no_third_parties

Findings

• A vendor was first seen on the site after the privacy policy last changed
• The privacy policy names other vendors than the site contacts

What this relies on

The observed vendors are real; the policy was not updated when marketing added a tool.

How to verify by hand

The data protection officer's processing register.