{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.1.0","mappingVersion":"2026-07-29.1","changeId":"1c0fa075-7975-4cd2-a17d-1cc2c2cc8034","screeningDate":"2026-10-23T11:43:31.564Z","publicationGate":"published","company":{"id":"eaf6c865-63a3-4c4f-bd2b-00eb6d0071d5","name":"Wise","slug":"wise","industry":"FinTech"},"policy":{"id":"4cb8eff5-72ef-440c-b9a6-b614a2e47ae0","name":"Business Privacy Notice","type":"privacy","jurisdiction":"Global","sourceUrl":"https://wise.com/gb/legal/privacy-notice-business-en"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-23T11:43:31.549Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"97ed5ee26356257ed5d3bd1924e4afb1bf64e4a42c67f032e22b837f0f2c5f75","capturedAt":"2026-10-02T04:58:05.095Z"},"current":{"version":2,"sha256":"2f41fc88c0b501d6ebc884c38dc6cc2bc8daf2b05c647e4c66b095cd734862b5","capturedAt":"2026-10-23T11:43:31.549Z"}},"analysisLineage":{"status":"verified","requestSha256":"8178df1ae3fffcd8278abeb728ff8587dcf4a7e48095ddc5dedff46a11de8347","responseSha256":"bb07f289976b0d49d43295992a49e5b1d06ca89d8d41f81988df688af6b6abad","model":"gemini-2.5-flash","promptVersion":"policy-analysis.v3-full-document","schemaVersion":"policy-analysis.schema.v2","inputCoverage":"complete","semanticCoverage":"not_measured","documents":{"old":{"sha256":"97ed5ee26356257ed5d3bd1924e4afb1bf64e4a42c67f032e22b837f0f2c5f75","charLength":57002,"byteLength":57210,"rangeUnit":"utf16-code-unit","includedRanges":[[0,57002]],"excludedRanges":[]},"new":{"sha256":"2f41fc88c0b501d6ebc884c38dc6cc2bc8daf2b05c647e4c66b095cd734862b5","charLength":57002,"byteLength":57210,"rangeUnit":"utf16-code-unit","includedRanges":[[0,57002]],"excludedRanges":[]}},"boundary":"Hash verification links retained inputs and the application SDK request. It does not prove provider execution, semantic completeness or legal correctness."},"captureLineage":{"old":{"provenance":"unknown","sourceUrl":null,"requestedUrl":null,"finalUrl":null,"capturedAt":"2026-10-02T04:58:05.095Z","urlDisclosure":"credentials-query-fragment-redacted"},"current":{"provenance":"captured","sourceUrl":"https://wise.com/gb/legal/privacy-notice-business-en","requestedUrl":"https://wise.com/gb/legal/privacy-notice-business-en","finalUrl":"https://wise.com/gb/legal/privacy-notice-business-en","capturedAt":"2026-10-23T11:43:31.549Z","urlDisclosure":"credentials-query-fragment-redacted"}},"assessment":{"summary":"The Wise Business Privacy Notice has no material changes, maintaining existing data collection, sharing, and automated decision-making practices.","overallRisk":"High","overallScore":7,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"warning","textEn":"Extensive collection of sensitive data like biometrics and precise geolocation.","textIt":"Vasta raccolta di dati sensibili come biometrici e geolocalizzazione precisa.","deltaScore":0,"evidenceQuote":"In some jurisdictions we will also collect facial scan data extracted from your photo or video (known as ‘biometric data’).","evidenceSide":"old","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Broad sharing of personal data with numerous third parties for various purposes.","textIt":"Ampia condivisione di dati personali con numerose terze parti per vari scopi.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"},{"icon":"alert","textEn":"Reliance on automated decision-making for critical functions, with review options.","textIt":"Affidamento a decisioni automatizzate per funzioni critiche, con opzioni di revisione.","deltaScore":0,"evidenceQuote":"These processes may make an automated decision to reject your application or a proposed transaction, to block a suspicious attempt to log into your Wise account, or to close your account. If this happens, you will be notified and offered th","evidenceSide":"old","relatedKpi":"kpiAutomatedDecision","anchorStatus":"verified"}],"keyPoints":[{"textEn":"No material changes were introduced in this policy update, ensuring continuity in privacy practices.","textIt":"Nessuna modifica sostanziale è stata introdotta in questo aggiornamento, garantendo continuità nelle pratiche sulla privacy.","sentiment":"neutral"},{"textEn":"Policy details extensive collection of sensitive data, including biometrics and precise geolocation.","textIt":"La politica descrive una vasta raccolta di dati sensibili, inclusi biometrici e geolocalizzazione precisa.","sentiment":"negative"},{"textEn":"Broad data sharing with various third parties, including advertising networks and fraud prevention agencies.","textIt":"Ampia condivisione dei dati con diverse terze parti, inclusi network pubblicitari e agenzie antifrode.","sentiment":"negative"},{"textEn":"Automated decision-making is used for identity verification, fraud prevention, and account management.","textIt":"Le decisioni automatizzate sono utilizzate per la verifica dell'identità, la prevenzione delle frodi e la gestione dell'account.","sentiment":"negative"},{"textEn":"Users retain rights to access, correct, delete data, and request human review of automated decisions.","textIt":"Gli utenti mantengono i diritti di accesso, correzione, cancellazione dei dati e revisione umana delle decisioni automatizzate.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses using Wise must ensure their own data provision to Wise aligns with GDPR, especially when sharing data of Authorised Users. Cross-border transfers are managed via SCCs and UK Addendum.","complianceNoteEn":"GDPR Articles 28, 46"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The policy's extensive data collection, including biometrics, requires explicit consent under GDPR. Automated decision-making with significant impact also triggers specific rights for individuals.","complianceNoteEn":"GDPR Articles 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global businesses using Wise must navigate complex data transfer mechanisms and ensure their internal compliance programs account for Wise's broad data processing activities across jurisdictions.","complianceNoteEn":"International Transfers"},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Individuals globally face extensive data collection and automated decisions, but Wise commits to local data protection laws. The policy's global scope means varying rights based on residency.","complianceNoteEn":"Global Data Protection"},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses should be aware of data sharing with Amazon and other third parties, ensuring their internal policies align with Wise's practices and relevant US state privacy laws.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"California residents have CCPA rights, including data access, deletion, and correction, though Wise states it does not sell personal information. Other state laws may offer varying protections.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Certified"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Certified"}]}]},"humanReviewQuestions":["Does the original Business Privacy Notice source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/1c0fa075-7975-4cd2-a17d-1cc2c2cc8034","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"34f2447c71b15b48614dbbeab5eb7b0a6233818f2ee5955eaecf60f1737bce24"}