{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"3f664da1-706b-446a-8c0a-1902a7a06274","screeningDate":"2026-09-23T17:18:39.510Z","publicationGate":"published","company":{"id":"142fa44a-8249-4358-b365-5e2fe4e375ef","name":"Revolut","slug":"revolut","industry":"FinTech"},"policy":{"id":"3b2b7720-1fed-44e0-9b23-56ed241de9dd","name":"Privacy Policy","type":"privacy","jurisdiction":"UK","sourceUrl":"https://www.revolut.com/legal/privacy/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-23T17:18:39.500Z","retrievalChannel":"archive","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"081254b3d739552eabb507355ad50f31976ac526df92272bdb7f66881372a139","capturedAt":"2026-07-06T07:15:18.667Z"},"current":{"version":2,"sha256":"e5f127c4f1e67ee6737e81d6ca5ff8bccb917a5dfa0355970ce894c99d4febd3","capturedAt":"2026-09-23T17:18:39.504Z"}},"assessment":{"summary":"No changes were detected between the old and new versions of Revolut's Privacy Policy, which will become effective on March 17, 2026.","overallRisk":"High","overallScore":7,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"alert","textEn":"Extensive data collection, including biometric, behavioral, and device metadata.","textIt":"Ampia raccolta dati, inclusi biometrici, comportamentali e metadati del dispositivo.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Broad third-party sharing with credit agencies, fraud prevention, and crypto partners.","textIt":"Ampia condivisione con terze parti: agenzie di credito, prevenzione frodi, partner crypto.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiThirdPartySharing","anchorStatus":"not-recorded"},{"icon":"warning","textEn":"Automated decision-making for eligibility and risk assessment is explicitly stated.","textIt":"Decisioni automatizzate per idoneità e valutazione del rischio sono esplicitamente dichiarate.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiAutomatedDecision","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Revolut collects extensive personal data, including biometric and behavioral data, for identity verification and fraud detection.","textIt":"Revolut raccoglie dati personali estesi, inclusi dati biometrici e comportamentali, per verifica identità e frodi.","sentiment":"negative"},{"textEn":"Your data is shared with many third parties like credit agencies, fraud prevention, and crypto compliance partners.","textIt":"I tuoi dati sono condivisi con molte terze parti come agenzie di credito, prevenzione frodi e partner crypto.","sentiment":"negative"},{"textEn":"The policy confirms you can manage privacy settings in-app and request data deletion via DPO.","textIt":"La politica conferma che puoi gestire le impostazioni privacy in-app e richiedere la cancellazione dati tramite DPO.","sentiment":"positive"},{"textEn":"Automated decisions are made about your eligibility and risk based on your transaction history and application details.","textIt":"Decisioni automatizzate sono prese sulla tua idoneità e rischio basate sulla cronologia transazioni e dettagli applicazione.","sentiment":"negative"},{"textEn":"Revolut promises not to sell your data and to keep it safe, aiming to give you control.","textIt":"Revolut promette di non vendere i tuoi dati e di mantenerli al sicuro, cercando di darti controllo.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Enterprises using Revolut must ensure their data processing activities align with GDPR, especially concerning employee or customer data. The broad third-party sharing requires careful due diligence.","complianceNoteEn":"GDPR Articles 28, 32"},{"region":"EU","perspective":"Individual","riskLevel":"High","impactAnalysisEn":"The extensive collection of biometric and behavioral data, coupled with automated decision-making, poses a high risk under GDPR. Users should be aware of their rights, especially regarding sensitive data processing.","complianceNoteEn":"GDPR Articles 9, 22"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Global enterprises using Revolut must navigate a complex landscape of international data protection regulations. Ensuring robust data governance and transparency in data handling is essential.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users globally face medium to high risk due to broad data collection and sharing practices. It is important to understand local privacy rights and leverage in-app controls and DPO contact for data management.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Businesses integrating with Revolut need to assess how data flows comply with various US state privacy laws. Managing consent and data sharing with third parties is crucial for compliance.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Extensive data collection, including sensitive personal information, raises concerns under state privacy laws like CCPA/CPRA. Users should utilize their opt-out rights for data sharing and targeted advertising.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Opt-Out"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Policy source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/3f664da1-706b-446a-8c0a-1902a7a06274","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"989d0225fe4493725d77ede4d2f7c88f6d339411bb2c8b99ef782f96624a6fd9"}