Hello everyone and welcome back to the keep productive YouTube channel on today's feature. We're sitting down with Thomas Codevilla, who is at
SK&S legal and he's gonna dive into a little bit about privacy policies and how to go about navigating them for
productivity software the main reason I wanted to talk to you guys about this is because it's something that
Constantly comes up in emails
How do I navigate a privacy policy to best?
Understand it before I use an application because privacy is quite important
So being able to understand, you know what the good things and the bad things are about policy
What makes a good policy and how to go about finding out all of what this means?
Hopefully Thomas will be able to answer your questions today. Now just a legal disclaimer. This is actually just generalized advice
Thomas is giving up his own free time
So I just wanted to thank him up front and say I'm very excited for this feature
But just remember privacy and your own security is your own information. This is only advice
So do not take it as the gospel and if you guys without further ado, let's dive into the chat with Thomas Codevilla
Partner SKS were a full-service small business law firm. I specialize in data privacy and security
I used to be general counsel at Sphero which is a robotic to a company we've got
Distribution all over the world did a lot of gdpr stuff. So yeah, it started to practice and
do a lot of work with privacy policies and
Really enjoy the opportunity to get to talk with you today. Yeah, I'm very excited. I think it's gonna help a lot of people
100% and and we were just chatting before about the sort of scariness of
Starting up and all that
Obviously how long they've been rolling now just about three months. I
Think six months old
So yeah, just getting started. Yeah brilliant. Well, it's obviously something that's really a very important space right now, especially
You know all those new keywords do DPR and etc, etc
I think they're coming out of the woodwork and and people starting to understand there
They while trying to understand their data policies a bit more. So I think the first question
for you is
when people sort of struggle to understand the
Policies a lot of time. What advice do you give to those people?
Starting from the basics when you know, when they land on that privacy policy page, what should they first look out for?
Yeah, I think that
If it seems farthest because it is because most privacy policies are written in a really obscure style
originally privacy policy was written by a company so that they could do pretty much whatever they wanted with your information and
Not really have to be accountable for it that shifted
New-style privacy policies. Well, you should be looking for is a way to draw a straight line from the
information
Specifically a specific piece of information that the company collects to what they do with it who they share it with
How long they store it for how long it's secured
and the like
So the first thing you should realize I guess is that it shouldn't be hard if you find yourself having to go
What does that word mean?
And I'm not sure what this category of data is used for then that's a good indication that the company that you're dealing with
probably doesn't take your privacy seriously or is doing something that
They would rather not talk about in the open
Not to not to spread conspiracy theories
That's the first thing I look at when I look at a privacy policy is alright
Do these people care enough to explain in plain English what they're doing?
Yeah, and now I guess that's important because we don't know the like has the average user
You don't know all of the key terms the information
You just want to go in there to be you know readable for the the in layman's terms, right? Yeah. Yeah, exactly
I just think straight lines if you have a question about for example with productivity software
Is a human reading my content whatever that is. Maybe it's just my calendar. Maybe it's to-do lists
But if you can't figure that out from reading the privacy policy
Yeah that matters. You got a problem there and a good privacy policy will tell you that the line the questions that user has
Yeah, you shouldn't have follow these questions in the first place
Right, but lawyers don't think like consumers most of the time. That's it. Yeah
and when it comes to like
Big red flags when you're looking for a privacy policy
and maybe it's written in fairly simple terms or
Roughly enough for you to understand but you you you find a few things what what are the things that you should be deterred by?
I
think
actually, there's a
Software called Newton. I took a look at their privacy policy and
It's got an old-school privacy policy. What it does is it says we collect?
this information
But that it doesn't say what it does with the each piece of information
It simply says the privacy policy says we use your information generally to do all of these things
So you have no idea if they're using your email address to do all these things if they're reading your content
So that's a red flag for me because I can't figure out what they're doing with my death
And it's written in such a way that gives them the ability to say. Yeah, we told you we did this with your information
So that's a red flag
I'm just because I'm a lawyer and I'm a bit of a Penant good typos and things like that if there's no contact information
in the privacy policy
if the privacy policy is
Extremely long and not broken up or well organized. That's another red flag
if they're in the EU and they don't mention gdpr or
third-party
Service providers or things like that if they don't disclose who they use
as their party service providers
That's a red flag for me
If they don't talk about cookies or
Targeted advertising if you can't figure out whether what you give to the service is going to be used to serve you ads later
That's a red flag for me
And those are the big ones it obviously depends on
the company in the kind of software that's there and and in those sort of like when you're looking through that as well should
because obviously as a couple of accredited
Privacy organizations out there what they're different to wherever you were but wherever you are in the world
But should you be looking out for those sort of organizations their support privacy policy?
Yeah, if if somebody at least makes the effort to get certified or if for example in the US
We have something called privacy shield and if you're gonna transfer data from the EU to the u.s
Privacy shield was one of the ways that you can legally do it and still be in compliance with European privacy law
So if a company has taken the time to try to get registered under privacy shield
That's a great sign
I am wary of
People who put accolades by their privacy policy. I sometimes I think what are you trying to hide here?
It's like arguing from authority. It doesn't create a great impression
But generally you've got some really serious privacy organizations out there like for kids data. There's a student data privacy pledge
that you can take
and so
Yeah, it definitely
Classes up a privacy policy if if people are involved and know what they're doing and know that they're subject to these laws
yeah, that's a it's pretty good advice and
On the sort of topic of like sometimes in the productivity software space you see like a couple of apps that are involved
With you know, they have a couple of apps like, you know calendar app to do this tap up
You know all those thoughts but they're involved in a suite of apps and should you be looking out for?
Whether they share data between those applications, even if you're not using the other service
You should look out for that if it matters to you, but generally if a company has access to your data
It's pretty well assumed that they're going to use it to improve all of their products and services
Because you can't very well say, all right, we have product we have a calendar product here
We're not going to use anything that we learn there to improve our email product over here
it would be it would have to be a special circumstance for a company to say no this the data we have here is
completely siloed off from the rest of the company because as a practical matter
In a company, it just doesn't happen. You know the same person who's running software development for one
area in the business, you know, he's maybe the same person or like talks to the other person who develops the other application so
That's not a huge red flag for me
okay, and
And from some of the the services I I mentioned he I said Thomas a few
Some random services. It's the software services. They're in productivity space
Did any of them come up with red flags or things? That should be noted?
Yeah
so you certainly Newton todoist notion and Evernote and
As I mentioned earlier Newton's privacy policy was pretty bad. He was kind of it was old school was
Relatively comprehensive, but I wouldn't know if they're reading anything that I give them or what they're doing with it based on
My reading the privacy policy, I'm not saying I'm not trying to come down on him. Obviously. I'm sure they're a fine company
I mean it's a bit obscure
You know
I'd like to know whether the content of my emails is being used shared with third parties analyzed
I would have to assume it is
Probably part of the business model. I don't know
To do is I really liked their privacy policy. Actually. It's plain English super short. Here's what we collect
Here's what we do with each separate piece of data that we collect from you
Here's what we don't do so it actually looked really good
People love short declarative privacy policies makes them feel safe. The only thing left to do there is
Hope that it's true
Notion is pretty good. They're doing things right. They know that they're subject to the gdpr
It's better than Newton the organization of their privacy policy wasn't great, but I could still
Pretty much tell what they're doing with everything they collect
And then Evernote was a it's a unique format that they use. It's more of a question-and-answer format
But they anticipated the users questions Evernote straight-up has a section where it's a it adds the question
Do you read my content does a person read my content?
Yeah, and so that might make you feel good. The one caveat there is
Do you care whether a robot or a person reads your content if it's still being used to serve you
advertisements I
personally don't
I don't, you know, if you're monetizing me and I would prefer not to be monetized
I don't care how you do it
but some people do care because I think people find some comfort in knowing that a person isn't looking at their personal details and
Maybe a system is just picking out key terms and then using it to match them with an ad
That's that's something to think about but you know at least Evernote gives you the ability to to have that
Conversation with yourself brilliant. I was like getting like a DNA test back there like and seeing the results
What what some of the software's are good cuz like for me
I would say I'm more of a user perspective looking at these is you only get like a few red flags
You know from some of the terminologies, but that's really it. So that was I think that was really helpful for everyone
Especially those users out there who were fairly clearly some privacy policies
So thanks so much for coming on Thomas. And where can everyone find you after this video. Cool. Oh
Thanks. So thanks for having me. Yeah, so we're online at SK and s legal.com
If you have questions about privacy policies, you just want to connect my email is Co Davila
Co de VI ll a at
SK and s legal comm
Yeah, I'd be happy to hear from you because a lot of your listeners or subscribers
are probably
Either in small businesses student privacy, and those are people I'd like to get to know because I love this stuff
Lovely, if I'm next couple years with all these new laws coming into effect. Oh, yeah. Definitely. It's gonna be a big space and
And I I definitely you know, when we first chat last week, I definitely made sure
In the introduction, I pronounce your name called the Vela it was
You guys who were Italian don't necessarily look at Lu that's it yeah wear glasses as well
Thanks so much Thomas for coming on and I really look forward to the comments and everyone getting
Was savvy about privacy policies
Thanks so much for having me Francesca. Thank you. Cheers, man, Cheers
yeah, I wish I'd mentioned I just thought of something like a
Privacy policy can say whatever it wants. But if you start seeing ads based on things you've talked about
Yeah, they're tracking you
Yeah, it's like pay attention
if
Something shows up in the only way somebody would know that you were thinking about buying a boat or something
Would be the name in your calendar, you know
That's scary stuff. That's general awareness stuff
So, you know, yeah, it's more like how you can tell them company's doing something and maybe you shouldn't be doing
I'll put that in the sort of kicker that goes like you just did that. Yeah, I get that sometimes a messenger
I mean that's an obvious one in that. But yeah, yeah if it's a specific productivity software. Yeah, that's pretty useful lovely
You