Information on personal data processing

01

Use of our solutions at client sites

Who is responsible for the processing?

The organisation operating the solution at the site acts as Data Controller. It determines the purposes for which the solution is used. Digeiz acts as Data Processor on its behalf.

The site’s privacy notice identifies the responsible organisation, the functions deployed, the applicable legal basis and its contact details.

What is the solution used for?

The solution produces aggregated, anonymised statistics that help clients understand attendance and the use of their premises, improve layouts and services, manage visitor flows and measure audience and venue performance.

Depending on the functions deployed at the site, these statistics may cover:

• Visitor counts, entries, exits and pedestrian flows.
• Aggregated movement patterns, dwell times and cross-visits between areas.
• Audience composition by perceived age group and gender.
• Advertising audience and exposure measurement.
• Vehicle counts and parking occupancy.

Individual pathways used to calculate movement statistics are temporary intermediate data, deleted each day upon completion of the statistical calculation. The retained results describe aggregated patterns rather than individual journeys.

The solution does not use facial recognition or establish visitors’ civil identities. Clients receive only aggregated, anonymised statistical results.

What data is processed?

The solution analyses images from cameras installed at the site.

Depending on the functions enabled, it processes person or vehicle detections, positions and timestamps, Feature Vectors derived from clothing appearance, and estimates of perceived age group and gender. The temporary processing used to calculate movement statistics is explained in the following section.

Feature Vectors are numerical representations generated from visual characteristics such as clothing shapes and colours. They are not facial-recognition templates.

Perceived age-group and gender estimates are used to produce statistical distributions. They do not establish a person’s actual age or gender identity.

How are images transformed into anonymised statistics?

Images are analysed locally at the site and deleted from the analytics processing pipeline in less than one second, without being written to its persistent storage.

For pathway analysis, Feature Vectors are held temporarily in memory on site. These intermediate data are pseudonymised data. After site closure, the Feature Vectors are compared and grouped to construct possible visitor pathways, without establishing visitors’ civil identities.

Once the pathways have been created, parsing them and updating the statistical aggregates takes no more than one minute. This follows the preceding comparison and clustering stage.

The temporary vectors, pathways and individual-level associations are deleted upon completion of the statistical calculation each day. Only anonymised statistical results are retained and transmitted to the analytics platform.

How long is the data retained?

Images are processed for less than one second and are not written to persistent storage.

Feature Vectors generated from clothing appearance are held temporarily in memory on site for the daily statistical calculation and deleted within a maximum of 24 hours.

Individual pathways are created temporarily during this calculation. Once created, their parsing and the population of statistical aggregates take no more than one minute. The Feature Vectors, individual pathways and associated individual-level data are deleted upon completion of the calculation each day.

Only anonymised statistical results are retained.

Who can access the data?

Technical access is restricted to authorised Digeiz personnel according to their responsibilities.

Clients access only aggregated, anonymised statistical results through the analytics platform.

What is the legal basis?

For the visitor-flow measurement purposes described here, processing is based on the relevant client’s legitimate interest in understanding attendance and improving the operation, layout and services of its premises.

The site’s privacy notice explains the purposes and legal basis applicable to its deployment.

How can you exercise your rights?

For questions about processing at a particular site or to exercise your rights, please contact the Data Controller using the contact details provided in the site’s privacy notice.

Applicable rights include access, rectification, erasure, restriction and objection, subject to the conditions governing each right and the processing concerned.

The ability to fulfil an individual request depends on whether the relevant personal data still exists and can be located. Once the intermediate data has been deleted, the remaining anonymised statistics cannot be linked back to a particular person.

For processing carried out exclusively for statistical purposes, the right to object may be excluded under the applicable legal conditions, including those set out in Article 116 of French Decree No. 2019-536. The site’s privacy notice explains any restriction applicable to its processing.

02

Development of our solutions

Who is responsible for the processing?

Digeiz acts as Data Controller for the development, training, testing, evaluation and retraining of its AI models.

This processing is distinct from the production of statistics on behalf of clients.

Where does the data come from?

We use:

• Datasets made available by academic institutions and research organisations, with faces blurred during preprocessing before use.
• Selected samples from client-site cameras, with faces blurred locally before any persistent storage, used to evaluate and improve models under actual operating conditions.

All pedestrian images retained in our training and evaluation datasets have blurred faces.

Deployment-derived samples represent different cameras, viewpoints, lighting conditions, levels of occlusion and visitor density. Selection focuses on these conditions rather than on identified individuals.

People represented in the datasets may include visitors, children and staff incidentally captured by the cameras.

Why do we process this data?

We use these datasets to develop and evaluate models for person and car detection, perceived age-group and gender estimation, clothing-appearance comparison and face blurring.

The objective is to maintain accurate and reliable measurements, improve robustness across different environments, and identify and reduce model errors and biases.

Academic datasets provide useful training and evaluation material. Selected deployment images complement them by representing actual site conditions. Reference datasets also enable reproducible comparisons between successive models and checks that updates maintain satisfactory accuracy.

The data is not used to establish people’s civil identities, assess employees’ performance, target individuals or make decisions about the people represented.

What data do we process?

Depending on the model task, retained datasets contain pedestrian images with blurred faces or car images with blurred licence plates, together with the annotations and limited technical metadata necessary for training and evaluation.

These may include bounding boxes, perceived age-group and gender annotations, camera and dataset identifiers, clothing-appearance associations, and descriptors of image quality, orientation, visibility or occlusion.

We do not add names or civil identifiers, create facial-recognition templates, or cross-reference these datasets with civil identity, loyalty or payment records.

How are images protected?

For deployment-derived pedestrian images, decoding and face blurring take place locally in volatile memory before persistent storage. Unblurred source images are processed for less than one second. Retained pedestrian images are limited to selected person-centred crops with blurred faces.

Faces are blurred so that facial features are unrecognisable and their recovery through deblurring techniques prevented, including AI-based methods. The blur strength is adapted to the dimensions of each detected face.

Academic datasets are pre-processed to blur faces before use. Licence plates are blurred in car-detection datasets.

The processed dataset records remain subject to personal-data safeguards, including restricted access, controlled use and limited retention.

What is the legal basis?

The processing is based on Digeiz’s legitimate interest under Article 6(1)(f) GDPR in developing and maintaining accurate, robust and reliable models for the functions described above.

The assessment takes into account the necessity of representative data, the collection context, the interests and rights of the people represented, and the safeguards applied throughout the processing.

Who can access the data?

Access is restricted to authorised personnel according to their responsibilities. Annotation takes place under controlled access and Digeiz supervision.

Training records are not made available through client analytics dashboards. Digeiz does not transfer these datasets outside the European Union.

How long is the data retained?

Processed training and evaluation datasets are retained for up to 15 years.

For deployment-derived datasets, this period runs from the production go-live date of the site concerned. The datasets support initial accuracy assessment, subsequent model development and retraining, regression testing and reproducible comparisons across model generations.

This retention applies to the processed images, annotations and technical metadata needed for those purposes. It does not apply to unblurred deployment images, which are processed locally in volatile memory and are not written to persistent storage.

How are people informed?

This page provides public information about Digeiz’s AI-development processing.

Digeiz holds no names or contact details enabling it to send individual notices to the people represented in its datasets. Images and technical metadata do not provide a means of contacting them. We do not use facial recognition or external identity databases to identify and locate these individuals.

For indirectly obtained data, where the conditions of Article 14(5)(b) GDPR are met, Digeiz relies on the exemption from individual notification and provides this publicly accessible information.

How can you exercise your rights?

Depending on the applicable conditions, you may request access, rectification, erasure or restriction of your personal data, or object to processing based on legitimate interest.

Please contact privacy@digeiz.com.

Retained pedestrian images have blurred faces and are not associated with names or civil identifiers. We therefore cannot reliably link a dataset image to you using your name or a photograph alone. A similarity in clothing appearance does not establish that two images show the same person.

You may submit a request and provide additional information, which we will assess to determine whether the relevant data can be reliably linked to you. If we cannot establish this link, we will explain why we cannot act on particular records. In accordance with Article 11 GDPR, we do not retain or acquire additional identifying information solely to identify people for the purpose of handling such requests.

The right to data portability does not apply to this development processing because its legal basis is legitimate interest.

03

Security and confidentiality

Digeiz applies technical and organisational measures to protect personal data, including:

• Access restrictions based on roles and responsibilities.
• Strong authentication and controlled administrative access.
• Access logging and network protection.
• Encryption of transfers and backups.
• Confidentiality obligations and staff training.
• Controlled annotation and dataset access.

For production inference, local processing, short retention periods and the transmission of anonymised statistical results protect visitors throughout the processing lifecycle.

For model development, face blurring, targeted sampling and restricted use drastically limit access to and exposure of the retained data.