Data processing policy

A deployment-specific framework

This policy describes the principles applying to Videtics’ video analytics services. It supplements website information without replacing the contract, the customer’s documented instructions or the data processing agreement (DPA). Actual processing depends on enabled features and the selected architecture.

Customer and Videtics responsibilities

The customer generally determines purposes and essential means: cameras and zones, uses, authorised users, retention and recipients. It therefore acts as controller. It checks the legal basis for each use, any required authorisations and informs people being filmed. Availability of a feature does not constitute legal authorisation to use it.

When processing personal data on a customer’s behalf, Videtics acts as processor, following documented instructions and the DPA under Article 28 GDPR. For its own contacts, contracts, invoices and support management, Videtics acts as controller.

Data and purposes

Depending on the project, Perception analyses video streams and produces counts, events, alerts, positions, trajectories, occupancy indicators or search results. Images, clips, metadata and technical logs may also be processed. Data subjects may include visitors, passers-by, employees or others present in covered areas.

Uses may include security, event search, counting and flow analysis. The customer must define a specific, necessary and proportionate purpose for each. An aggregate count may be anonymous; an image, trajectory or tracking identifier can remain personal data if someone is identifiable, including indirectly.

Minimisation and anonymisation

Perception does not perform facial recognition intended to identify a person. Face, body or licence-plate blurring, when enabled and appropriate to the scenario, reduces data exposure. Effectiveness must be checked under real site conditions. Blurring alone does not guarantee that all resulting data is anonymous.

Configuration should be limited to the zones, data categories, access and retention needed for the purpose. Use of aggregated and anonymised data to improve products is governed by the contract and must not allow a customer or person to be identified directly or indirectly.

Processing locations and integrations

Analysis can run on site, on a server or embedded device, or in a cloud environment agreed with the customer. VMS, supervision and Technis Spaces connections are defined by the project. The contract specifies exchanged data: indicators, alerts, metadata and, where necessary and authorised, images or clips.

Hosting, remote support access and sub-processors must be identified in contractual documentation. Transfers outside the European Economic Area require GDPR Chapter V safeguards. A European location alone does not exclude all access from third countries.

Security, incidents and retention

Measures must match the risk: restricted permissions, secure maintenance access, traceability, updates and incident procedures. The customer manages security of its environment and backups under its responsibility. The DPA details agreed measures and assistance.

If data processed on its behalf is breached, Videtics informs the customer without undue delay. The controller assesses required notifications, including to the supervisory authority within 72 hours where GDPR requires it, and to individuals in case of high risk.

There is no single retention period for all deployments. The customer sets limited periods justified by purpose, law and applicable guidance. The DPA provides for return or deletion at the end of services and treatment of backups, subject to statutory retention requirements.

Impact assessment and rights

A data protection impact assessment (DPIA) is required where processing is likely to result in high risk, including large-scale systematic monitoring of a publicly accessible area. The controller performs it before commissioning, with Videtics’ assistance as agreed in the contract.

If filmed at an equipped site, address rights requests to the controller identified on site signage. Videtics assists under the DPA. For data controlled by Videtics or help identifying the appropriate contact, write to: Alexandre Reboul — alexandre.reboul@technis.com

Your rights and remedies in our privacy policy