Data Privacy

INFORMATION ON PERSONAL DATA PROCESSING

In accordance with Regulation (EU) 2016/679 (“General Data Protection Regulation” or “GDPR”), this page provides information about how Digeiz processes personal data, as well as the rights of individuals whose data may be involved.

Digeiz, located at 738 rue Yves Kermen, 92100 Boulogne-Billancourt, FRANCE, develops and provides audience and traffic measurement solutions primarily for shopping centers, in order to calculate statistics on pedestrian flows, understand use of space, and improve visitor experience.

This notice includes:

Information about data processing conducted by Digeiz during the development of its AI-based solutions;
Information about data processing carried by shopping centers when they use Digeiz’s solutions.

1. DATA PROCESSING FOR THE DEVELOPMENT OF OUR SOLUTIONS

As part of the development of its artificial intelligence-based solutions, Digeiz, acting as the data controller, processes certain personal data contained in publicly available image datasets, including photographs captured in public spaces via CCTV systems.

SOURCE OF THE DATA

These datasets have been made available online by academic institutions and research organizations. For example, the “UPAR” dataset is one such publicly available source. Digeiz does not collect these images directly and has no relationship with the people shown in them.

PURPOSE OF PROCESSING

The images are used solely for research and development to build and improve AI solutions that provide real-time, aggregated statistics on pedestrian movements.

CATEGORIES OF PERSONAL DATA

The datasets consist solely of images. However, digeiz applies systematic pre-processing techniques to de-identify the data before any further use. No other types of personal data are processed.

LEGAL BASIS

The legal basis for this processing is Digeiz’s legitimate interest, as provided for in Article 6(1)(f) of the GDPR, namely the interest in developing an efficient, bias-minimized solution to improve foot traffic management in commercial environments.

RECIPIENTS OF THE DATA

The data is not shared with any third parties. Access is strictly limited to authorized Digeiz personnel involved in model development. No data is transferred outside the European Union.

RETENTION PERIOD

Only the de-identified data is retained, and only for the time strictly necessary to develop and evaluate DIGEIZ's systems. Original datasets are not stored.

RIGHTS OF DATA SUBJECTS

In accordance with the GDPR, individuals have the right to: access their personal data, request rectification or erasure, restrict or object to the processing, lodge a complaint with a supervisory authority.

However, due to the de-identification measures applied, DIGEIZ is not able to identify individuals in the datasets it processes. As a result, the exercise of certain rights may not be technically feasible in this context.

If you believe that your image may appear in a dataset used by DIGEIZ, you may contact us at: privacy@digeiz.com

2. DATA PROCESSING CARRIED OUT DURING THE USE OF OUR SOLUTIONS

PURPOSES OF DATA PROCESSING

When shopping centers use Digeiz’s solutions, they act as data controllers, and DIGEIZ acts as a data processor.

Personal data are processed on the basis of the legitimate interest of the relevant shopping center to provide visitors with the optimal customer experience and to improve its sales performance (see article 6.1.f of the GDPR). Indeed, Digeiz’s system allows for the reliable and precise observation of visitor flows in order to optimize customer routes, while anonymizing any personal data collected within a very short timeframe.

CATEGORIES OF DATA PROCESSED AND DATA SUBJECTS

The Digeiz system collects data about shopping center visitors. Personal data are collected in the form of images from which are extracted, within one second, anonymized vector characteristics for each visitor (shapes and colors observable from clothing, excluding faces).

These anonymized vectors are grouped to build statistics on visitors’ routes through the site. Once these anonymized vector characteristics have been extracted on the fly, the images are automatically erased.

Thus, no images captured by the system are saved. The anonymized vector characteristics of visitors are erased once the statistics on fragments of visitors’ route are erased. Only anonymized statistics are conserved and shared with the shopping center.

RECIPIENTS

Personal data are only accessible and processed by authorized Digeiz personnel. The data transmitted by Digeiz to the relevant shopping center are exclusively anonymous statistical data.

DATA RETENTION PERIOD

Captured images (ie. personal data) are processed within a second and are not stored.

RIGHTS OF INDIVIDUALS

In accordance with the applicable legal and regulatory provisions, you have the rights:

To access, rectify, delete, limit or object to the processing of your personal data,
To deﬁne directives relating to the conservation, deletion and sharing of your data after your death, and the right to the portability of such data,
To the portability of such data.

Due to the nature of the processing carried out, Digeiz will not necessarily be able to comply with these requests. This is because the processing carried out by Digeiz is done for statistical purposes, meaning that the resulting statistics do not constitute identifiable personal data, but rather anonymous data. Digeiz’s processing thus only produces aggregate data.

In this regard, a system which analyzes the pedestrian traffic of a shopping center based on criteria such as gender and age group in order to count visitors or determine commercial lease prices for the various store operators is considered by the French national commission on information technology and liberties (CNIL) as a statistical system.

The algorithmic processing carried out by our system is therefore in line with the statistical data processing guidelines outlined in article 116 of the decree n° 2019-536 dated 29 May 2019, and thereby precludes the right to object. Based on this text, the right to object can be precluded in situations where the exercise of this right may prevent or seriously hamper the achievement of specific outcomes, and where such exemptions are necessary in order to achieve these outcomes.

The right to object can here be precluded here for two reasons. Firstly, because the exercise of this right would prevent the gathering of reliable statistical data. Secondly, because no effective objection method can in practice be implemented without forgoing all statistics-gathering and thereby compromising the aim of the processing of data.

However, Digeiz and the relevant shopping centers take very seriously any questions you may have about the processing of your personal data within this system. To exercise your rights, or if you have any questions about the processing of your data, please email us at privacy@digeiz.com or contact the relevant shopping center directly.

After contacting us, if you feel that your rights have not been respected, you can file a claim with the relevant data protection authority (CNIL in France).

DATA SECURITY AND PRIVACY

The personal data collected by Digeiz are stored in a highly secure environment. In order to ensure their safety, Digeiz has implemented the following technical and organizational measures:

Secure offices
Access management – authorized personnel
Access logging
Data processing on internal network
No use of subcontractors
Strong authentication policy
Firewalls

Digeiz employees are required to respect the confidentiality of these personal data.

Digeiz will notify the relevant shopping center of any breach of confidentiality identified within its system. Digeiz and the shopping center will collaborate promptly in order to notify the relevant authority of any breach where necessary.