In the context of the services provided by Digeiz to shopping centers, this page aims to provide supplementary information about the processing of personal data and individuals’ rights thereto, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation or GDPR).
PURPOSES OF DATA PROCESSING
Digeiz (738 rue Yves Kermen, 92100 Boulogne-Billancourt, FRANCE) develops audience and traffic measurement solutions primarily for shopping centers, in order to calculate statistics on pedestrian flows, understand use of space, and improve layouts.
Digeiz and the shopping centers concerned are jointly responsible for processing data gathered by these systems.
Personal data are processed on the basis of the legitimate interest of the relevant shopping center to provide visitors with the optimal customer experience and to improve its sales performance (see article 6.1.f of the European Data Protection Regulation). Indeed, Digeiz’s system allows for the reliable and precise observation of visitor flows in order to optimize customer routes, while anonymizing any personal data collected within a very short timeframe.
CATEGORIES OF DATA PROCESSED AND DATA SUBJECTS
The Digeiz system collects data about shopping center visitors.
Personal data are collected in the form of images from which are extracted, within one second, anonymized vector characteristics for each visitor (shapes and colors observable from clothing, excluding faces). These anonymized vectors are grouped to buil statistics on visitors’ routes through the site. Once these anonymized vector characteristics have been extracted on the fly, the images are automatically erased. Thus, no images captured by the system are saved. The anonymized vector characteristics of visitors are erased once the statistics on fragments of visitors’ route are erased. Only anonymized statistics are conserved and shared with the shopping center.
Personal data are only accessible and processed by authorized Digeiz personnel. The data transmitted by Digeiz to the relevant shopping center are exclusively anonymous statistical data.
DATA RETENTION PERIOD
Images (ie. personal data) are processed within a second and erased.
RIGHTS OF INDIVIDUALS
In accordance with the applicable legal and regulatory provisions, you have the right to access, rectify, delete, limit or object to the processing of your personal data, the right to deﬁne directives relating to the conservation, deletion and sharing of your data after your death, and the right to the portability of such data.
Due to the nature of the processing carried out, Digeiz will not necessarily be able to comply with these requests. This is because the processing carried out by Digeiz is done for statistical purposes, meaning that the resulting statistics do not constitute identifiable personal data, but rather anonymous data. Digeiz’s processing thus only produces aggregate data.
In this regard, a system which analyzes the pedestrian traffic of a shopping center based on criteria such as gender and age group in order to count visitors or determine commercial lease prices for the various store operators is considered by the French national commission on information technology and liberties (CNIL) as a statistical system.
The algorithmic processing carried out by our system is therefore in line with the statistical data processing guidelines outlined in article 116 of the decree n° 2019-536 dated 29 May 2019, and thereby precludes the right to object. Based on this text, the right to object can be precluded in situations where the exercise of this right may prevent or seriously hamper the achievement of specific outcomes, and where such exemptions are necessary in order to achieve these outcomes.
The right to object can here be precluded here for two reasons. Firstly, because the exercise of this right would prevent the gathering of reliable statistical data. Secondly, because no effective objection method can in practice be implemented without forgoing all statistics-gathering and thereby compromising the aim of the processing of data.
However, Digeiz and the relevant shopping centers take very seriously any questions you may have about the processing of your personal data within this system. To exercise your rights, or if you have any questions about the processing of your data, please email us at email@example.com or contact the relevant shopping center directly.
After contacting us, if you feel that your rights have not been respected, you can file a claim with the relevant data protection authority (CNIL in France).
DATA SECURITY AND PRIVACY
The personal data collected by Digeiz are stored in a highly secure environment. In order to ensure their safety, Digeiz has implemented the following technical and organizational measures:
- Secure offices
- Access management – authorized personnel
- Access logging
- Earliest possible pseudonymization and anonymization of data
- Data processing on internal network
- No use of subcontractors
- Strong authentication policy
Digeiz employees are required to respect the confidentiality of these personal data.
Digeiz will notify the relevant shopping center of any breach of confidentiality identified within its system. As we are jointly responsible for processing, Digeiz and the shopping center will collaborate promptly in order to notify the relevant authority of any breach where necessary.