1. Parties and Roles
The Client is the data controller for images and sales data from their locations. SYNTRANOVA AL LTD acts as the data processor, handling this data solely on the client’s behalf and according to their documented instructions.
2. Purpose of Processing
Automated analysis of footage from the client’s cameras, cross-referenced with transactions from your POS / cash register system, to detect discrepancies, send alerts, and generate reports.
3. Data Subjects and Categories of Data
- Data subjects: the client’s employees, customers and visitors captured by cameras, and individuals designated to receive alerts;
- Data: images and video clips, transaction details (products, amounts, time, register, shift), phone numbers and email addresses of alert recipients;
- We do not process special categories of data and do not use facial recognition or biometric identification.
4. Duration and Retention
Processing lasts for the duration of the contract. Images are analyzed on a device located at the client’s premises; unless an incident occurs, we do not retain them. Incident clips are kept for as long as the client decides, by default up to 30 days, except where the client chooses to retain them for a justified reason. Upon contract termination, we delete or return the data, as the client prefers.
5. Our Obligations
- We process data only according to the client’s documented instructions;
- Anyone with access to the data is bound by confidentiality;
- We implement appropriate technical and organizational measures (Art. 32 GDPR): local processing, encryption in transit, role-based access, and access logging;
- We support the client in responding to data subject requests and impact assessments;
- We notify the client without undue delay of any data security breach;
- We provide the necessary information to demonstrate compliance and allow reasonable audits.
6. Sub-processors
The client gives us general authorization to use providers in the following categories: EU-based hosting, video and language analysis technologies, communications (WhatsApp, telephony, email), and notifications. We require them to meet the same data protection obligations. A full list is available on request, and we will inform the client in advance of any changes, with the option to object.
7. Data Transfers
If a provider processes data outside the European Economic Area, transfers are made only with the safeguards required by Chapter V of the GDPR.
8. Contact
For the full DPA or any questions: legal@vigilessa.com.
Questions about this document? Write to us at legal@vigilessa.com.