Data Processing Agreement

Version 1.0 (draft). Part of the Terms of Service, accepted when an account is opened. English is the operative version.

This Data Processing Agreement (“DPA”) is entered into between the Customer, as controller, and ALGI AI Yazılım ve Teknoloji Limited Şirketi, as processor, and forms part of the Terms of Service. It is drafted to meet Article 28(3) of Regulation (EU) 2016/679 (“GDPR”). Where it conflicts with the Terms, this DPA prevails on matters of personal data.

1. Roles and scope

1.1 The Customer is the controller of Camera Data and Output Data. ALGI is the processor and processes personal data only on the Customer’s documented instructions, which are these Terms, the account settings and the Modules the Customer activates.

1.2 The subject matter, duration, nature and purpose of processing, the types of personal data and the categories of data subjects are set out in Annex 1.

1.3 If ALGI believes an instruction infringes the GDPR or other EU or Member State data protection law, it will inform the Customer without delay and may suspend the instruction until it is confirmed or withdrawn.

2. Processor obligations

ALGI will:

1. process personal data only for the purposes in Annex 1 and on the Customer’s instructions, including with regard to transfers to third countries;
2. ensure that staff with access to personal data are bound by confidentiality and receive data protection training;
3. implement the technical and organisational measures in Annex 2 and keep them under review;
4. engage sub-processors only under clause 4;
5. assist the Customer, taking into account the nature of the processing, in responding to data subject requests under clause 6;
6. assist the Customer with security, breach notification, data protection impact assessments and prior consultation under Articles 32 to 36 GDPR, taking into account the information available to ALGI;
7. delete or return personal data at the end of the Service under clause 8;
8. make available the information needed to demonstrate compliance and allow audits under clause 7;
9. not store Camera Data beyond the period needed to produce Output Data (Annex 1), and not use Camera Data for any purpose other than producing Output Data for the Customer, including never for training models on identifiable images of people.

3. Nature of the processing and anonymisation

3.1 ALGI processes Camera Data to detect people, count their movement across counting lines and zones, and, where the Customer activates the relevant Module, to estimate an age band and gender for each detection in aggregate.

3.2 ALGI does not perform facial recognition, does not create biometric templates, does not identify individuals and does not link detections of the same person across visits or stores.

3.3 Output Data consists of counts and aggregate estimates with no identifier that can be linked to a natural person. Once Camera Data has been deleted under Annex 1, ALGI treats Output Data as anonymous data outside the scope of the GDPR. The Customer may rely on this position; if a supervisory authority takes a different view, the parties will cooperate in good faith to adjust the processing.

4. Sub-processors

4.1 The Customer gives general authorisation for ALGI to use the sub-processors in Annex 3.

4.2 ALGI will notify the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may cancel the affected Stores without penalty before the change takes effect.

4.3 ALGI will impose on each sub-processor data protection obligations no less protective than those in this DPA and remains fully liable to the Customer for the sub-processor’s performance.

5. International transfers

5.1 Camera Data and Output Data are processed and stored on servers owned and operated by ALGI in Türkiye (Annex 1). Türkiye has no adequacy decision under Article 45 GDPR. The transmission of Camera Data from the Customer’s cameras to ALGI, and any access to personal data by ALGI staff, is therefore a transfer of personal data to a third country.

5.2 For that transfer the parties enter into the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), which are incorporated into this DPA by reference, with the following selections: Clause 7 (docking clause) included; Clause 9(a) Option 2, general written authorisation with 30 days’ notice; Clause 11 optional language not included; Clause 13 as applicable to the Customer’s supervisory authority; Clause 17 Option 1, the law of Bulgaria; Clause 18, the courts of Bulgaria. Annex I of the SCCs is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by Annex 3.

5.3 ALGI confirms that it has assessed the laws and practices of Türkiye applicable to the transferred data, that it is not aware of any law or practice that would prevent it from meeting its obligations under the SCCs, and that it will inform the Customer promptly if that changes. ALGI will keep a transfer impact assessment on file and provide it to the Customer on request.

5.4 Supplementary measures: Camera Data is kept only until the day’s Output Data has been produced and is deleted within 24 hours of receipt (Annex 1); Output Data contains no identifier for any person. Camera Data is not viewed by ALGI staff except to review camera placement before the trial (Terms clause 4.3) or to resolve a support request from the Customer. Access to the processing servers is limited to named ALGI engineers, with multi-factor authentication, and is logged. ALGI will challenge any request from a public authority for the Customer’s data that it considers unlawful and will inform the Customer unless legally prohibited.

5.5 ALGI will not transfer personal data to any other third country without the Customer’s prior written instruction and an appropriate transfer mechanism.

6. Data subject requests

6.1 Because Output Data contains no identifier for any person, ALGI cannot locate data about a specific individual and will tell a data subject who contacts it directly to address their request to the Customer.

6.2 Where the Customer receives a request relating to Camera Data still held under Annex 1, ALGI will assist within 5 business days, including by deleting the relevant Camera Data on instruction.

7. Security, breaches and audits

7.1 ALGI will notify the Customer by email without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Customer’s data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken, and a contact point. Information may be provided in phases.

7.2 ALGI will keep records of its processing activities on behalf of the Customer as required by Article 30(2) GDPR.

7.3 Once in any 12-month period, and additionally following a breach, the Customer or an independent auditor bound by confidentiality may audit ALGI’s compliance with this DPA on 30 days’ written notice. ALGI will first provide written responses and available certifications and reports; an on-site or remote audit takes place only where those are reasonably insufficient, during business hours, at the Customer’s cost, and without access to other customers’ data.

8. Deletion and return

8.1 Camera Data is deleted automatically after the period in Annex 1.

8.2 On termination of the Service, or of a Store, ALGI makes Output Data available for export for 30 days and then deletes it, together with any remaining personal data, within a further 30 days, unless EU or Member State law requires retention. ALGI confirms deletion in writing on request.

9. Liability

The liability of each party under this DPA is subject to the limitations in clause 13 of the Terms, except that nothing limits either party’s liability to data subjects or supervisory authorities under Article 82 GDPR or the SCCs.

10. Term and precedence

10.1 This DPA applies from acceptance of the Terms and for as long as ALGI processes personal data on behalf of the Customer.

10.2 In the event of conflict, the order of precedence is: the SCCs, this DPA, the Terms.

Annex 1: Details of processing

Annex 2: Technical and organisational measures

Annex 3: Approved sub-processors

ALGI staff in Türkiye operate the processing servers directly under clause 5 and are not sub-processors.