Kontrol Flow privacy

Kontrol Flow can estimate the age band and gender of visitors. This feature is optional and off by default: it is enabled only after a data protection impact assessment (DPIA) carried out with the customer's DPO.

When enabled, demographic data is used only in aggregate, for example the share of visitors by age band, and is not used to identify people.

The system automatically tells staff apart from customers and excludes them from every number shown in the platform. Kontrol Flow measures customer flows, not employees' work.

The cameras may still capture staff: this is why the installation requires the steps that apply to video systems in the workplace (see Customer obligations).

Typically, the retailer using Kontrol Flow in its stores is the controller of the data collected by the cameras. Vulkano s.r.l. acts as processor under Article 28 GDPR, on the basis of a data processing agreement (DPA) signed with the customer.

The DPA sets out the customer's instructions, the security measures, any sub-processors and the assistance Vulkano gives the customer, for example with data subject requests and with the DPIA.

Detailed data for each anonymous path stays in the platform for 7 days, the time needed to calculate metrics such as waiting times and paths between areas. After that period only aggregated data remains, such as counts by hour, area and store, kept for the period agreed with the customer.

Kontrol Flow does not keep video outside the store.

• The platform is hosted in the European Union, on Hetzner infrastructure.
• Each customer organisation has its own separate space: its data is not visible to other customers.
• Access to the dashboard is limited to the users the customer invites, with different roles.
• The edge device is managed remotely by Vulkano for updates and maintenance.

As the controller, the customer remains responsible for some obligations. Vulkano supports the customer with the technical information needed.

• Inform visitors, with a clearly visible sign before the area being filmed and a full privacy notice, following the guidance of the European Data Protection Board (EDPB) and of the national supervisory authority on video surveillance.
• Assess whether a data protection impact assessment (DPIA) is needed and, if so, carry it out before going live. A DPIA is required in any case before enabling demographics.
• If the cameras may capture employees, comply with the rules on remote monitoring of workers. In Italy, Article 4 of Law 300/1970 (Workers' Statute) requires, for audiovisual systems, an agreement with the trade union representatives or, failing that, an authorisation from the Labour Inspectorate. This applies even though Kontrol Flow excludes staff from the counts.
• Handle data subject requests, with the assistance from Vulkano provided for in the DPA.

This guidance is meant as support and does not replace the assessment of the customer's DPO or legal advisers.

For questions about how data is processed in Kontrol Flow, or to request documentation for your DPO, write to privacy@vulkano.ai.