Data Processing Agreement (DPA)

This DPA is entered into between the customer identified by the StreetProof account (“Controller”) and StreetProof (“Processor”). It forms part of the Terms of Service and applies to all processing of personal data contained in footage and derived artifacts that the Processor performs on behalf of the Controller. In case of conflict between this DPA and the Terms, this DPA prevails for data-protection matters.

The Processor processes footage only on the Controller’s documented instructions: the act of submitting footage and configuring a study constitutes the instruction to count and report. The Processor will not process footage for any other purpose, and will inform the Controller if, in its opinion, an instruction infringes the GDPR. Derived counting results (timestamps, directions, categories) are anonymous and fall outside the scope of personal data once produced.

• Confidentiality: persons authorised to process the footage are bound by confidentiality obligations.
• Purpose limitation by design: no facial recognition, no biometric categorisation, no emotion recognition — ever (fixed policy, Section 3 of the Privacy Policy).
• Assistance:the Processor assists the Controller with data-subject requests (Arts. 12–23) and with the Controller’s obligations under Arts. 32–36, taking into account the nature of the processing.
• Breach notification:the Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting the Controller’s footage, with the information required by Art. 33(3).
• Deletion and return: raw footage is deleted automatically within 30 days, immediately on request, and on deletion of a study or closure of the account. On request the Processor returns footage before deletion.
• Audits:the Processor makes available the information necessary to demonstrate compliance and allows audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, on reasonable notice and at the Controller’s expense.

• Encryption of footage at rest and in transit.
• Resolution reduction on ingest — the pipeline operates on downscaled video sufficient for silhouette counting only.
• Audio stripped on ingest and never stored.
• Automatic retention enforcement: 30-day TTL on raw video, with a “delete immediately after processing” option.
• Access controls: footage and media artifacts are reachable only via the owning account’s session or short-lived, job-bound media tokens.
• Isolation of derived data: reports and benchmarks are built from anonymous events (timestamp, direction, category), never from imagery.
• Logging and monitoring of administrative access.

The Controller grants general authorisation for the following categories of sub-processors: cloud infrastructure (hosting, storage and compute) and transactional email delivery. Footage itself is processed only on cloud infrastructure hosted in the European Economic Area by default. The Processor will inform the Controller of intended changes (additions or replacements) in advance, giving the Controller the opportunity to object, and remains fully liable for its sub-processors’ performance.

Personal data is processed in the EEA by default. Any transfer to a third country takes place only under an adequacy decision or appropriate safeguards (Standard Contractual Clauses), and the Processor will document such safeguards on request.

The Controller warrants that it has a lawful basis for the capture and submission of the footage, that required notices to data subjects are in place (a notice template is available from the Processor), and that its instructions comply with applicable law — as set out in Section 7 of the Terms.

Liability under this DPA is subject to the limitations in the Terms, except where the GDPR mandates otherwise (Art. 82). This DPA is governed by the same law and jurisdiction as the Terms.

For a countersigned copy of this DPA, the current sub-processor list, or the video-surveillance notice template, contact privacy@streetproof.app.