If to Navori Inc:
1000 Sherbrooke West # 710, Montreal, H3A 3G4 Canada
Attn: Privacy Officer With a copy to firstname.lastname@example.org
If to Navori SA:
Avenue Mon-Repos 22, CH-1005 Lausanne, Switzerland
Attn: Data Protection Officer With a copy to email@example.com
1. What do we consider personal data?
3. What type of personal data do we collect, and why?
The Aquaji Services collect the personal data described in the table below, which also provides you with information on the purpose of the collection. We do not sell your personal data and the Aquaji Services are designed with privacy-by-design principles. The Aquaji Services only uses degraded embeddings to aggregate data upon collection and such as to generate analytics and metrics for our clients. They can use these metrics for purposes such as performance management or improving the position of their digital signage.
The Aquaji Services analyzes the video streams inputted by clients through camera systems and similar video inputs. We do not control the video streams which are inputted by clients. Our clients are under contractual obligation to act in compliance with privacy laws and to respect privacy rights of individuals when using the Aquaji Services.
As we are the data processor, we process personal data collected on the legal bases that the data controller determines. Should you wish to obtain more information on how a client collects personal data, and on which legal basis, please contact them directly.
4. Where do we collect, use, and disclose your personal data?
We are based in Canada and Switzerland. The Aquaji Services are hosted in Germany.
We may also use third-party service providers in other countries, in which case, they will collect, use, or disclose your data in those countries.
Those countries may not have the same data protection laws as the country in which you initially provided that information. Before transferring personal data outside the European Economic Area, we ensure that adequate safeguards are in place, such as by entering into agreements with such third parties that incorporate standard contractual clauses.
5. Do we engage in profiling or automated decision-making?
The Aquaji Software allows our Clients to collect business intelligence information about visitors to their premises. Specifically, the Aquaji Software is installed in an edge device or PC. The Aquaji Software analyzes video images captured by a USB or IP camera in real-time and stores this data in RAM memory. Once the image data has been acquired, an algorithm based on a mathematical formula analyzes the data to individualize people or objects based on the video image. For example, the Aquaji Software may identify the gender and age group of a visitor and what they are looking at, and for how long. This information is aggregated to detect patterns for business intelligence, for example, to assign staff or to arrange displays based on visitor preferences. Moreover, the Aquaji Software can be used to customize programmatic add systems by triggering the most appropriate content based on the identified audience’s profile. For instance, a Client may show relevant content when a group of visitors that matches that profile walk by the sign. Navori does not make these determinations; as the data processor, we process personal data with the instructions received from our Clients
6. How do we protect your personal data?
We use reasonable organizational, technical, and administrative measures to protect information within our organization. Access to end users’ accounts is protected with multi-factor authentication, and our data centers have multiple certifications and third-party audits attesting to the security controls in place, including an end to end encryption.
The Aquaji Software has been built to incorporate privacy by design. We do not store images or video streams. Almost as soon as information is collected about specific attributes such as age and gender, personal information is anonymized and aggregated. Furthermore, in order to minimize risk exposure, we aggregate personal data as metadata in a period of minutes after its acquisition and then permanently destroy the raw data.
The Aquaji Software assigns a unique anonymous identifier to each visitor, and only recognizes visitors by his or her physical characteristics through their identifier so it’s impossible to identify a person’s name or other personal data. These aggregated demographic data sets are stored by the Client and can be analyzed according to their requirements and in compliance with relevant local legislation.
7. How long do we keep your personal data?
We retain information about end users for as long as they have an active account with us. In general, we use data minimization to reduce our retention of personal data to what is necessary for the purpose of the collection, unless we are required to keep it longer to comply with a legal obligation or in accordance with the law.
However, it should be noted that we do not store personal data that is collected by visitors through Aquaji SaaS, as data is aggregated and anonymized soon after we receive it, and the stored data cannot be used to identify an individual.
8. With which categories of recipients do we share personal data?
We do not sell your personal data. We disclose your personal data as required to provide our clients with Aquaji Services. Here are the categories of recipients with whom we share personal data:
9. How can users exercise their rights regarding their personal data?
Applicable laws contain rights that individuals can exercise over their personal data.
Depending on where you are located, different rights are granted to you over your personal data. These rights generally include the right to access and rectify personal data. In the European Union, additional rights include the rights to:
- be informed about how we process your personal data.
- request the erasure of your personal data.
- revoke your consent when our processing is based on your consent.
- object to the processing of your personal data.
- restrict the processing of your personal data.
- have automated decision-making reviewed in accordance with the law.
- the portability of your personal data.
Some of these rights may not be applicable, depending on the circumstances. If you would like to learn more about these rights, please click here for a more detailed explanation.
If you reach out to us to exercise your rights, we will respond to you within 30 days of receiving your request, or faster if required by applicable laws. In some cases, we may need additional information to validate your identity. We will only use this information for this purpose. If you do not agree with how we responded to your request, you have the right to lodge a complaint with your local authorities. To consult the list of data protection authorities by country in the European Union, please click here.
If you are located in Canada, the Officer of the Privacy Commissioner of Canada drafted this FAQ to help you access your personal information when it is held by a business. You can also contact the Office of the Privacy Commissioner of Canada’s Information Center:
9:00 am to 4:00 pm EST
Office of the Privacy Commissioner
30 Victoria Street
If you’re not satisfied with how we process your request, you can lodge a complaint with the OPC, by filling out this form.