Privacy policy

1. Controller

The controller for the processing of personal data on this website is [FIRMENNAME] [RECHTSFORM], [STRASSE UND HAUSNUMMER], L-[PLZ] [ORT]. Email: [E-MAIL].

2. Demo requests

When you request a demo, we process your name, the name and address of your shop, your phone number and your email address.

The purpose is to handle your request and to get in touch with you. The legal basis is Article 6(1)(b) GDPR (pre-contractual measures).

We delete these details once the request has been dealt with, at the latest after [PERIOD].

3. Server logs

When you visit this website, the server stores technically necessary data such as your IP address, the time and the page visited. This serves security and troubleshooting. The legal basis is Article 6(1)(f) GDPR. The logs are deleted after [PERIOD].

4. Cookies and fonts

This website uses no tracking or advertising cookies. The admin portal uses a technically necessary login cookie.

The IBM Plex Sans font is loaded from our own server. There is no connection to Google or other third parties.

5. The Vigila service

For shops that use Vigila, the rules of the contract and the data processing agreement also apply. In short:

Warnings contain no names and no information on origin, religion or health. They are deleted automatically after 30 days. We transcribe voice messages on our own server and delete them immediately afterwards. They are not passed on to anyone. There is no facial recognition, no biometric data and no matching of people between shops.

Camera and person image: shops with a Vigila box record their own cameras inside the shop. Recordings are stored encrypted on the box in the shop and deleted after 8 days at the latest. They are sent neither to our server nor to an AI service. The box only detects that a person is in the picture, where, and the approximate colour of their clothing, so the shop can search its own footage. After an incident, the shop can create an encrypted package for the police. After an offence, the shop may add an image of the person responsible to its warning, as a cut-out from the camera or as a photo taken with the tablet. It must first confirm that an offence was committed and that the person caused it. Publication, including on social media, is forbidden. Other people in the cut-out are made unrecognisable automatically. Only shops within the chosen radius see the image, watermarked with the viewing shop and without the possibility of a screenshot. Every view is logged. The image is deleted with the warning, after 30 days at the latest, and can be withdrawn by the reporting shop at any time. Legal basis: [LEGAL BASIS, e.g. legitimate interest of the shops under Art. 6(1)(f) GDPR in conjunction with Art. 10 GDPR]. Data subjects can exercise their rights with us and with the reporting shop.

To phrase reports neutrally, detect recurring methods and read receipts, we use the AI service of Anthropic, PBC (San Francisco, USA). Only the following is transferred: the text of a report before it is neutralised; for detecting recurring methods, the district, time, type, method and goods of warnings, without any description of people; receipt photos without location or camera data. This processing may take place outside the EU. Basis for the transfer: [SAFEGUARDS, e.g. EU standard contractual clauses]. Retention at Anthropic: [PERIOD].

Messages (messenger): shops can send each other text messages, individually or in a group for their district, and write to the Vigila team. We store the text, the sending shop and the time, but no photos or files. Only the shops involved can read them. The Vigila team only sees messages between shops if a shop reports a message. Messages and announcements are deleted automatically after 30 days. The content of messages is not checked; the shops that write them are responsible for it.

6. Recipients and storage location

Our servers are operated by OVH SAS (Roubaix, France) in a data centre in the European Union. All data is stored there. Transmission is encrypted (HTTPS, plus a dedicated VPN for the tablets). Processors: OVH SAS (hosting), Anthropic, PBC (AI, see section 5), [EMAIL PROVIDER] (notification of demo requests).

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent you have given at any time.

To do so, write to us at [E-MAIL].

You can also lodge a complaint with the Commission nationale pour la protection des données (CNPD): 15, Boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.