GDPR Compliance Factsheet

GDPR Compliance Factsheet

Product Name: Crane Safety AI (CSAI)

Version: Version 26 SP 1

Supplier: Event Gates

Purpose: Machine safety event detection and video logging

Last Updated: 07-Jul-2025

1. Product Overview

This product uses AI-powered object detection to monitor defined zones for human presence during machine operation. Event-triggered video footage is recorded to support workplace safety and incident investigation.

2. Types of Data Processed

Data Category	Description
Video footage	Recorded only when an event (e.g., person detected) occurs
Event metadata	Timestamp, camera ID, event type
System logs	Local access logs (if enabled)

Note: No continuous surveillance, facial recognition, or identity tracking is performed by default.

3. Data Storage and Access

• All data is stored locally on the edge device.
• The system has no built-in internet connectivity.
• Access is restricted via local user management (configurable by the end user).
• Retention period is automatically calculated based on the storage space left and automatically deletes old recordings.
• A new configurable retention period setting will be released soon.

4. Supplier’s Role

Event Gates acts as a technology provider. We are not a data controller under GDPR in the context of your specific deployment. We are a data processor because we may have access to system and camera views during installation and later maintenance.

We support GDPR compliance by:

• Designing the system with privacy by design and by default (Article 25 GDPR)
• Offering customizable settings for data minimization and retention
• Providing this compliance factsheet to support your internal documentation (e.g., DPIA, privacy notices)

5. Customer’s Responsibilities under GDPR

As the entity deploying and operating the system, you are the data controller. You are responsible for:

✅ Determining the lawful basis for processing (e.g., legitimate interest for workplace safety)

✅ Informing affected individuals (e.g., employees, contractors)

✅ Defining and enforcing retention periods

✅ Conducting a Data Protection Impact Assessment (DPIA) where required

✅ Handling access requests from data subjects if applicable

6. Privacy Features

Feature	Description
Limited retention period	Recordings will be deleted based on local storage space
Local-only storage	No data sent to the cloud or external systems
User-based access control	Limit who can view/export footage
On-device privacy blurring	Optional anonymization of detected individuals

7. Disclaimers

The blur feature is based on AI detection and may not identify all individuals in all scenarios (e.g., occlusions, low visibility). Therefore, customers should not rely solely on this feature to achieve full anonymization and must treat video recordings as personal data unless otherwise verified.

8. Contact

For technical or data protection-related questions regarding the product contact us at https://osticket.eventgates.com

GDPR Compliance Checklist

A check list for deployers about Event Gates Safety AI logging features.

1. Lawful Basis

• A lawful basis for processing is documented (e.g., contract, consent, legitimate interest).
• A legitimate interest assessment (LIA) is done if that’s the basis used.

2. Transparency

• Informational notices are visible in the workplace (e.g., signage stating “AI-based video logging for safety”).
• Privacy policy clearly explains what is recorded, why, and who can access it.
• Data subjects (employees, visitors) are informed about their rights.

3. Data Minimization

• Only event-based video clips are recorded—not continuous video.
• The field of view is physically limited to necessary areas (e.g., danger zones).

4. Storage & Retention

• Videos are stored in edge devices.
• Videos and logs are automatically deleted.
• Access to video data is logged and restricted to authorized personnel only.

5. Security

• Technical and organizational measures are in place (passwords, VPNs, access logs).
• Edge devices (PCs, cameras and gateways) have firmware-level security.

6. Data Subject Rights

• Procedures exist to handle requests for:
  • Access to personal data (e.g., footage)
  • Erasure (if applicable)
  • Restriction of processing
• Data Protection Officer (DPO) contact is provided.

7. Processor/Third Party Management

• Contracts (DPAs) are in place with all vendors or processors (Event Gates, system integrators).

8. DPIA (Data Protection Impact Assessment)

• A DPIA is conducted before or during deployment.
• Risks are assessed and documented, especially regarding surveillance and AI bias.

9. Anonymization (Optional but Recommended)

• Blurring provided out of the box by default.
• If not used, justification is documented in DPIA.