Subject matter and nature
- Automated processing and analysis of images and business data submitted by or on behalf of the Customer, returning a Result for each Processed Item – with the use of an AI-based Tool;
- Hosting and support of the Tool under the Agreement.
Purpose
Provision of Services to the Customer in accordance with the Agreement and the Customer’s documented instructions.
Categories of Data Subjects whose Personal Data is being Processed
The Services allow the Customer to submit Personal Data, the scope of which is determined and regulated solely by the Customer, and may encompass, but is not restricted to, Personal Data about the subsequent categories of Data Subjects:
- users operated by the Customer or its clients, whose data appears on scanned receipts, documents or in related records (Items);
- persons incidentally visible in submitted (Items), in particular in images (e.g. store customers, store staff);
- personnel of the Customer and its clients using the Tool (e.g. merchandisers, field staff, API users).
Categories of Personal Data being processed
The Customer has the option to provide Personal Data to the Services, with the scope being decided and managed by the Customer alone, and may encompass, among other things, the following categories of Personal Data:
- receipt data (for example: date and time, store or POS identifier, receipt number, purchased items and amounts, payment method indicators, telephone number, cashier identifier);
- identifiers: loyalty programme member ID, user ID;
- images: shelf photos, incidental images of persons, image metadata (exif, timestamp, geolocation, device);
- user data: name or login, e-mail address, IP address (transient), API key identifier, timestamps;
- technical data: request, processing and error logs;
- results linked to the above
to the extent that the above materials/data constitute Personal Data.
Sensitive Data being processed (only if applicable)
The Customer shall not submit Sensitive Data for processing. In the event of such intention, the Customer shall inform Open Loyalty about it prior to any submission of Sensitive Data.
Location of Processing
EEA; only limited processing occurs outside the EEA (see Schedule 2)
Technical and Organizational Measures
Organisational
- Information security policy and documented risk assessment.
- Confidentiality obligations of all persons authorised to process personal data; regular data protection and security training.
- Role-based access on a need-to-know basis; access rights reviewed regularly and revoked upon change of role or departure.
- Incident response procedure, including notification of personal data breaches to the Customer without undue delay.
- Data processing agreements with subprocessors and due diligence of their security measures.
- Business continuity plan and data backups.
Technical
- Encryption of data in transit (TLS 1.2 or higher) and at rest AES-256.
- Logical separation of Customer data from the data of other customers.
- Logging of access and system events, and protected against unauthorised modification.
- Vulnerability management, security patching and penetration testing; secure software development practices.
- Customer Data, including images and Results, is stored in and AI processing is generally performed within the EEA; limited exceptions are listed in Schedule 2.
- Customer Data is not used to train or improve AI models.