Legal
Data processing terms
The terms on which AKYS processes personal data on a client's behalf, meeting Article 28 GDPR. These apply when you send us your data; they do not cover imagery we capture ourselves, which is governed by our privacy policy.
This page is the standard version. For a signed agreement on your own paper, or if your procurement needs specific clauses, write to [email protected] and we will work from your template.
1. Roles
You are the controller. You decide what data is sent to us and why. AKYS is the processor and acts only on your documented instructions. Your order, statement of work or written brief is the instruction. If we think an instruction breaches GDPR, we will say so before carrying it out.
2. What we process for you
| Subject matter | Anonymisation, annotation, measurement and processing of imagery, video and point-cloud data you supply |
|---|---|
| Duration | For the term of the engagement, plus the deletion window in section 7 |
| Nature and purpose | Automated detection and blurring of faces and plates; object detection and annotation; geometric measurement and reporting |
| Personal data | Images of individuals and vehicles, vehicle registration plates, and the location and time at which they were recorded |
| Data subjects | People and vehicle keepers who appear in the material you supply |
| Special categories | Not requested and not sought. Street imagery may incidentally show characteristics such as ethnicity or a visit to a place of worship; we do not detect, index or derive anything from them. |
3. Our obligations
- Instructions. We process only on your documented instructions, including on transfers, unless EU or Member State law requires otherwise — in which case we tell you first unless the law forbids it.
- Confidentiality. Everyone we allow near your data is bound to confidentiality.
- Security. We apply the measures described on the security and compliance page, as required by Article 32.
- Sub-processors. Section 4.
- Data subject requests. If someone contacts us about your data, we will not answer for you. We pass it to you without undue delay and help you respond.
- Assistance. We help you with Articles 32–36: security, breach notification, impact assessments and prior consultation, so far as the work we do for you is relevant.
- Deletion or return. Section 7.
- Audit. Section 8.
4. Sub-processors
You give general authorisation for the sub-processors below. We will give you notice before adding or replacing one, and you may object on reasonable data-protection grounds.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare | Storage and delivery of working files and deliverables | EU region storage |
| Stripe | Payment processing, marketplace orders only | EU / US, Standard Contractual Clauses |
Core processing — blurring, detection and measurement — runs on AKYS hardware in Lithuania, not on third-party GPU services. Each sub-processor is bound by terms no less protective than these.
5. Transfers outside the EEA
We keep your data in the EEA unless you instruct otherwise. Where a transfer is necessary it relies on an adequacy decision or on Standard Contractual Clauses, with a transfer impact assessment where required.
6. Breaches
If we become aware of a personal data breach affecting your data, we notify you without undue delay and in any event within 48 hours — chosen so you can still meet your own 72-hour duty under Article 33. We will tell you what happened, what categories and roughly how many records are affected, what the likely consequences are, and what we are doing about it, and we will keep you updated as we learn more.
Report a suspected incident to [email protected].
7. Return and deletion
On completion we deliver the output and delete working copies within 30 days, unless you ask us to keep them or law requires retention. We will confirm deletion in writing on request. Backups are overwritten on their normal cycle; until then they stay protected by the same controls.
8. Audit
You may verify our compliance. In practice that means: we answer a security questionnaire; we provide our documentation; and where that is genuinely not enough, we accommodate an audit on reasonable notice, during business hours, without disrupting other clients' work. We do not currently hold an ISO certificate that could stand in for an audit, and we say so rather than point you at a certificate that does not exist.
9. Liability and precedence
These terms sit alongside the main contract. Where the two conflict on the processing of personal data, these terms win. Liability is governed by the main contract.
Last updated: 2026-10-26