Legal
Privacy policy
How AKYS handles personal data: the imagery we capture on public roads, the data clients send us to process, and the little we collect from this website.
The short version. We drive public roads and record them. Faces and vehicle registration plates get blurred by our own pipeline before anything is published, shared or sold. If you appear in our imagery and want it removed, write to [email protected] and we will deal with it — you do not need a lawyer and you do not need to give a reason.
1. Who is responsible
AKYS operates under UAB AKYS, registered in Lithuania, company code 307471513, registered address Žemaitės g. 74, LT-41112 Biržai, Lithuania (VAT LT100019928014). For everything described in this policy we act as the controller, except where section 6 says otherwise.
Data protection contact: [email protected]. We have assessed whether we are required to appoint a Data Protection Officer under Article 37 GDPR; our current position is recorded at [email protected].
2. Imagery captured on public roads
Our core activity is mobile mapping: a vehicle carrying cameras and LiDAR drives public roads and records what is visible from them. People and vehicles that happen to be on those roads end up in the recording. That is personal data, and this section is the part of this policy that matters most.
What we record
360° panoramic imagery, forward and rear video, stereo imagery, LiDAR point clouds, and the position and time of each frame. We do not record audio. We do not use facial recognition, and we do not attempt to identify anyone.
Why we are allowed to do it
Our legal basis is legitimate interests, Article 6(1)(f) GDPR. The interest is operating a surveying and mapping business and producing road condition, asset inventory and digital twin deliverables that our clients — including public authorities — use to maintain infrastructure. We have carried out a balancing assessment weighing that interest against the rights of people who appear in the imagery. The blurring described below is the main safeguard that makes the balance come out the way it does. You can ask us for a summary of that assessment.
Blurring, and what it does and does not mean
Before imagery is published, delivered to a client or listed for sale, it passes through our anonymisation pipeline. Faces are detected by a face model and vehicle plates by two independent plate models; detected regions are destroyed in the output with Gaussian blur and mosaic, not merely covered. The blur is applied to the pixels and is not reversible from the published file.
We are deliberately precise here. In the delivered file, blurred faces and plates are anonymised — they cannot be recovered from it. But we retain the original unblurred capture for a period (section 4), and while we hold it the material is pseudonymised, not anonymised, and remains personal data in our hands under GDPR. We would rather say that plainly than claim more than is true. Our internal access controls for original captures are described on the security and compliance page.
No automated pipeline is perfect. If a face or plate has been missed, tell us and we will fix it — see section 7.
Where and when we drive
We publish our capture areas and dates at Street imagery notice, so that it is possible to know in advance when we will be working in an area.
3. Other data we hold
| Who | What | Why | Legal basis |
|---|---|---|---|
| People who contact us | Name, organisation, email, phone, message | To answer the enquiry and, if it leads somewhere, to quote | Art. 6(1)(f) legitimate interests; Art. 6(1)(b) if it becomes a contract |
| Marketplace customers | Email, order and licence record, payment confirmation | To sell and deliver a dataset licence and meet accounting duties | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation for invoices |
| Website visitors | See section 5 | To make the site work | Art. 6(1)(f) legitimate interests |
We never receive your card number. Card payments are handled by Stripe; we see only that a payment succeeded and the information needed to issue an invoice.
4. How long we keep things
| Material | Retention |
|---|---|
| Original, unblurred captures | Only as long as needed to produce and support the deliverable — then deleted or irreversibly blurred in place |
| Blurred, published or delivered imagery | For as long as the dataset is offered or the client licence runs |
| Removal requests and what we did about them | 3 years, so we can show the request was handled |
| Enquiries that do not become business | 12 months |
| Invoices and accounting records | 10 years (Lithuanian accounting law) |
5. This website
This site runs no analytics, no advertising tags and no third-party trackers. It stores two items in your browser:
akys_lang— which language you chose.akys_cart— what is in your marketplace basket.
Both are strictly necessary for functions you asked for, so under Article 5(3) of the ePrivacy Directive they do not require consent, which is why this site shows you no cookie banner. Neither is sent to us or to anyone else; both stay in your browser and you can clear them at any time. Our host records standard server logs, including IP address, for security and troubleshooting.
6. When we process on a client's behalf
When a client sends us their own imagery to blur, annotate or process, they remain the controller and we act as their processor. We act on their documented instructions, and the terms are set out in our data processing terms. In that arrangement this privacy policy does not govern the client's data — their own policy does.
7. Your rights, and how to actually use them
Under GDPR you can ask us for a copy of your data, ask us to correct or erase it, ask us to restrict how we use it, and object to processing based on legitimate interests — which is the basis for our street imagery.
If you appear in our imagery. Email [email protected] with roughly where and when, or a link to the frame. You do not have to explain why. We will blur or remove it, and we will tell you what we did. We aim to respond within 7 days and are required to within one month.
We may ask for enough information to find the right material, but we will not demand identity documents where they are not necessary, and we will not use anything you send us for any purpose other than handling the request.
8. Who else sees the data
| Recipient | Role | Where |
|---|---|---|
| Cloudflare | Hosting, storage and delivery of the site and datasets | EU region storage |
| Stripe | Payment processing for the marketplace | EU / US, SCCs |
| Clients | Receive the blurred deliverable they commissioned | Per contract |
We do not sell personal data. The datasets we sell are blurred imagery; the commercial product is the road and asset information in them, not people.
Where a recipient is outside the EEA, transfers rely on an adequacy decision or on Standard Contractual Clauses. You can ask us which applies to a given recipient.
9. Complaints
If you think we have handled your data badly, tell us first — [email protected] — because we would rather fix it. You also have the right to complain to the Lithuanian supervisory authority:
Valstybinė duomenų apsaugos inspekcija (VDAI), L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt, [email protected], +370 5 271 2804.
10. Changes
If we change how we handle personal data in a way that affects you, we will update this page and change the date below. Material changes to the street imagery sections will also be noted on the Street imagery notice.
Last updated: 2026-10-26