Legal

Data Processing Addendum (DPA): AI Analytics

Effective Date: January 2026

1. Scope and Purpose

This Addendum applies to the processing of data via the Hexa AI Sensor technology integrated into Clever Posters’ Premium and Enterprise Tiers. It clarifies the roles of Clever Posters as the Data Processor and the Customer as the Data Controller.

2. Privacy-by-Design: "At the Edge" Processing

To minimise risk and ensure maximum privacy, the Hexa AI solution operates under a Privacy-First architecture:

• Local Processing: All face detection and audience analysis are performed locally on the hardware device (at the Edge).
• No Image Retention: No raw images, video feeds, or Personally Identifiable Information (PII) are stored, retained, or transmitted to the cloud.
• Immediate Anonymisation: Data is transformed into anonymous mathematical vectors instantly, ensuring no individual can be re-identified

3. Nature of Data Processed

The Customer acknowledges that Clever Posters processes only Aggregated Anonymized Metrics. These include:

• Foot Traffic Statistics: Total volume of individuals passing the sensor.
• Verified Impressions: "Total Looks" or individuals who looked at the screen.
• Dwell Time: The duration of sustained attention on the content.
• Demographic Estimates: Anonymized age ranges and gender categories for audience segmentation

4. Customer (Data Controller) Obligations

As the Data Controller, the Customer is responsible for legal compliance at the physical point of capture:

• Transparency: Customers must ensure that appropriate signage or "Privacy Notices" are visible to the public, informing them that anonymous audience measurement technology is in use.
• Legal Basis: Customers must establish a valid legal basis for processing (e.g., Legitimate Interest for business analytics) under Article 6 of the UK GDPR.

5. Clever Posters (Data Processor) Obligations

• Data Security: We maintain strict technical and organizational measures to protect the cloud dashboard where aggregated metrics are stored.
• Audit Rights: We will provide the Customer with necessary documentation to demonstrate the privacy-safe nature of the "Edge AI" processing.
• Sub-processors: You authorize the use of Hexa AI as a specialized sub-processor for the delivery of these analytics.

6. International Data Transfers

While AI analysis happens locally, aggregated metrics are hosted on Google Cloud infrastructure. We ensure that all such data remains within secure jurisdictions or is protected by Standard Contractual Clauses (SCCs) to maintain a high level of data protection globally