This is not legal advice; it is a set of practical notes from an engineer who has sat through meetings with the legal and compliance teams of dozens of customers over five years. Consult your lawyer on every project. But if you walk in with a clear architecture, the meeting takes an hour; if you don't, six weeks.
First decision: no face recognition
We made this a product decision in 2021 and never changed it. Face recognition means processing biometric data; under Turkish data-protection law (KVKK) and GDPR that is special-category personal data, explicit consent and a separate set of obligations. Retail analytics, workplace safety and production monitoring do not need faces. "How many people came in, how long did they stay, is he wearing a helmet, how close did she get to the forklift" are questions that do not require identity.
Customers ask for "recognising loyal customers". Our answer is no. That it is technically possible does not make it legally or ethically possible, and besides, no analytics metric covers the cost of a face database that leaks one day.
Where does the video go?
Nowhere. The stream is processed on the site server, the frame is decoded in memory, detection runs, the frame is discarded. No video is written to disk. What leaves is metrics and events: numbers, timestamps, rule identifiers. Showing this on the architecture diagram with arrow directions closes the legal team's first question.
Exception: some safety customers want the frame of the moment, to see the "person without helmet" alert with evidence. In that case the frame is stored, but under two conditions: faces blurred and automatic deletion after a defined period. The period follows the customer's own policy, 7–30 days. This setting is enabled at installation; the default is off.
Is anonymisation really anonymous?
A frequent and fair question. Giving a person a tracking identity means a temporary number valid until that person leaves the frame. The identity is not persistent, there is no record matched to the person, and the person is not given the same number when they come back the next day. In projects with age and gender estimation, the estimate is kept only as an aggregate: "60% of those entering in this hour were women". There is no individual record.
We give this as a written undertaking, because the word "anonymous" alone is not enough; what is collected and what is not has to be written line by line.
Notices and signage
The store or the plant already has cameras and already has a privacy notice. When analytics is added, the purpose section of the notice is updated: "statistical analysis" is added next to "security". That is the customer's own job; we provide a draft, the legal team writes the final text. For employee-facing safety analytics, the workers' representative and the occupational-safety specialist must be informed separately; in a few projects the union joined the meeting, and the sentence "no identity, no frames, only an alert" settled the matter.
Access and logging
Who accessed the server, when and why is logged. Every operation that changes a rule, draws a polygon or views an event frame is logged with the user name. This log is open to the customer. Our remote-support access is limited to the window the customer opens, over VPN, and logged in the same way.
Retention periods
| Data | Retention | Note |
|---|---|---|
| Raw video | Not stored | Processed in memory and discarded |
| Event frame (optional) | 7–30 days | Faces blurred, automatic deletion |
| Metrics (aggregate counts) | Indefinite | Contain no personal data |
| Access log | 1 year | Per customer policy |
Data for model training
Improving the model needs samples from the field. We do this under a separate clause agreed with the customer: for a defined period, from defined cameras, frames with faces blurred, for labelling and training only. If the customer does not want it, we do not take it; the model then runs on general data and field calibration takes longer. We explain that trade-off openly.
The one page we bring to the meeting
The architecture diagram (video stays on site), the list of data collected and not collected, the retention table, the access model, our role as sub-processor. When this page is ready, the legal meeting ends in an hour. When it is not, two months are lost before the project starts. In computer-vision projects the most expensive delay is not the GPU; it is compliance uncertainty.