§ 1. Subject and duration
As the controller, you entrust us, as the processor, with processing personal data to the extent necessary to provide the purchased Odoardo™ services. You conclude this agreement when you order Odoardo Lens™ or Odoardo Soul™, before we begin processing. The agreement applies where you use the service in the course of your business. It does not apply where you use the service purely for personal or household purposes, and it does not cover the Odoardo Soul™ AI assistant of an Odoardo Alibi™ box or an Odoardo Art™ work. In those cases we are the controller of the guests' data.
The entrustment lasts for as long as the service is used and ends when the service ends and the entrusted data is deleted or returned.
The entrustment covers whichever of the Odoardo Lens™ and Odoardo Soul™ services you use. Each of them is described separately in the “Nature, purpose and scope of processing” section. Provisions concerning a service that was not purchased do not apply.
§ 2. Nature, purpose and scope of processing
We process video recorded by the guests of your space, including their image, voice and what they say, the first name or name they give, an identifier stored in the guest's browser, and a record of the statement the guest makes before recording and of their separate consent to your brand using the film — in its exact wording, with the date it was made and the date the consent was withdrawn. When a video postcard is played, we process a cryptographic digest computed with our key from the viewer's IP address and browser, together with the date, the class of device and the page language, and the digest is removed after 400 days. The IP addresses of guests and viewers also reach our technical logs, kept on the terms of the “Technical data” clause of the privacy policy. Purpose: recording, storing and making available a video postcard, evidencing the guest's statements and counting its plays. Categories of people: guests using the Odoardo Lens™ recording scenario in your space and people viewing the video postcard. The retention periods set in the “Retention” clause of the Odoardo Lens™ Terms form part of your documented instruction. We assemble the video postcard in our own infrastructure. A provider we might use for the montage in future would be announced under the “Changing a sub-processor” clause.
We process the content of conversations guests hold with your object or space and a record of every touch of a phone to the object — the date, the page language and the browser identifier. If a guest does not choose, on the object's page, to have their phone remembered, the conversation lasts only in the open browser tab and the object does not recognise them on a later visit. If they choose it, we store an identifier in the phone's browser by which Odoardo Soul™ recognises the same phone on a later visit, and we process the guest's first name if they give one and a summary of earlier conversations. If a guest asks the staff of your place for something, the assistant passes the request by e-mail to the service address you designate, quoting the guest's words. From the guests' questions of the day a language model derives one sentence about what kept coming up, without describing any individual, and the assistant may quote it to other guests. We also process the knowledge documents you give us, which may contain data of your employees or associates. Purpose: holding and continuing the conversation, passing a guest's request to the staff and answering on the basis of your knowledge. Categories of people: guests who brought a phone to your object, and people named in your knowledge documents. A guest can erase at any time what the object remembers about their phone — the first name and the summary of earlier conversations — with the “Forget me” button on the object's page. The retention periods form part of your documented instruction: conversation content is anonymised at the latest 24 months after the last message, what the object remembers about a phone is anonymised after a year without another visit, the browser identifier is removed from the records of phone touches after 400 days, the sentence of the day is removed after 90 days, and guests' data and the knowledge documents are anonymised 90 days after the service ends.
We do not use entrusted data for our own purposes. In particular, we build no marketing profiles from it. Entrusted data is not used to train models — neither ours nor our sub-processors'.
§ 3. Your duties and rights
You are responsible for there being a legal basis for processing the entrusted data, and for meeting the information duty towards data subjects — in particular towards the guests of your space. You declare that the data you entrust to us was collected lawfully.
You may at any time give an instruction concerning the processing — including a demand that particular data be deleted — and we carry it out without undue delay, unless a legal obligation binding on us prevents it.
Through the Odoardo™ services you do not entrust to us special categories of data within the meaning of Article 9 of Regulation 2016/679, or data relating to criminal convictions. The services are not intended for that and we do not apply to them the measures such data requires. In particular, you do not place Odoardo Lens™ welcome cards or frame anchors where a recording would reveal a guest's state of health, on the terms of the “Recording places and health data” clause of the Odoardo Lens™ Terms, and the knowledge of the Odoardo Soul™ AI assistant contains no data concerning health.
§ 4. Our duties
We process the data solely on your documented instruction, which is this agreement, your use of the service and the settings you choose in Odoardo ID™. We bind everyone given access to the data to confidentiality. We apply technical and organisational measures matching the risk: encryption in transit (TLS), encryption at rest in the managed PostgreSQL database and in DigitalOcean Spaces file storage, private file storage accessible only after authorisation, access control with two-factor sign-in to the administration panel, backups and operation logging.
We do not transfer the entrusted data to a third country or to an international organisation without your instruction, unless required to do so by European Union or Polish law. In that case we inform you of that requirement before processing, unless the law prohibits it on important grounds of public interest. Data passed to the sub-processors established in the United States that you authorise in the “Sub-processors” section (DigitalOcean LLC, Cloudflare, Twilio SendGrid and OpenAI — for users in the European Economic Area OpenAI Ireland Ltd., where the contract with that provider so provides) is transferred on the basis of the European Commission adequacy decision under the EU–US Data Privacy Framework, for certified entities, or on the basis of the standard contractual clauses adopted by the European Commission.
If, in our assessment, your instruction infringes data protection law, we inform you of it immediately.
We help you meet your duties towards data subjects — in particular, we enable you to block or delete a Odoardo Lens™ recording in Odoardo ID™.
Taking into account the nature of the processing and the information available to us, we help you meet your obligations under Articles 32 to 36 of Regulation 2016/679 — the security of processing, notification of breaches to the supervisory authority and to data subjects, data protection impact assessments and prior consultation. A data protection impact assessment, where one is required, is carried out by you as the controller — in particular where you use the service in a space connected with health care or another space in which the processing may result in a high risk to guests — and at your request we provide the information on the processing and the safeguards it needs. We notify you of a personal data breach without undue delay and no later than 48 hours after becoming aware of it, giving the information required by Article 33(3) of Regulation 2016/679 to the extent that we have it.
When the service ends we delete or anonymise the entrusted data within the periods set in the “Nature, purpose and scope of processing” section, unless you ask for the data to be returned before those periods end — we then hand it over to you before deletion. You ask for the return by e-mail to [email protected]. This does not apply to data the law requires us to keep.
§ 5. Sub-processors
You give us general authorisation to use the sub-processors listed in the “Infrastructure providers” and “The language model provider” clauses and further ones of which we inform you under the “Changing a sub-processor” clause.
We use infrastructure providers to deliver the services: DigitalOcean (application hosting, database and file storage, European Union region), Cloudflare (delivering network traffic and protecting it against attacks) and Twilio SendGrid (transactional mail, including guests' requests passed to the staff of your place).
Where the entrustment covers Odoardo Soul™, we send OpenAI: the content of a guest's conversation with the AI assistant, so that an answer can be generated, a question the guest dictates, so that the recording can be turned into text, an answer the guest wants to hear, so that it can be read aloud, excerpts of the guests' questions of the day, so that the sentence of the day can be derived, the latest exchange, so that follow-up questions can be suggested to the guest, excerpts of the conversation of a guest who chose to have their phone remembered, so that the summary by which the object recognises them on a later visit can be prepared, and your knowledge documents, so that they can be indexed. We do not store the recording of the question. The audio of an answer read aloud is kept only in the server's memory, for at most 12 hours, so that listening again does not generate it anew. The basis for the transfer to a third country is set out in the “Transfers outside the EEA” clause. Without that transfer the conversation service cannot be provided, so beginning to use Odoardo Soul™ is an instruction covering this transfer as well.
We bind sub-processors by contract — including by accepting their standard data processing agreements — to protect data at a level no lower than in this agreement. Where a sub-processor fails to fulfil its data protection obligations, we remain fully liable to you for the performance of that sub-processor's obligations (Article 28(4) of Regulation 2016/679), and the limitation set out in the “Limitation of liability” clause does not apply to that liability.
We inform you by e-mail at least 14 days in advance of an intention to change or add a sub-processor, and you may raise a reasoned objection within that time. Where an objection cannot be accommodated without losing a function of the service, you may, at no cost at all, terminate the contract for that service together with this agreement as far as it concerns that service. We may end it to that extent only with the notice period set out in the “Termination by the Operator” clause of the General Terms.
§ 7. Liability
Each party is liable for damage caused by processing that infringes data protection law, to the extent that it has not complied with the duties that law places on it. How we process data for which we are the controller is described in the privacy policy.
Between the parties, this agreement is subject to the limitation of liability set out in the “Liability towards business customers” clause of the General Terms, within the limits permitted by law. It does not limit either party's liability towards data subjects, nor our liability for sub-processors set out in the “Sub-processors' duties” clause. The amount of the limit is calculated from the fee for one billing period of the Odoardo Lens™ or Odoardo Soul™ service the processing concerns.
