Scanned the QR code on one of our screens? This page explains, in plain words, what the cameras on AdVinci advertising totems do. In short: they count, they don’t record. The full details required by Regulation (EU) 2016/679 (GDPR) follow below.
1. In short
- The cameras are used only to count: how many people and vehicles pass the screen, how many people look at it and for how long.
- Images are analysed in a fraction of a second inside the totem and immediately overwritten. They are never recorded or sent anywhere.
- No facial recognition. We do not estimate age, gender or emotion, and we do not follow anyone from one screen to another or from one day to the next.
- We keep only anonymous statistics: numbers and times, never images.
- We don’t know who you are and have no way of finding out. For any question, write to privacy@advinci.it.
2. Controller
- Controller
- AdVinci – P.IVA 02154870436
- Address
- Loc. Parolito, 62027 San Severino Marche (MC), Italy
- E‑mail
- privacy@advinci.it
- Phone
- +39 350 525 8588
- DPO
- Matthew Kirk – privacy@advinci.it
AdVinci has designated Matthew Kirk as its Data Protection Officer (DPO). You can write to the DPO at privacy@advinci.it about anything to do with the processing of your data and the exercise of your rights.
3. Where and how it works
The system runs on AdVinci digital advertising totems. The first two are double-sided totems in San Severino Marche, on Viale Eustachio and on Viale Bigioli next to Piazza del Popolo; further screens are planned. On each screen face a sign tells you about the camera before you enter its view.
- The camera. Each screen face has a small camera mounted at the top centre, about 2 m above the ground, angled slightly down towards the area in front of the screen. There is no audio.
- Everything happens inside the totem. Images are analysed by a small computer locked inside the totem. Each frame exists only in temporary memory and is overwritten by the next one within a fraction of a second. No frame is saved or transmitted.
- What it detects. The software detects people and vehicles (cars, vans and trucks, buses, motorbikes, bicycles). To count each one only once, it gives it a temporary number while it is in view; the number is discarded about 2 seconds after it leaves the view.
- How attention is measured. The system locates faces and five reference points (eyes, nose, mouth corners) only to estimate which way the head is turned. If it is turned towards the screen (within about 30°), that moment counts as “attention”. No face template or biometric signature is created, and nothing about the face is kept.
- Vehicles. Vehicles are counted by type only. Number plates are not read and the people inside are not analysed.
4. What we keep
| Data | What it contains | Where and how long |
|---|---|---|
| Camera images | The live images | Only in the totem’s memory, overwritten within a fraction of a second. Never recorded or transmitted. |
| Temporary numbers | Position and temporary number of what is in view | In the totem’s memory, deleted about 2 seconds after leaving the view. |
| Per-minute totals | For each screen face and minute: number of pedestrians, of people who looked and of vehicles by type; average and total time in view and attention | 30 days on the totem after upload. In the cloud they are kept as anonymous statistics. |
| Visit records | For each person or vehicle: type, time of entering and leaving the view (to 0.1 s), periods facing the screen, total attention and a random code. No image, no position, no link between screens | 30 days on the totem after upload. In the cloud 13 months, then deleted automatically. |
| Ad play times | Which ad played, when and on which totem | Contain no personal data. |
Visit records contain no identifier, image or characteristic of a person. A very small risk remains that a time could be matched with other footage of the same moment, for example a third party’s CCTV. That is why we delete them after 13 months and only authorised AdVinci staff can access them.
5. Purpose and legal basis
PurposeTo produce anonymous audience statistics for our screens (how many people pass, how many look and for how long, including per ad) in order to price, sell and report advertising to advertisers. Nothing else.
Legal basisAdVinci’s legitimate interest in measuring the audience of its advertising space (art. 6(1)(f) GDPR). We have checked that this interest is not overridden by your interests or rights: images are not kept, no one is identified, profiled or followed, and no decision is taken about you. The Italian data protection authority (Garante) accepted legitimate interest, under similar conditions, for advertising screens that detect faces to measure their audience (decision of 21 December 2017, doc. web no. 7496252); our system meets those conditions and does less, as it does not estimate age, gender or emotion.
Why this is not biometric dataThe face detection we use only estimates head orientation: it does not allow or confirm the unique identification of a person. It therefore does not produce biometric data within the meaning of art. 4(14) GDPR, and no special categories of data (art. 9 GDPR) are processed.
What we don’t do- We do not use the cameras for surveillance or security.
- We do not market to individuals or show you ads based on who you are.
- We do not sell or hand over visit-level records.
- We make no automated decisions and do no profiling (art. 22 GDPR).
Any new function would require a new impact assessment and an update of this notice.
6. Recipients
- Supabase, a processor (art. 28 GDPR) that hosts our cloud database in its EU region (Frankfurt). It receives per-minute totals, visit records and ad play times. Supabase’s Data Processing Addendum includes the EU Standard Contractual Clauses, which cover any access from outside the EU.
- The mobile network operator carries the data encrypted (HTTPS) and has no access to its content.
- Advertisers and agencies receive aggregated figures only (per day, hour or ad play), never visit-level records.
- The ad player that plays the ads is not involved and receives no data: its built-in face-recognition function is disabled.
Within AdVinci, the data can be accessed only by authorised staff. The data is hosted in the European Union.
7. Your rights
To be clear: AdVinci does not and cannot know who you are. Images are not kept and the data we hold contains nothing that identifies you. For this reason, under art. 11 GDPR, the rights of access, rectification, erasure, restriction and portability (arts. 15–20) apply only if you give us additional information that allows you to be identified in the data. In practice, no record can be linked to a person.
- Right to object (art. 21). You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. Because each image is processed instantly and not kept, the simplest way not to be counted is not to stay in the area in front of the screen shown on the sign. You can still write to us and we will reply within one month.
- Contact. For questions or requests: privacy@advinci.it or +39 350 525 8588.
- Complaint. If you believe the processing infringes the GDPR, you can lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it).
8. Impact assessment
Before putting the system into service, AdVinci carried out a data protection impact assessment (DPIA, art. 35 GDPR; Garante decision no. 467 of 11 October 2018). It concludes that, with the measures in place, the residual risk to individuals is low and that prior consultation of the Garante (art. 36 GDPR) is not required. We review it at least once a year and before any change to the system.
9. Updates
Last updated: 6 October 2026. If the system changes we will update this notice and the date above.
For data collected through our website and services, see our Privacy Policy.