Data Processing Addendum

1. Subject matter and roles

The Customer is the controller and Visentry is the processor. Processing covers the provision of camera management, face matching, event/alert records, reporting, integrations, and support for the service term. Customer instructions consist of the main agreement, configuration, and authorized support requests.

2. Data and data-subject categories

• Employees, visitors, and other individuals in camera areas.
• Authorized users, organization administrators, and support contacts.
• Images/video, face photographs and templates, match results, location, time, alert/event, and audit logs.
• If Ring is connected: device, event, authorization, and media data.

3. Visentry obligations

• Process data only on documented instructions and as required by applicable law.
• Bind authorized personnel to confidentiality and limit access by need.
• Apply technical and organizational security measures proportionate to risk.
• Provide reasonable support with data-subject requests, DPIAs and, where applicable, EU AI Act fundamental-rights impact assessments (FRIAs), and regulatory duties.
• Notify the Customer without undue delay after becoming aware of a personal-data breach.
• Not use Customer Data to train or fine-tune a shared AI model or a model serving other customers.

4. Customer legal-basis and notice duties

• Before activation, document the purpose, data minimization, retention period, and applicable legal basis for every camera, person list, face template, and use case.
• Provide accessible layered notice. Where explicit consent is required, collect it separately from the notice and any international-transfer choice, ensure it is freely given and demonstrable, and manage withdrawal records.
• Assess less intrusive alternatives for employees, children, publicly accessible spaces, and large-scale monitoring; complete a DPIA/FRIA where required and comply with local prohibitions.
• Do not use a face match as the sole basis for a legal, disciplinary, employment, or similarly significant decision; provide suitable human review and an appeal channel.

5. Subprocessors and transfer addenda

Visentry may use subprocessors necessary to provide the service and will impose equivalent data-protection duties on them. The current subprocessor name, country, service, data categories, and change notice are identified in the applicable order form or subprocessor list; the contractual prior-notice and reasoned-objection process applies to a new subprocessor.

For a GDPR-covered transfer from an EU/EEA controller to Visentry in Türkiye, absent another adequacy basis, Module 2 (Controller to Processor) of Commission Implementing Decision 2021/914 and completed Annexes I-III are incorporated into the agreement. The transfer impact assessment and necessary supplementary measures are documented. A different SCC module is selected for a different role chain.

A transfer from Türkiye to a foreign processor or subprocessor uses the official KVKK standard contract corresponding to the parties' roles and is notified within the statutory period. Restricted UK transfers use the appropriate UK Addendum or IDTA. A general reference on this page does not replace an executed transfer instrument with completed annexes.

6. Security measures

• Role-based access and workspace separation.
• Encrypted network traffic and encrypted integration tokens.
• Authenticated, permission-controlled access to media files.
• Activity/audit logs, backup, monitoring, and incident-response procedures.
• Configurable retention and secure deletion after the applicable period.

7. Return, deletion, and audit

At the end of the service, Visentry will return or delete data at the Customer's choice unless retention is legally required. Reasonable information and audit requests will be supported while protecting confidentiality and system security; scope and costs may be agreed in advance.