- Home
- Privacy checklist
Camera analytics in your stores: 10 privacy questions to ask before you install
A checklist for retail, legal and security teams evaluating any in-store camera analytics, GoTrack included. It says what to ask and why; it is not legal advice.
The short version
Ask where the images are processed, whether any are kept, and whether anyone can be identified. A system that analyses images on a device in the store, keeps none by default, uses no face recognition and sends only product events to the cloud leaves far less personal data to govern than one that uploads video. Your legal team still decides how the processing is classified and what notices it needs.
The 10 questions
- Where are camera images processed? On a device in the store, or streamed to a cloud service? Processing on site means video does not leave the building.
- Are any images or video stored, and for how long? Ask about the default, about debug or support modes, and who can switch them on.
- Does it recognise faces or create biometric templates? Under KVKK and the GDPR, biometric data used to identify a person is a special category of personal data, with stricter conditions.
- Can it recognise the same shopper on a later visit? Recognising a returning shopper turns anonymous measurement into following individuals.
- What exactly reaches the cloud? Ask for the list of fields. Product events (product, zone, time, hold time) are a different matter from images, face crops or identifiers of shoppers.
- Where is cloud data hosted, and does it leave the country? Transfers abroad have their own rules under KVKK and the GDPR.
- Can staff areas be kept out of the analysis? Ask whether the system masks areas of the image or relies on where the cameras point.
- Who can see the data, and are changes recorded? Ask about user roles and an activity log.
- What do shoppers need to be told? Your notices should describe the analytics, not only security cameras. The retailer writes them as data controller; the vendor should supply the technical facts.
- Can we have it in writing? Ask for data flows, retention periods and the hosting region in writing before you buy, and have your data protection officer review them.
How GoTrack answers them
| Question | GoTrack |
|---|---|
| Where images are processed | On a device in the store; images are not sent to the cloud for analysis. |
| Images stored | Not by default. If debug recording is switched on, the files stay on the store device and are deleted after 30 days by default. |
| Faces and biometrics | No face recognition, no face templates, no biometric matching. |
| Returning shoppers | Not recognised. No shopper is identified across visits. |
| What reaches the cloud | Product events (product, variant, zone, camera, time, hold time, put-back) and device health. No images or video. |
| Hosting and transfers | Ask GOTONOM in writing for the hosting region and retention of cloud records before purchase. |
| Staff areas | No pixel-level masking. Analysis is limited to the shelf zones defined for each camera; cameras are aimed at the shelf and the shopping area. |
| Access | User accounts with team roles; changes in the panel are recorded in an activity log. |
| Notices | GOTONOM describes the technical behaviour; the retailer, as data controller, writes the notices. |
| In writing | Yes. We walk legal and security teams through it in detail. |
Answers that should worry you
- Video is sent to the cloud for analysis, and nobody can say where it is kept or for how long.
- The system recognises faces but is described as anonymous.
- “It’s anonymous” with no list of the fields that leave the store.
- Age or gender estimation with no written description of what is processed and kept.
Questions
Does GoTrack use face recognition?
No. There is no face recognition, no face template, no biometric matching, and no shopper is recognised across visits.
Does GoTrack record camera footage?
Not by default: each analysed frame is discarded. If debug recording is switched on, the files stay on the store device and are deleted after 30 days by default. The only image that reaches the product catalogue is one an authorised user deliberately adds as a product photo.
Does GoTrack work without processing personal data?
GoTrack does not store images, identify anyone or send personal data to the cloud, but it does process camera images in real time on the store device. How that is classified under KVKK or GDPR, and the notices it needs, is for the retailer's legal team to assess as data controller.
Can GoTrack mask staff areas and analyse only the shopping area?
There is no pixel-level privacy masking. Analysis is limited to the shelf zones defined for each camera. Today, keeping staff areas out of view means aiming the camera at the shelf and the shopping area.
Where is the data kept?
Camera images are processed on the store device and, by default, never leave the store. For the hosting region and retention of cloud records, ask GOTONOM in writing before purchase.
Send us your questions in writing.
We answer in Turkish, English or Spanish, with the technical detail your legal team needs.
or write to info@gotonom.com