Privacy and data protection

At Foot Analytics, privacy isn’t an afterthought: it’s the foundation of everything we do.

Certifications

Our security and privacy practices are independently audited and certified under two internationally recognised frameworks.

ISO 27001

ISO/IEC 27001:2022 · International standard for information security

• The leading international standard for Information Security Management Systems (ISMS), published by ISO.
• It requires systematically identifying security risks and implementing controls covering people, processes and technology.
• Certification is granted by an independent, accredited auditing body and renewed annually.
• Key areas: risk management, access control, cryptography, physical security, suppliers, incident response and business continuity.
• For our clients, it means their data is managed within a formally governed security framework that is continuously monitored.

View certificate

ENS

National Security Framework (ENS) · Royal Decree 311/2022

• Spain’s national cybersecurity framework, established by Royal Decree and regulated by the National Cryptologic Centre (CCN).
• Mandatory for Spanish public administrations and for private providers delivering digital services to the public sector.
• Key areas: security governance, operational security, personnel security, physical protection, incident management and service continuity.
• It makes Foot Analytics a trusted, compliant partner for the public sector, healthcare institutions and regulated environments in Spain.

View certificate

GDPR Compliance

Foot Analytics fully complies with the General Data Protection Regulation. Our data pipeline is designed so that the device’s original identifier is permanently removed the moment data enters the system: what we store is always an irreversible cryptographic hash.

Anonymisation at the point of receipt

As soon as a WiFi signal is detected, we immediately convert the device identifier into a unique, irreversible hash and permanently delete the original.

Anonymised records, non-re-identifiable by design

We store presence records identified by hash, not by person. This enables aggregate analysis of real-time occupancy, dwell time and routes. Behaviour is measurable; identity is not.

Retention policies tailored with the DPO

We work with each client’s Data Protection Officer to define retention windows that fit regulatory obligations and business needs. Records are deleted according to the agreed schedule.

No tracking of identifiable individuals

We measure flows and occupancy using anonymous hashes.

How it works

Our architecture enforces privacy at every stage.

1. 01

   Sensors detect presence and movement patterns within a space.

2. 02

   The device identifier is converted into a one-way cryptographic hash on arrival. The original identifier is permanently deleted: it never enters our database.

3. 03

   Only anonymised presence data and aggregate occupancy metrics are stored, available through the Dashboard and the API.

4. 04

   All records are deleted according to the schedule agreed with the client, in line with the DPO’s retention policy.

Questions?

If you have any questions about our privacy practices or would like to exercise your data rights, get in touch with our team.

Contact the team

or email us at help@footanalytics.com

CertificateOpen in new tab ↗