DAVANTIS

GDPR overview

Implementation is concrete rather than declarative. The privacy policy invokes Regulation (EU) 2016/679 and the Spanish LOPDGDD, names the controller with its tax number and registered office, and states the legal bases: performance of the contract, or consent where no contract exists. Access, rectification, erasure, objection, restriction, portability, withdrawal of consent and the right not to be subject to automated decision-making are all listed, exercised by email to info@davantis.com with an identity document, or by post. A full data processing agreement is published on the same page, naming one subprocessor — Google Cloud EMEA Limited, for hosting — and describing breach notification, audit rights and standard contractual clauses for international transfers. No data protection officer is designated, no Article 27 representative is named, which is consistent with an EU-established company, and the policy carries no effective date or version number.

Who owns the data?

The data processing agreement published alongside the privacy policy is explicit: the customer acts as data controller and DAVANTIS as processor. The material at stake is named — identifying images and video from security cameras — and DAVANTIS may process it only on the controller's documented instructions. When the contract ends, the controller can demand deletion or secure anonymisation, with evidence, or the return of all data followed by destruction of the copies. Intellectual and industrial property in the software and the hardware stays entirely with DAVANTIS. One reservation cuts across all of this: the privacy policy states that installation images may be stored and reused to improve the company's video analysis algorithms.

Reuse rights

As data controller, the customer keeps its surveillance footage and uses it for its own security purposes without asking DAVANTIS. The reverse direction is tightly restricted. The end-user licence reserves every intellectual and industrial property right in the products to DAVANTIS and forbids modifying, reproducing, creating derivative works from, distributing or publicly communicating them. It also bans decompiling, reverse engineering, deriving source code, and applying robots, scrapers, data mining or extraction methods to the products. Any commercial use of the products requires DAVANTIS's prior written consent. In the other direction, DAVANTIS grants itself a broad reuse right over customer material: images from CCTV installations running its products may be stored and used to improve its algorithms, anonymised beforehand so that, it says, no person or company can be identified.

Data retention & training

Hosting summary

The published data processing agreement names a single subprocessor: Google Cloud EMEA Limited, at Velasco Clanwilliam Place, Dublin 2, Ireland, contracted for hosting. That is the subprocessor's corporate address, not a stated data location, and the site never says in which country or region customer data actually sits. The agreement also allows transfers to third countries or international organisations that ensure an adequate level of protection, relying on the European Commission's standard contractual clauses. Declared technical measures include encrypted transmission or secure VPN, access control with a user provisioning process, logging for traceability, a pseudonymisation architecture, periodic backups with a restore protocol, and classification of all handled information as confidential. Two things are worth separating: the public website itself runs on OVH infrastructure in France, which says nothing about the product; and DFUSION /3 performs its deep-learning processing locally on the appliance or the customer's server, with only the DFUSION_Xtension service moving that processing into the cloud.