driving Retail Performance
01.12.2026
Privacy is one of the first questions retailers and mall operators raise when they evaluate people counting. Instead of relying on general promises, ask specific questions. This article lists five practical questions to put to any provider. It is not legal advice; involve your data protection officer or counsel for your situation.
Good answers do not only help with compliance. They also speed up internal approvals, because security, legal and works council representatives get the facts they need early.
Ask exactly what leaves the device. A solution that works with counts and anonymous movement data has a different risk profile from one that records or streams images. Do not accept a general statement; ask for a description of the data flow.
Find out whether images are processed on the device and discarded, or transmitted to a server. Ask what happens during installation and maintenance as well, not only in normal operation.
Request this description in writing so that it can be attached to your internal documentation.
Clarify whether the system identifies people or only produces aggregated numbers such as counts, dwell time and group size. Ask for the answer in writing, and ask what exactly is stored in the database behind the reports.
Pay attention to the difference between anonymous and identifiable data. If the provider says the data is anonymous, ask how this is ensured and whether individual tracks can be linked back to a person.
Ask how long raw and aggregated data are kept and how deletion works.
Find out which regions host the data, who can access it and how long it is retained. This matters for contracts and internal compliance reviews, especially for companies operating in several countries.
Ask whether subcontractors or cloud providers are involved and where they are located. A clear list of processors helps your legal team to review the setup.
Check how access is controlled, for example roles for store managers, regional teams and support staff.
Features such as age groups, gender estimates and staff filtering should be explained clearly: how they work, what is stored and what is only used for the calculation. These features create value, but they also raise questions.
Ask whether demographic information is estimated per visit and discarded, or stored in a way that could be linked to a person. Ask the same for staff exclusion: does the system recognize individuals, or does it work with movement patterns?
If works councils are involved in your company, early and open communication on these points saves time.
A professional provider can share data processing terms, technical descriptions and answers for your data protection team. Request them early in the project, ideally before a pilot starts.
Typical documents include a data processing agreement, a description of the system architecture and a summary of security measures. Your own legal team will tell you what else is needed.
Keep these documents together with your project file. They are useful again when auditors or new colleagues ask how the system works.
Clear answers speed up approvals and let analytics teams focus on insights instead of discussions about risk. Providers who can explain their approach in plain language are usually the ones who have thought it through.
Treat privacy as part of data quality and vendor selection, not as a hurdle at the end of the process.
Talk to our team if you would like to discuss how these questions apply to your project.
Does people counting require cameras? Many solutions use sensors that look down from above and produce counts rather than recordings. Ask your provider what the specific device does.
Is people counting data personal data? It depends on the system and the data it creates. Aggregated counts are different from identifiable data. Your data protection officer should confirm this for your setup.
When should I involve my data protection officer? As early as possible, ideally when you start comparing providers.
