Privacy Notice: Situate crowd monitoring in public places
Createc Ltd (“Createc”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. We provide Situate, a crowd monitoring system designed to help organisations manage safety, security and operational performance in busy public places (for example transport hubs, public buildings and event venues). This Privacy Notice explains how personal data may be processed when Situate is deployed in a location you visit.
For each deployment, the organisation responsible for the site (for example, a venue operator, local authority or transport operator) will determine the purposes for which Situate is used. Depending on the deployment model, Createc may act as (a) a processor on behalf of the site operator, (b) a joint controller with the site operator (for example, where both parties jointly decide the purposes and means of processing), or (c) an independent controller for limited processing activities such as product improvement. Where Createc is a processor, the site operator is the controller and is responsible for providing local contact details and handling requests in line with UK data protection law.
Situate is designed with privacy in mind. It is not designed to identify individuals, and we do not use Situate data to try to identify you.
Individuals are represented within Situate as non-identifying points (“centroids”) and movement paths (“tracks”). This is a form of pseudonymisation (Article 4(5) UK GDPR) because the system assigns technical identifiers to track movement over short periods, without attaching names or other direct identifiers. Although this means it is highly unlikely that an individual could be identified from Situate outputs alone, we treat the data as personal data and apply UK GDPR and Data Protection Act 2018 safeguards.
This Privacy Notice (together with any other notices provided at a deployment site) sets out the basis on which data is processed when Situate is in use. Short notices and signs may be displayed at entrances and within monitored areas to alert the public and provide a route to further information.
How to contact us about this notice
If you have any questions about this Privacy Notice, please contact the organisation responsible for the site you are visiting using the contact details provided on local signage. You can also contact Createc using the details below.
Createc contact: dataprotection@createc.co.uk. Postal address: Createc Ltd, Unit A, Riverside Business Park, Wakefield Road, Cockermouth, Cumbria, CA13 0HR. Telephone: +44 (0) 1900 828112. If Createc is acting as a processor for the site operator, we will pass your request to the controller where appropriate.
2. What data are we processing?
Situate processes data about the movement of people (and, where relevant, vehicles or objects) within the sensor coverage area. The primary outputs are centroid and track data, which may include location, direction, speed, dwell time and density/flow metrics.
The sensors generate short-lived measurements of shapes and distances in the environment. This information is processed on the device (edge processing) to create the centroids and tracks. Raw measurement data is held only transiently for processing and is overwritten, and is not made available for routine access by Createc, the site operator, law enforcement agencies or other third parties.
Each person is represented in the system interface as a moving dot (centroid).
Movement tracks capture the trajectory of each centroid over time. Track data may include locations, direction, speed/velocity and dwell time. Depending on the configuration, the system may also produce aggregated statistics (for example, queue length or occupancy levels) for operational use.
3. Why are we processing this data?
Situate is used to help site operators understand crowd density and movement patterns, identify emerging congestion or safety risks, and support timely operational responses. Where agreed, data may also be used to improve and validate Situate’s performance (for example, by tuning detection thresholds and training models to recognise normal patterns and anomalies).
The lawful basis depends on the organisation acting as controller for the deployment:
Public authorities / public bodies may rely on Article 6(1)(e) UK GDPR (public task) where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
Private organisations (and Createc where it acts as controller) may rely on Article 6(1)(f) UK GDPR (legitimate interests) where the processing is necessary for safety, security and operational management, and those interests are not overridden by your rights and freedoms. We apply data minimisation and privacy-by-design measures to reduce impact on individuals.
Key safeguards include: (i) the system does not capture facial images or audio; (ii) raw sensor measurements are not stored; (iii) access to processed data is restricted to authorised users; and (iv) processed data is used for the stated purposes and is not used to attempt to identify individuals.
4. How do we store and process this data?
Situate performs edge processing in real time. Raw sensor measurements are held only briefly in device memory while processing occurs and are then overwritten. The outputs (centroids, tracks and derived statistics) may be transmitted securely to a cloud environment or on-premise platform (depending on the deployment) for visualisation, alerting and analysis.
Where data is transmitted off the device, it is protected using industry-standard encryption in transit and access is restricted to authorised users. Physical and technical measures are used to protect the sensor equipment and supporting systems against unauthorised access.
Where third-party hosting or support providers are used, they are selected and managed under appropriate contractual and security controls. If personal data is transferred outside the UK, the controller will ensure that appropriate safeguards are in place (for example, UK adequacy regulations or approved contractual clauses), in line with UK data protection law.
Roles and responsibilities (controller/processor/joint controller) and governance arrangements are agreed for each deployment, including how transparency information is provided and how requests are handled. Where there are joint controllers, there will be an arrangement setting out respective responsibilities, and key points of that arrangement will be made available on request.
Personal data is not sold. It may be shared with service providers who support hosting, maintenance and support (acting under instructions), and with relevant authorities where we are required to do so by law, or where necessary to protect vital interests.
5. How long will we store the data?
Retention periods are set by the controller for each deployment, based on the purposes for which Situate is used (for example, live monitoring, incident review, trend analysis and/or product improvement) and in line with the storage limitation principle. Data is kept no longer than necessary and is subject to periodic review and deletion. Further information about retention for a specific site should be available via local signage or on request.
6. Your data protection rights
Under UK data protection law, you have rights including the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability (in certain circumstances) and the right to object (particularly where processing is based on legitimate interests or public task). We may ask for information to help us respond to your request.
Because Situate is designed not to collect names or other direct identifiers, we may not be able to reliably locate data relating to a specific individual in response to a request. Where this limits our ability to fulfil a request, we will explain why and will respond in line with UK GDPR. You can make a request using the contact details in section 1, and we may ask for information to help us identify the relevant time and location.
If you have concerns about how your personal data is being processed, please contact the controller for the relevant deployment (see local signage) and/or Createc using the details in section 1. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
7. Automated decision-making
Situate may generate automated alerts about crowd conditions (for example, unusual congestion patterns) to help staff respond. It is not intended to make decisions about you as an individual that produce legal effects or similarly significantly affect you. Any operational response should involve human assessment by the site operator.
8. Changes and site-specific information
We may update this Privacy Notice from time to time. The most relevant information for a particular deployment (including who the controller is, the purposes and retention period) should be provided via local signage or on request.