POLICY FOR DATA ETHICS

‍Purpose, scope, and users

This policy is based on D-seal questionnaire of data ethical considerations.

The purpose of this policy is to ensure ethical reflection and accountability when we design and use systems that process personal data. We aim to protect individual rights and avoid unintended consequences like bias or manipulation.

The scope of this policy includes all products, systems, and processes where personal or behavioral data is collected, processed, or used to influence decisions or user behavior.

The users of this policy are all employees, especially those involved in product development, design, analytics, AI, customer success, and marketing.

Internal Data Ethics Work

We’ve made data ethics and security a cultural pillar, with transparency as our main focus. We engage in open communication, provide user alternatives, and encourage internal discussion across departments.

Stakeholder Involvement

We engage universities, cybersecurity experts, and legal advisors to review our solutions quarterly. We consult our GDPR/AI legal team to stay ahead of regulatory changes.

Influence on User Behavior

We prioritize transparency and informed choice. An onboarding manager trains staff and users on system use and alternatives to facial scanning.

User Control and Transparency

We’re redesigning our onboarding app to guide users through consent flows clearly, helping them understand when facial scanning is triggered and what data is collected.

User Rights vs Business Interests

We act as a data processor and don’t sell or misuse user data. Any data shared with clients is anonymized and aggregated.

User Value from Data

Customers can optimize staffing. We aim to improve value delivery further as part of our roadmap.

Avoiding Unintended Consequences

We use gate cameras/tablets instead of ceiling cameras to give users more control. Scanning is user-activated, and we minimize data collection. It's clearly marked where the scanning area is.

Protecting Vulnerable Groups

We configure systems to require adult supervision for children and allow extended time for users with disabilities. Customers are contractually required to use our product in a GDPR compliant way.

Limiting Restriction of Rights

There are always alternatives to face scanning (e.g., code login, support access). We’ve expanded these options to ensure inclusivity.

Avoiding Social Bias and Discrimination

We’ve made it a priority that facial recognition works equally across ethnic groups. We test for algorithmic fairness and have achieved strong performance for darker-skinned users.

Communicating Privacy-by-Design

We communicate these during onboarding and via signage.

Records or Evidence

Review and update this policy annually (corresponds to the D-seal questionnaire of data ethical considerations.).

How is this policy implemented and validated?

Employee habits

• Speak up if a feature or process seems ethically unclear or could unintentionally harm users

Recurring tasks for security roles

DPO

• Annual review of data ethics and management approval

  • Description: Coordinate completion and review of the data ethics policy

  • Frequency: Yearly

  • Security roles: DPO