Video Analytics Privacy Notice

Effective date: 27 February 2026

Last updated: 27 February 2026

Your Privacy Matters

The Video Analytics system does not record or store footage, and no footage is available for review or playback. No one can access video footage or identifiable images, and the only outputs are anonymised aggregated statistics such as visitor and vehicle counts.

It does not perform facial recognition, biometric identification, profiling, individual tracking, or any other processing intended to identify individuals.

Introduction

This Video Analytics Privacy Notice describes how Citix BILLBOARDS ADVERTISING LLC (“Citix”, “we”, “us”) uses video analytics devices installed in certain locations in the United Arab Emirates to create anonymised statistics about how spaces are used.

This notice applies only to our video analytics technology that operates on site in real time and does not record, store or transmit any images or video of identifiable individuals.

Citix BILLBOARDS ADVERTISING LLC is the “Controller” as defined in Article 1 of Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (“UAE PDPL”), read together with Cabinet Decision No. 44 of 2023 (the “Executive Regulations”), for the processing described in this notice.

What we do

Our devices use optical sensors to observe how people and vehicles move through an area.

Processing takes place only in real time on the device. Images are used only to calculate statistics such as visitor and vehicle counts. The device does not record or store video or images and does not send video or images to Citix, to the premises operator or to any third party.

Only anonymised digital data leaves the device. This data consists of aggregated statistical metrics (such as counter values, timestamps, dwell time, and attention metrics) that do not identify any person.

The system does not perform facial recognition, biometric identification, biometric authentication, demographic estimation, profiling, or tracking of individuals. It does not analyse facial features, estimate age, gender, mood, or any other personal characteristic. It does not create biometric templates, faceprints, facial embeddings, persistent identifiers, or profiles linked to any individual.

What Data We Process

While you are in the field of view of a sensor, the device temporarily processes visual information about you in its live memory. This temporary processing of live video frames constitutes processing of personal data within the meaning of the UAE PDPL, even though no identifiable data is recorded, stored, or transmitted.

We use this information only to create aggregated, anonymised statistics about use of the space. The categories of anonymised statistical outputs produced include: visitor and vehicle counts per location and time period, dwell time and attention duration (aggregated averages), and distance estimates (aggregated). These outputs do not contain images, video, biometric templates, or any information that could identify an individual.

How We Use Anonymised Video Analytics Data

We use the video analytics data we collect to deliver secure, compliant and efficient services, while providing anonymised statistics about how spaces and Citix digital screens are used.

Specifically, we use anonymised video analytics data for understanding how many people and vehicles have passed through a monitored area within a given time period.

We do not use this system to identify or authenticate individuals, track individuals across time or locations, make decisions that have a legal effect or similarly significant impact on individuals, conduct employee evaluation or workplace monitoring, or support law enforcement surveillance or security monitoring through stored footage.

Why We Collect and Process Anonymised Video Analytics Data

We operate video analytics devices to produce anonymised statistics that help our customers understand how spaces and Citix digital screens are used.

Specifically, we collect and process personal data to support our customers in measuring the reach and performance of digital screens and billboards using aggregated, anonymised metrics.

By processing data lawfully and transparently, and by ensuring that no identifiable video is stored or transmitted, we aim to protect privacy while delivering reliable, compliant analytics services.

Legal Basis for Processing Anonymised Video Analytics Data

We process personal data based on the following lawful grounds under the UAE PDPL:

• Statistical Studies (Article 5(1) of the UAE PDPL, read with Article 12 of Cabinet Decision No. 44 of 2023 - Executive Regulations): The transient processing of live visual information is necessary to generate aggregated, anonymised statistics about how spaces are used. Processing is performed in real time on the device solely to calculate statistical outputs, and is designed so that identifiable images are not recorded, stored, or transmitted. Adequate technical and organisational safeguards are in place, and the statistical results are used only in anonymised, aggregated form.

• Legal Obligations (Article 5(1) of the UAE PDPL): Where necessary to comply with specific legal and regulatory requirements in force in the UAE, including responding to legally binding requests from competent authorities and meeting applicable data protection and security obligations.

Each processing activity is carried out in accordance with applicable privacy laws, including the UAE PDPL, and is designed to ensure transparency, proportionality, and appropriate safeguards.

We do not rely on consent for this processing in public or semi-public areas. Individuals are not required to provide information about themselves. Transparency is provided through on-site signage at monitored locations, this Privacy Notice, and a published contact channel for the Data Protection Officer.

Who Has Access to Anonymised Video Analytics Data?

No one, including Citix, can access video footage, images, or any identifiable video analytics data. Identifiable data is not stored and is not available for remote access or connection.

Only aggregated anonymised metrics, such as visitor or vehicle counts, which do not contain personal data, may be accessed by:

• Authorised Citix personnel responsible for analytics, reporting, and operations, subject to role-based access controls and the principle of least privilege.

• Trusted service providers supporting the operation, hosting, maintenance, and security of the analytics and statistics platform, including our video analytics software provider. These service providers receive only anonymised aggregated metrics and do not have access to video footage, images, or identifiable data.

• Regulatory or law enforcement authorities, where disclosure is required by a legally binding request, noting that identifiable video data is not retained by this system.

Data Breach Notification

We take security incidents seriously and have measures in place to detect, contain, and respond to them. Our video analytics system is designed to operate in real time without recording, storing, or transmitting identifiable video or other personally identifiable information. If a security incident involves personal data, we will:

• Assess the nature, scope, and potential impact of the incident.

• Contain and mitigate the incident to prevent further unauthorised access.

• Notify affected parties promptly where appropriate.

• Report the incident to the relevant regulatory authorities as required by law, within the timeframes set by the PDPL Executive Regulations.

• Provide guidance and support to affected parties, including recommended security measures.

Our response process aligns with applicable data protection requirements, including the UAE PDPL.

Information Sharing and Disclosure

Our video analytics system does not record or store video footage and does not transmit images or other identifiable data. We do not share personal data from this system with our customers or any third parties.

We may share only aggregated, anonymised statistics (for example visitor and vehicle counts) with:

• Our customers who operate the premises or digital screens, for the purpose of measuring reach and performance of digital screens and understanding space usage.

All recipients of aggregated statistics are contractually prohibited from attempting to re-identify individuals from the data.

Where we receive a legally binding request from a competent authority, we will respond as required by law, noting that identifiable video data is not retained by this system.

Transfers to Third-Party Countries

Our video analytics system is designed so that NO personal data, including images, video footage, biometric templates, or any information enabling the identification of individuals, is transferred outside the United Arab Emirates at any time.

Anonymised aggregated metrics (such as visitor counts, dwell time, and attention duration) may be transmitted via encrypted connections to a cloud platform operated by our video analytics software provider and hosted in the European Union for processing, reporting, and dashboard access. These metrics do not contain images, video frames, biometric templates, persistent personal identifiers, or any information that could, alone or in combination with other data, identify a natural person.

As a precautionary measure, if the UAE Data Office issues adequacy decisions or guidance requiring additional safeguards for transfers to the European Union, or if a future change to the system means that personal data (as defined by the UAE PDPL) would be transmitted outside the UAE, Citix will implement the required safeguards under Article 22 of the UAE PDPL and update this notice before any such transfer takes place.

How We Protect Video Analytics Data

Data Security Measures

Citix implements technical and organisational measures designed to protect the analytics outputs and any related operational data, which may include:

• Encryption for data in transit and at rest where appropriate.

• Role-based access controls and multi-factor authentication for administrative access where feasible.

• Logging and monitoring for security and troubleshooting.

• Vulnerability management and security testing.

• Incident response planning and staff awareness training.

Citix’s approach is aligned with recognised industry practices and may be informed by frameworks such as ISO/IEC 27001.

Where required, Citix evaluates the impact of the proposed processing on personal data protection before deploying video analytics that may pose a high risk to privacy and confidentiality, and reviews this assessment when material changes occur (for example changes in technology, deployment scale, or risk profile).

Data Retention

Citix does not retain identifiable video footage or stored images from this system. Citix retains aggregated analytics outputs only for as long as necessary for reporting and service delivery.

On-Site Transparency

Citix deploys visible signage at entry points and in proximity to camera locations at monitored sites. Signage includes:

• A clear statement that video analytics is in operation.

• The purpose of the processing (anonymised counting and statistics).

• Confirmation that no footage is recorded or stored.

• The Controller’s identity (Citix Billboards Advertising LLC).

• A QR code linking to the full version of this Privacy Notice.

• Contact details for the Data Protection Officer ([email protected]).

Signage is reviewed whenever new locations are deployed and during periodic site audits.

Your Rights and Choices

Under Articles 13 to 18 of the UAE PDPL, individuals have rights in relation to the processing of their personal data. Our video analytics system is designed to protect privacy by operating in real time without recording, storing, or transmitting identifiable video or personal data. Because of this design, there is generally no personal data retained that can be linked back to an individual after they leave the monitored area.

Your rights under the UAE PDPL include:

• Right to be informed (Article 13): You have the right to know how your personal data is processed. This Privacy Notice and on-site signage at monitored locations are provided to fulfil this right.

• Right of access (Article 13): You may request confirmation of whether your personal data is being processed and access to information about the processing. Because the system does not retain identifiable data, we will confirm that transient processing occurs while you are in the camera field of view, but that no identifiable record is created or retained.

• Right to correction and erasure (Article 14): You may request correction of inaccurate data or erasure in the circumstances set out in the UAE PDPL. Because the system does not retain identifiable personal data, these rights are generally not applicable for this processing activity.

• Right to restrict or stop processing (Article 15): You may request that we restrict or stop processing your personal data. Where you object to processing, we will assess your objection and consider whether reasonable operational measures can be taken (for example, reviewing camera placement or adjusting the field of view). We will respond to your request within 20 working days.

• Right to data portability (Article 17): You may request that your personal data be provided in a portable format. Because no person-specific dataset exists for this processing activity, data portability is generally not applicable.

• Rights relating to automated processing (Article 18): No automated decisions with legal or similarly significant effects are made about individuals by this system. The system does not perform profiling, individual tracking, or decision-making about specific individuals.

• Right to complain: You have the right to lodge a complaint with the UAE Data Office (the Bureau) if you believe your rights under the UAE PDPL have been violated.

To exercise any of these rights or to ask questions about this processing, please contact our independent external Data Protection Officer:

Email: [email protected]

We will acknowledge your request within 5 working days and respond substantively within 20 working days (or such shorter period as required by applicable regulations). All rights requests and their outcomes are documented by the Data Protection Officer.

Changes to This Privacy Policy

We review and update this Privacy Notice periodically and at least annually, or whenever material changes occur (for example, changes in technology, deployment scale, locations, processing purposes, or applicable law).

Any changes will be posted on citixmena.com.

Contact