Governance · Republic Act 10173
Privacy & Data Privacy Act compliance
OOH.OS measures environments, not people. This page sets out what is collected at each layer, the lawful basis for it, the safeguards enforced in the system itself, and the hard boundary we do not cross — turning anonymous exposure back into an identified person.
General data privacy principles
Transparency
Every measurement surface states what is collected, on what basis, for how long, and who may access it. Camera deployments carry on-site notice at the corridor.
Legitimate purpose
Data is processed for one declared purpose: verifying and reporting advertising exposure and outcomes. It is not repurposed for enforcement, insurance, credit or security use.
Proportionality
Only the minimum needed is kept. Video frames are processed at the edge into counters and discarded; personal data is never the unit of analysis.
Article · Processing inventory
What is processed, and why
Camera AI at the asset
- Collected
- Aggregate vehicle counts, class, direction, dwell seconds, visibility index.
- Personal data
- None retained. Frames are transient and discarded after inference.
- Lawful basis
- Not personal data as retained; on-site notice posted regardless.
- Retention
- Aggregate counters: campaign term + audit period.
Mobile / geofence panel
- Collected
- Cohort-level reach, frequency, trip purpose, modelled visits and conversions.
- Personal data
- No device records ingested. Provider supplies aggregates only.
- Lawful basis
- Consent obtained by the panel provider, evidenced in the consent registry.
- Retention
- Panel extracts deleted on schedule after reporting.
Platform accounts
- Collected
- Workspace user email, role assignment, action audit log.
- Personal data
- Yes — staff account data.
- Lawful basis
- Contract and legitimate interest in system security.
- Retention
- Life of the account, audit entries retained for the audit period.
Opt-out requests
- Collected
- SHA-256 hashed identifier, scope, reason, reference code.
- Personal data
- Pseudonymised in the browser before transmission.
- Lawful basis
- Compliance with the data subject's right to object.
- Retention
- Kept as proof of suppression; never used for marketing.
Your rights as a data subject
- Be informed — this notice and the on-site corridor notices.
- Object — submit an opt-out and have the identifier suppressed across sites.
- Access and rectification — for workspace account data held by the media owner.
- Erasure or blocking — where processing is withdrawn, unlawful or no longer necessary.
- Damages and complaint — including recourse to the National Privacy Commission.
Requests are logged with a reference code, actioned by the Data Protection Officer, and every decision is written to the audit trail.
Submit a requestOrganisational & technical safeguards
- Row-level security: consent records and opt-out queues are readable only by the DPO and admin roles, enforced in the database rather than the interface.
- Role separation: ops manage calibration and drift alerts, analysts read measurement, privacy roles alone touch personal-data artifacts.
- Append-only audit log: exports, opt-out decisions and configuration changes are written and never editable or deletable.
- Pseudonymisation at source: opt-out identifiers are hashed client-side, so the raw identifier never reaches the server.
- k-anonymity floor: cohort cells below the minimum panel threshold are suppressed instead of published.
- Privacy impact assessment per deployed corridor, with data sharing agreements executed with every panel provider.
Prohibited by design
We do not re-identify. Anonymous exposure data is never linked to an advertising ID, SIM, app registration, purchase record or messaging account; no individual profiles are built, sold or enriched; and no cohort is reported small enough to single a person out. Outcome matching, where an advertiser requests it, occurs only inside a clean room on the advertiser's own consented first-party data and returns aggregates.
Roles and contact
The media owner is the personal information controller for its operational and account data. Panel providers remain controllers of their consented device data and supply aggregate outputs only. A named Data Protection Officer maintains the consent registry, the opt-out queue, the privacy impact assessments and the breach-notification procedure required under RA 10173 and its IRR.
Reach the Data Protection Officer through the opt-out form, selecting the relevant request scope. Complaints may also be lodged with the National Privacy Commission.