Onsito / Privacy policy

Privacy policy

This page describes how we handle personal data on the onsito.eu website and in the Onsito product. The website collects only what is needed to deliver it, and it starts visitor analytics only with your consent. It has no forms. For the product, the client is the controller of personal data and we process only what the client entrusts to us.

Who we are

Controller of personal data for the website and for communication with us:

• Head The Projects s.r.o., Company ID (IČO): 23995491
• registered office: Cyrilská 508/7, 602 00 Brno
• registered in the Commercial Register kept by the Regional Court in Brno, file number C 148504 (section C, insert 148504)
• executive director (jednatel): Dan Burian
• contact via the executive director's LinkedIn linkedin.com/in/buriandan, data box (Czech government electronic mailbox) 3rt3arh

Send all questions about personal data as a LinkedIn message, to the data box or by post to the registered office address.

The onsito.eu website

What the website does not do

• Without your consent it uses no visitor analytics and no cookies, except the language cookie set when you click the language switcher. Details are on the Cookies page.
• It has no advertising pixels.
• It has no forms.
• It does not load anything from third-party servers. Fonts and scripts are on our domain.

Technical data when you visit

The website runs on the Cloudflare Pages service. When you open a page, your browser sends a request to Cloudflare's servers. In doing so, Cloudflare processes technical data about the connection, mainly your IP address, and keeps technical logs from it.

• Purpose: to deliver the page to you and to protect the website against attacks and abuse.
• Legal basis: our legitimate interest in a working and secure website, Article 6(1)(f) GDPR.
• Retention period: Cloudflare keeps the technical logs according to its own policies. We do not export or store them.
• Recipient: Cloudflare, Inc., 101 Townsend Street, San Francisco, USA, as our processor under a data processing agreement (Cloudflare Data Processing Addendum).

The page cannot be delivered without this data. We do not identify anyone from it and do not combine it with other data.

When you write to us

When you send us a message on LinkedIn, to the data box or by post, we process your name, your contact details and whatever you include in the message, for example your company and job title.

• Purpose: to reply to you and to discuss a pilot or cooperation.
• Legal basis: our legitimate interest in answering an inquiry and dealing with the company you represent, Article 6(1)(f) GDPR. If you are negotiating a contract with us on your own behalf, these are steps taken prior to entering into a contract, Article 6(1)(b) GDPR.
• Retention period: for the duration of the discussions and no longer than 3 years from the last message. If the discussions result in a contract, we keep the correspondence for the period required by accounting and tax regulations.
• LinkedIn: LinkedIn messages are also processed by LinkedIn Ireland Unlimited Company as an independent controller under its own privacy policy. We have no influence over what LinkedIn does with the messages.

Writing to us is voluntary.

Visitor analytics (only with consent)

• What: Microsoft Clarity records how you use the page: clicks, scrolling, visit duration, device and browser type, and approximate location based on your IP address. Clarity masks the text on the page.
• Purpose: to find out which parts of the website people read and where they leave, and to improve the website accordingly.
• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time via the Cookie settings link in the footer.
• Retention period: session recordings 30 days, aggregate statistics 13 months (according to the Clarity service settings).
• Recipient: Microsoft Corporation, One Microsoft Way, Redmond, USA, as our processor under the Clarity terms of service. Microsoft processes the data in the USA and complies with the EU-US Data Privacy Framework.

Google Search

Google Search Console shows us how the website appears in Google Search. It works with aggregate figures for the website, not with data about individual visitors.

Transfers outside the EU

Cloudflare is based in the USA and has servers both in and outside the EU. A request to the website may therefore also pass through a server outside the EU.

• Transfers to the USA rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795. According to its privacy policy, Cloudflare complies with the framework and holds a certification with the US Department of Commerce.
• If the certification ceased to be valid, the standard contractual clauses under Commission Implementing Decision (EU) 2021/914, which are part of the data processing agreement, apply instead. Cloudflare uses the same clauses for transfers to other countries outside the EU.

Sources: Cloudflare privacy policy, Cloudflare data processing agreement, Data Privacy Framework participant list.

Automated decision-making

We do not make automated decisions or carry out profiling on the website.

The Onsito product

Onsito is in development and we are launching pilot deployments. This section describes how the product is designed and how we share responsibility with the client.

The client is the controller

The cameras and the Onsito box process video directly at the client's site. The client's employees or visitors may appear in the frame. The client is responsible for this processing as the controller. The client decides where the cameras will be, what they are used for and how long video is kept.

When we are a processor

Head The Projects is a processor where it may come into contact with personal data at the client's site:

• when we service the box on site at the client,
• when we train the model on site on images from the client's operations.

For these cases we conclude a data processing agreement with the client under Article 28 GDPR. The agreement sets out the scope of processing, the technical and organizational measures, sub-processors and deletion. We do not use images and video from the client's operations for other clients or for our own purposes.

What data Onsito processes

• Camera video stays in the client's network. The box blurs people before it stores anything. It keeps video for 90 days (the client sets the period based on its impact assessment), and the video can be played back only from the client's network. We have no remote access to the box.
• Images for model training stay with the client. They never leave the company.
• Events and numbers in the cloud dashboard: the box sends them to the cloud in one direction only. They are machine status, piece counts, cycle times and downtime. They are designed so that no specific person can be identified from them. The cloud is in the EU and each client has a separate dashboard. We operate it with DigitalOcean, LLC (USA) in a data center in Frankfurt am Main, as our sub-processor with standard contractual clauses.
• Cloud dashboard users: name, email, role and login records of the people the client invites to the dashboard. We process them as a processor for the client for the term of the contract and delete them within 30 days after it ends.

Onsito does not evaluate individuals and does not use biometrics. Face detection serves only to blur faces. Summaries are only by machine and line.

The client may combine the numbers from the cloud with its own data, for example with a shift schedule. They may then become personal data for the client and belong in its impact assessment.

What the client must do

1. Determine the legal basis. This is usually the legitimate interest in managing production, Article 6(1)(f) GDPR, balanced against the interests of employees. Employee consent is not a suitable legal basis in an employment relationship.
2. Assess Section 316 of the Czech Labour Code (Act No. 262/2006 Coll.). Without a serious reason arising from the special nature of its activities, an employer must not intrude on employees' privacy by open or covert monitoring. Onsito cameras point at machines and workstations, not at people. The client should have documented why and where it uses the cameras.
3. Inform employees. Directly and in advance, about the scope and method of how Onsito works (Section 316(3) of the Labour Code), and under Article 13 GDPR, for example with a sign by the cameras and an internal notice.
4. Carry out a data protection impact assessment (DPIA) under Article 35 GDPR. It is part of the installation: we supply the technical description and supporting documents, and the client carries out and approves the assessment.
5. Conclude a data processing agreement with us under Article 28 GDPR and record the processing in its records of processing activities under Article 30 GDPR.
6. Handle requests from people in view. If such a request reaches us, we pass it on to the client and help the client handle it.
7. Stick to the intended purpose. Onsito is for measuring machines and material flow. It must not be used to evaluate people's performance or behavior. Such use could make it a high-risk AI system under Annex III, point 4 of Regulation (EU) 2024/1689 (AI Act) and make the client its provider under Article 25(1)(c).

For operations outside the Czech Republic, local labor law applies. In Slovakia, under Section 13(4) of the Slovak Labour Code (Act No. 311/2001 Coll.), an employer may intrude on employees' privacy through a control mechanism only for serious reasons arising from the special nature of its activities. The employer must discuss the scope, method and duration of the monitoring with employee representatives in advance and inform employees about them in advance.

More about the technical solution is on the Security page.

Your rights

Under GDPR, you have the following rights against the controller:

• access to your data (Article 15),
• rectification of inaccurate data (Article 16),
• erasure (Article 17),
• restriction of processing (Article 18),
• data portability where GDPR allows it (Article 20),
• objection to processing based on legitimate interest (Article 21).

For the website and emails, Head The Projects is the controller, so write to us. For footage from operations, the controller is your employer or the company you are visiting. We will forward any request that reaches us to them.

We will respond within one month. In complex cases we may extend this period by two more months and will tell you why (Article 12(3) GDPR).

Supervisory authority

You can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz. You can also contact the supervisory authority in the EU member state where you live or work.

Contact

Head The Projects s.r.o., Cyrilská 508/7, 602 00 Brno, data box (Czech government electronic mailbox) 3rt3arh, the executive director's LinkedIn linkedin.com/in/buriandan.

Changes

When the website or the product changes, we will update this page too. The current version is always here, with its effective date.

Effective from October 12, 2026.