Home / GDPR & compliance
GDPR compliance for robotics video datasets.
Compliance is not a checkbox at EgoVista, it is the architecture. Every dataset we deliver was collected, processed, and stored under EU law from day one, and each decision taken along that chain is recorded at the moment it is taken.
1 of 8 sections
Why GDPR matters for robotics datasets.
In 2026 the regulatory pressure on AI training data is no longer theoretical. The European AI Act is in application, GDPR enforcement has matured, and compliance audits of robotics products and software systems are now a standard step in enterprise procurement. For an ML team, using a dataset that was collected or processed in a non-compliant way creates a chain of risk: dataset recall, model retraining, deployment blockage, and in the worst case, fines that scale with company revenue.
The risk is not abstract. A robotics startup that ships a manipulation policy trained on a non-compliant dataset can find itself in a position where the policy must be retired before launch, because the dataset cannot be re-licensed under acceptable conditions, or because a contributor withdrawal request cannot be honored in the trained model. EgoVista was designed so the dataset side never becomes that bottleneck.
2 of 8 sections
Face pseudonymisation before any external processing.
The cornerstone of the EgoVista pipeline is a simple ordering rule: facial blurring runs before any external call, and no unblurred frame is sent outside our own environment. The blurring operates on detected faces and does not warrant exhaustive detection. Facial blurring is the first stage of the pipeline and precedes any external call, whether to a cloud service, a model, or a GPU inference endpoint. This blurring is a pseudonymisation measure — a security and data-minimisation step — not anonymisation: the processed video remains personal data, because identifiers other than the face may persist.
The technical implementation in plain terms:
- Multi-person face detection with a face-detection model running locally. The detector is tuned with a conservative confidence threshold so missed detections are minimised, at the cost of occasional false positives that are then also blurred.
- Gaussian blur applied to each detected face region with a kernel sized to defeat off-the-shelf face recognition models on the resulting image. The parameters are calibrated to remain effective against current recognition systems, with a margin for the underlying detector to be updated.
- The unblurred version is never sent to an external service. Blurring is the first stage of the pipeline and every downstream stage declares a dependency on it, so the sequence that reaches annotation is blurred by construction rather than by instruction.
3 of 8 sections
European-first infrastructure.
Storage and the main processing run in the European Union. A number of our suppliers are established outside the EEA, and their support, administration and control-plane access constitute transfers under Chapter V. Each is covered by the European Commission’s standard contractual clauses or by the guarantee regime applicable to that supplier. The choice is not branding, it is the simplest way to satisfy GDPR transfer rules and the data sovereignty expectations of enterprise clients in the EU. The full infrastructure stack:
- Storage: object storage in the EU region. All raw, pseudonymised, and derived data sits in EU buckets with restricted access.
- Compute: EU-region GPU compute for the GPU-bound annotation layers (segmentation, hand pose, depth).
- Action labelling: a vision language model produces the natural-language descriptions of the actions visible in the footage.
- Database and authentication: an EU-region database for the metadata catalogue, contributor accounts, and capture session metadata.
- Domain, email, and operational tooling: EU-region providers, with US sub-processors limited to email delivery, covered by the EU-U.S. Data Privacy Framework with Standard Contractual Clauses as a fallback.
The full, dated list of sub-processors, with the functional category and the transfer mechanism for each, is published at egovista.app/legal/sub-processors and the data flow is documented in the privacy policy, so a compliance officer can audit the chain without having to ask.
4 of 8 sections
Legal basis for each processing operation.
GDPR requires that every processing operation has a clear legal basis. The table below summarises the basis we rely on per step, with the GDPR article reference. The full version, including retention periods and sub-processor names, sits in the privacy policy.
| Processing | Legal basis | Justification |
|---|---|---|
| Contributor video capture | Explicit consent (Art. 6.1.a) | The contributor accepts the terms when the account is created, gives a separate and revocable biometric consent, and files a declaration with each sequence submitted. Each of these is recorded and dated. |
| Face pseudonymisation | Data minimisation (Art. 5.1.c); legitimate interest in protecting third parties (Art. 6.1.f); data protection by design (Art. 25) | Facial blurring is applied as a security and data-minimisation measure before any subsequent processing; the processed video remains personal data. |
| Hand pose, depth, segmentation | Legitimate interest (Art. 6.1.f) | The data is already pseudonymised at this point. The processing is necessary to produce a usable dataset, the impact on data subjects is minimal, and the balancing test documents this. An effective right to object (Art. 21) is available. |
| Action labelling | Legitimate interest (Art. 6.1.f) | Processing runs only on pseudonymised frames. The balancing test and the sub-processor agreement are documented. |
| Delivery to client | Contract (Art. 6.1.b) | The delivery is the core of the contractual relationship between EgoVista and the client. The dataset is produced and shipped for that purpose. |
| Post-delivery retention | Legitimate interest (Art. 6.1.f) | Retention windows are short, documented, and serve a defined purpose: re-packing into another format, quality re-review on dispute, contractual support. |
A DPIA (Data Protection Impact Assessment) covering the full pipeline is available on request for enterprise clients under NDA.
5 of 8 sections
Contributor rights and data subject access.
Contributors keep the standard set of GDPR data subject rights. The way each right is honoured on the EgoVista side:
- Right of access: a contributor can request a copy of the data captured during a mission, within the legal one-month window.
- Right to withdrawal: consent can be withdrawn at any time, in writing. Data that has not yet been delivered is deleted within thirty days. Data that has been delivered is covered by the contractual chain described to the contributor at signup.
- Right to erasure: EgoVista erases the data from its own systems within thirty days and notifies the client of the request, in discharge of its notification obligation under Article 19 GDPR. EgoVista cannot guarantee erasure on a third party's systems, and Article 17(3) exceptions may apply on the client side.
- Right to portability: a contributor can request their data; we return it in a structured, machine-readable format.
- Complaint procedure: contact details for the data controller and for the relevant supervisory authority (CNIL in France) are provided in the privacy policy, in plain language.
6 of 8 sections
AI Act and high-risk system data requirements.
Under the EU AI Act, robotics products that perform safety-critical functions can fall under the high-risk system category. Such systems require structured data governance, transparency about training data, and risk management. EgoVista contributes to that governance by shipping each dataset with:
- Provenance metadata: which mission an episode belongs to, when it was submitted, and the terms in force at capture.
- Annotation provenance: which pipeline version and which model produced each annotation layer, and when.
- Per-dataset QA report: shipped with every delivered dataset, covering schema validation, completeness metrics, and known limitations.
- Dataset card: shipped with every delivered dataset, covering intended use, composition, known biases, and recommended evaluation practice.
The dataset card is intended to slot into your AI Act compliance documentation without rework. We do not certify the downstream system, that is your team's responsibility, but we make sure the dataset side does not become the missing piece.
7 of 8 sections
How EgoVista handles client confidentiality.
On the client side, the same posture applies. Exclusivity, where agreed, is contractual and carries a defined end date. Retention of raw footage after delivery is set at engagement and follows our published retention policy. NDAs are available before any technical conversation, and most enterprise engagements start with a mutual NDA. The storage and processing cost during the project window is absorbed in the delivery fee, with no per-gigabyte surprise on the invoice.
8 of 8 sections
GDPR and compliance frequently asked questions.
Is your dataset legal to use in EU production deployments?
Yes, under standard conditions. Every processing step has a documented legal basis under GDPR, recorded in our register of processing activities. A dataset card ships with every delivered dataset, covering composition, provenance, processing chain and known limitations. For deployment in a high-risk AI system under the EU AI Act, the broader governance remains your responsibility (risk management, transparency, post-market monitoring); the dataset side is built to slot into that governance without rework.
Can you provide a DPIA for our compliance review?
Yes. A data protection impact assessment covering the EgoVista capture and annotation pipeline is available on request under a mutual NDA, together with our transfer impact assessment, our technical annex, our sub-processor list and our retention policy. They describe the data flows, the legal basis for each processing operation, the risks identified and the measures applied, including facial pseudonymisation and EU storage and processing. Your DPO can use them as input to your own assessment; each controller conducts and signs its own.
What happens if a contributor withdraws consent after delivery?
Contributors can withdraw consent at any time. For data still in our pipeline that has not been delivered, withdrawal triggers deletion within thirty days. For data already delivered to a client, EgoVista erases it from its own systems within thirty days and notifies the client of the request, in discharge of its notification obligation under Article 19 GDPR, so the client can give effect to it under its own GDPR procedure. EgoVista cannot guarantee an outcome that depends on the action of a third party, and Article 17(3) exceptions may apply on the client side. The contributor agreement documents both paths in plain language so no party is surprised.
Are facial features completely removed or just blurred?
Faces are blurred with a conservative filter that keeps the body context intact for hand and object segmentation. This is pseudonymisation, a security and data-minimisation measure, not anonymisation: the processed video remains personal data, because a person can still be recognisable from hands, gait, build, environment or context. We say this consistently across our documentation and we never describe our footage as anonymous. For projects with stronger requirements we can apply a heavier filter or mask additional categories.
Do you process any data outside the EU?
Storage and the main processing run in the EU. Some of our suppliers are established outside the EEA, and those transfers are covered by the European Commission's standard contractual clauses.
Can you sign a DPA (Data Processing Agreement)?
Yes. We provide a standard DPA aligned with GDPR article 28, covering the scope of processing, the sub-processors involved, the location of processing, the security measures applied, and the procedure for handling data subject requests. The DPA is signed before any client data crosses into our pipeline. Custom amendments to the standard DPA are accepted on request, within the limits of our compliance posture.
How long is raw footage retained before deletion?
Retention is governed by our retention policy, which is communicable on request and sets a period for each category of data. Retention of raw footage after delivery is agreed at engagement. The records that document the annotation provenance follow their own period, at the end of which the elements linking them to an identified person are removed while the record itself is kept as evidence of a decision.
Request a compliance brief.
Your compliance team can review the EgoVista pipeline before any data is exchanged. We can send a DPA template, a high-level architecture description, and a DPIA summary under NDA. For related material, see the product overview, the LeRobot format details, and the RLDS format details.