Privacy Statement for 
Web Crawling

 

This Privacy Statement applies to personal data processed during web crawling activities carried out by PIXRAY GmbH (“PIXRAY” or “we”). It is addressed to the operators of public websites and online platforms that are visited by our web crawler, as well as to individuals whose personal data appears on such publicly accessible websites or platforms.

 

For information on data processing on our website, please visit https://pixray.com/privacy-policy/.

 

1 Who we are


The controller of the data processed by our web crawler is PIXRAY GmbH, Eisenhartstr. 4, 14469 Potsdam, Germany. You can contact the Controller through the postal address, via email at info@pixray.com or via telephone at +49 331 288 380 00.

 

The data protection officer of PIXRAY GmbH can be reached through the abovementioned postal address of PIXRAY GmbH or via email at gdpr@pixray.com or via telephone at +49 331 288 380 00.

 

 

2 Data Processing

 

2.1 Overview and Purpose of Processing

 

PIXRAY provides its customers with a search engine that can identify copyright infringements in photographs and other images (collectively “images”). To this end, PIXRAY uses a web crawler to scan and analyze publicly available images. Images that do not infringe customers’ copyrights are deleted from PIXRAY’s system immediately after analysis. Infringing images are stored and transferred to the respective customer together with the information about the operator of the website or platform containing the infringing image.

 

 

2.2 Details of the Web Crawling Process

 

The web crawler visits and processes data from URLs on publicly accessible websites and online platforms.

 

These public websites and online platforms are discovered through publicly available domain registration information and/or by following links from other websites and platforms. URLs of individual sub-pages are discovered by following links or evaluating sitemap.xml documents on those websites and platforms, or by following links on previously known public websites and online platforms.

 

Each HTML document retrieved by the web crawler is stored in ephemeral storage (RAM) only. Links to other documents and URLs of embedded images are extracted and stored. The HTML document itself is immediately deleted and removed from ephemeral storage without any further processing.

 

Image URLs are accessed by the web crawler which downloads the images for further analysis. Only publicly accessible images are downloaded. Images are temporarily stored for processing by the image matching mechanism. This mechanism uses algorithms to identify whether an image matches an image of a PIXRAY customer. Potential matches are vetted by human operators to ensure accuracy. PIXRAY deletes all images that are not a confirmed match immediately. PIXRAY does not store or index any fingerprints or other meta data from non-matching images.

 

For each potential match PIXRAY attempts to retrieve information about the operator of the public website or online platform containing the corresponding image.

 

PIXRAY presents the matches to the respective customer along with a copy of the image, the URL of the HTML Document, the URL of the image in question and the contact details of the operator of the website or platform. PIXRAY does not process any personal data for its own purposes after the transfer.

 

2.3 Categories of Personal Data processed

 

The following categories of information can be processed:

  • All data included in the imprint/contact page or any other page of the website that contains contact information such as the name of the owner of the website and contact details.
  • Technical data such as URLs, hostnames and IP-addresses.
  • All personal information that might be recognizable from the analyzed images

 

2.4 Technical Security Measures

 

The web crawler uses encrypted SSL connections wherever the visited website or platform supports them. No indexing of the contents of HTML documents is performed, except for extracted image URLs and links.

 

2.5 Legal Basis of Data Processing & Legitimate Interest Assessment

 

PIXRAY processes the data based on the legitimate interest of its customers (see Article 6 (1)(f) GDPR).

 

As the holders of the copyright for their content, PIXRAY’s customers have a legitimate interest in identifying instances of copyright infringement on public websites and online platforms. It is vital to their core business to ensure that users of their content comply with copyright law.

 

Using a web crawler to crawl public websites and online platforms is necessary to identify copyright infringements, as large quantities of such infringements occur on public websites and online platforms without any prior knowledge of the locations of the infringements, which would allow a more targeted approach to identification. PIXRAY’s web crawler only processes and stores the minimum amount of personal data required to fulfil this purpose.

 

PIXRAY also limits its web crawling to publicly accessible websites and online platforms to ensure that the rights and interests of the data subject do not outweigh PIXRAY’s legitimate interest to search for and analyze the images.

 

3 Retention and Deletion

 

All collected data is immediately deleted if no confirmed match is found. Otherwise, the information is transferred to the copyright owner. PIXRAY does not process any personal data as a controller and for its own purposes afterwards.

 

4 Recipients

 

If we find a match we transfer all information to the copyright owner.

 

5 Automated decision-making

 

PIXRAY does not use technologies that make decisions based solely on automated processing (including profiling) that have legal or similarly significant effects for data subjects. PIXRAY does not use facial recognition technology or any other technology to identify individuals in downloaded images, nor does it make any automated assessments about the contents of images.

 

6 Your rights

 

You have the following rights, provided that the legal requirements are met. To exercise these rights, you can contact us at the contact addresses provided.

 

• Art. 15 GDPR – Right of access by the data subject:

 

You have the right to obtain confirmation from us as to whether personal data concerning you are being processed and, if so, which data and the circumstances of the data processing.

 

• Art. 16 GDPR – Right to rectification:


You have the right to request that we immediately correct any inaccurate personal data concerning you. Taking into account the purposes of the processing, you also have the right to request the completion of incomplete personal data, including by means of a supplementary statement.

 

• Art. 17 GDPR – Right to erasure:


You have the right to request that we delete personal data concerning you without delay.

 

• Art. 18 GDPR – Right to restriction of processing:


You have the right to request that we restrict processing.

 

• Art. 20 GDPR – Right to data portability:

 

In the event of processing based on consent or for the performance of a contract, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format and to transmit this data to another controller without hindrance from us or to have the data transmitted directly to the other controller, where technically feasible.

 

• Art. 77 GDPR in conjunction with § 19 BDSG – Right to lodge a complaint with a supervisory authority:

 

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes applicable law.

 

In particular, right to object and withdrawal of consent


• Art. 21 GDPR – Right to object:


You have the right to object, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on our legitimate interests or on the performance of a task carried out in the public interest or on the exercise of official authority.

 

If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

 

If we process your personal data for direct marketing purposes, you have the right to object to the processing at any time. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

 

You can lodge your objection at any time with future effect via one of the contact addresses known to you.