Two kinds of processing, both stated in full.

Part 1 · Sensor-data processing

The pipeline

Our sensors are passive and listen-only. They receive the probe frames phones broadcast while looking for WiFi, and everything identifying is dealt with on the sensor itself:

• Anonymised on the sensor itself, in 1–3 seconds — the device identifier is hashed with a unique random salt immediately on capture. Raw device identifiers are never stored: not on the sensor, not in transit, not on our servers, which never receive and cannot reconstruct them.
• Each device is assigned a pseudonymous identity, irreversibly de-linked at campaign end. Within the salt’s lifetime, the same device yields the same hash — that is the entire basis of new-versus-repeat statistics.
• The salt is destroyed when your event closes (or at campaign end by agreement); destruction irreversibly eliminates linkability in production systems.
• Repeat-visitor metrics exist only within one event or contracted campaign. There is no recognition across campaigns, ever.

What comes out

• Aggregate statistics only: no profiles are created, stored, or delivered, and no re-marketing use.
• No report cell ever represents fewer than 12 devices — a suppression rule in production since 2019.
• Counts are unique devices, not people — stated in every report.
• Classification — engaged, passer-by, faraway — is derived from signal strength and time; location is perimeter detection, not positioning.

Legal basis

During the live processing window we treat hashed identifiers as pseudonymised personal data and apply GDPR in full, on a legitimate-interests basis (Art 6(1)(f)).

Retention

Anonymous aggregates and delivered reports are retained for 12 months.

Transparency at the venue

Venue signage and privacy notices are the venue operator’s responsibility as controller of the deployment context — and we supply template wording, so a correct notice is one email away.

The captive portal is different

Captive-portal users are identified with consent (double opt-in) — unlike the anonymous passive pipeline. Registration data is collected under your flow’s consent text and handled as your product page and notice state.

For your compliance team

Our GDPR Support Statement — the full pipeline, salt lifecycle, retention and a customer Q&A — is available to customer compliance teams, and we offer a walkthrough call with it.

Part 2 · This website

No cookies

This site sets no cookies and shows no consent banner because it needs none. Traffic measurement uses Cloudflare Web Analytics, which is cookieless and does not track individuals.

The contact form

What you type into the contact form is sent to us by email, relayed through our email provider, and used only to reply to you. It is not added to a marketing list, and there is no CRM pixel, chat widget or third-party form service behind it.

Controller

Advanced Radio Mapping Limited, Suite 6, The Terrace, Dublin D18PW56, Ireland. Company No 620229. Questions about this notice: info@advancedradiomapping.com.