Data processing involving the collection, retention, structuring, and analysis of online audience measurement data through the design, development, and provision of the digital analytics SaaS solution "Piano Analytics". Geographical scope: Delivered from FR worldwide.

In today's digital landscape, tracking customer data is crucial for enhancing engagement and providing personalized services. Equally important is ensuring the proper protection of data subjects. By effectively managing and processing customer tracking data, companies can improve their interactions with customers while complying with data protection regulations. Applied Technologies Internet SAS (AT Internet) sells and acts as a group via the Piano Software branding (Piano). At Piano, customer tracking data involves billions of events per month from hundreds of millions of pseudonymized and/or logged-in users. This data includes raw information such as IP addresses, terminal IDs, and other related details, which are then processed into visitor IDs and other audience-related data. The primary purpose of collecting and processing customer tracking data is to provide the requested data within the customer's service subscription, offer additional services such as support and product updates, and interact with individuals seeking information about the brand and products. Piano delivers these services worldwide, making significant efforts to ensure data security and comply with all applicable laws. Specific binding corporate rules are applied to safeguard collected information (https://www.piano.io/legal/binding-corporate-rules). The use of subcontractors is strictly controlled and monitored (https://www.atinternet.com/en/processor-sub-processor-information-parent-company/). While AT Internet / Piano acts as processor, the company works diligently to assist its customers, who act as controllers, in properly assessing risks and protecting data subjects. This includes providing accurate information to end users (https://www.atinternet.com/en/data-protection/data-collection-on-our-customers-sites/).

Document review, Interviews (face to face meetings, online and remote meetings, written questions), Examinations, Data / Records sample analysis

AT Internet / Piano is a market leader in data analytics and a pioneer in applying new technologies. The company boasts a robust process structure and strong expertise in Data Protection, emphasizing awareness, data minimization, pseudonymization, privacy by design, and privacy by default. Given the vast amount of data managed, the company demonstrates comprehensive coverage of procedures and processes for both general and specific cases. Their collaboration with Data Protection Authorities is noteworthy, showcasing transparency during audit activities. Special attention is given to role separation concerning data access, the control of subprocessors, and continuous collaboration with Data Controllers to ensure proper information and protection of data subjects. Even as data processor, AT Internet / Piano provides extensive information on their website, enabling both data controllers and data subjects to understand the privacy approach applied in the collection and analysis of data.

The Applicant’s Data Processing Activities included into the Target of Evaluation, and referred to the applicable parts of the scheme (as processor), has been found compliant with requirements specified by the Certification Scheme and relevant for the Data Processing role. The evaluation process did not find any substantial non-conformities and the decision to certify is consistent with the collected evidences.