Hereinafter “the Company” or “we”) shall treat personal data and protection and privacy issues with responsibility and paramount importance. In this regard, and in compliance with the transparency and information obligations set out by the General Data Protection Regulation (hereinafter the “GDPR”) and the Greek Law 4624/2019, we will publish this Privacy Notice to inform you with respect to the processing of your personal data that are recorded by the closed-circuit television system (hereinafter “CCTV”).
If you have any queries regarding this notice, please contact us either by phone or by sending an e-mail to the following Data Controller details.
- Data Controller details
| Data Controller: | Hellenic Recovery Recycling Corporation |
| Address: | 5 Chimaras St, Maroussi, 15125 |
| Telephone: | +30 210 801 0962-3 |
| e-mail: | [email protected] |
2. Purpose of processing and legal basis
The Company uses CCTV solely for the protection and security of individuals and their fundamental rights, as well as the protection of corporate property. This processing is necessary for the purposes of the legitimate interests pursued by the Company as a Data Controller (Article 6, par. 1 f of GDPR).
3. Analysis of Legitimate Interests
The Company’s legitimate interest consists of the need to protect our premises and the goods that are found therein, as well as the life, physical integrity and health of our personnel and any third party that is located in the video surveillance area from the risk of fire.
The Company collects only visual data and restricts the monitoring to areas where fire and accidents are more likely to occur based on our assessment, without focusing on areas which might present an excessive restriction of the private life of individuals, whose image is captured by the camera (e.g., toilet and changing room area), including their right to respect their personal data.
The CCTV data that is collected is not used for employee supervision and performance monitoring, while the cameras used are not able to move or zoom.
In addition, we inform you that the Company takes the appropriate security measures to ensure the best possible storage of your personal data and the prevention of any accidental loss, misuse, or unauthorised access. Thus, the Company has established procedures in order to be able to comply with its legal obligations in case of personal data breach.
4. Data Recipients and Transmission
Under no circumstances shall the Company share, use or in any way transmit your personal data to the third parties, with the exception of those stated herein.
For the purpose stated hereto, the retained material shall only be accessible by our competent/authorised security staff and who is bound by the confidentiality of their actions.
This material can only be transferred with the consent of the persons captured by camera, except under the following circumstances:
a) to the victim or perpetrator of a criminal act, and upon their justified request, when the data may serve as evidence for the establishment, exercise or support of legal claims or a criminal act and may contribute to the investigation of the incidents or in identifying the perpetrators
b)to authorised judicial, prophylactically and law enforcement authorities, when the material contains information which is essential for the investigation of a criminal act relating to individuals or goods, or when they legally request the data in the course of exercising their duties.
5. Retention Time
If an incident pertaining to the intended purpose does not arise in the stored or real time footage, your data will be destroyed at the latest within fifteen (15) days.
In case we identify an incident during that period of time to the detriment of persons or goods, we will separate the relevant footage and store it in a separate file for thirty (30) days in order that the incident be properly investigated and legal action for the protection of our legitimate interests commence.
If the incident concerns a third party, we will store the footage it in a separate file for an additional period of up to three (3) months.
6. Your rights
In the context of the above purpose of processing, you have the following rights:
- Right of access: You have the right to be notified by us whether we process your image, and if this is the case, to obtain a copy.
- Right to erasure: You have the right to request the erasure of your personal data.
- Right to object: You have the right to object to the processing.
- Right to restriction: You have the right to request the restriction of the processing, e.g., not to delete the data which you consider necessary to establish, exercise or defend any legal action.
In order for us to examine a request relating to your image we will need you to tell us roughly when you were present in the vicinity of the cameras and send us a photo of yourself which will help us to identify your data and hide the data of other individuals appearing in the footage. Alternatively, you may come to our premises and we will show the footage that you appear in. Note that the exercise of your right to object or your right to erasure does not necessarily entail the immediate erasure of data or a change in the processing. In any event, we will respond to you in detail as soon as possible within one (1) month of your request. Having regard to the complexity of the request and the number of requests being processed, this deadline can be extended by another two (2) months, upon prior notice. Our response to this request is provided free of charge. However, if your request is unfounded, excessive or repetitive, we may impose a reasonable fee after notifying you, or refuse to respond to your request.
- Right to lodge a complaint: If you consider that the processing of your data violates Regulation (EU) 2016/679 (GDPR), you have the right to lodge a complaint to the supervisory authority. In Greece, the supervisory authority is the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23, Athens, https://www.dpa.gr/, tel. 2106475600.