CCTV PRIVACY POLICY

Privacy Notice

Information on the processing of personal data through a video surveillance system

1. Data Controller:

PHĀEA

67 Dimokratias str, GR-71306 Heraklion, Crete, Greece

Tel: +30 2810 334034

E-mail: [email protected]

2. Purpose and legal basis of the processing:

We operate a surveillance system for the purpose of protecting persons and goods. The processing is necessary in order to exercise legitimate interests that we seek as a data controller (article 6 par.1.f GDPR).

3. Legal Interests

Our legal interest is based on the need to protect our premises and the goods contained in them from illegal acts, such as theft and vandalism. The same applies to the protection of human life and the property of our guests and staff as well as any third parties who are legitimately in the supervised area.

The reception is limited to areas where we have assessed that there is an increased possibility of committing illegal acts without focusing on areas where the privacy of the persons being recorder including their right to respect their personal data can be seriously affected.

4. Recipients

The stored data is accessible only by the competent / authorized personnel in charge of the security of the area. This data is not transmitted to third parties, except in the following cases:

(a) to the competent judicial, prosecutorial and police authorities when it contains information necessary for the investigation of a criminal act which concerns employees or goods of the data controller,

(b) to the competent judicial, prosecutorial and police authorities when requesting data, lawfully, when exercising their duties,

(c) to the victim or perpetrator of an offence, in the case of data which may constitute evidence of the offence.

5. Retention Period

The Data retention period of the CCTV footage is 15 days

In the event that during this period we notice the occurrence of an incident, we isolate part of the video and keep it for one (1) month, in order to investigate the incident and initiate legal proceedings to defend our legal interests, if the incident concerns a third party, we will keep the video for up to three (3) more months.

6. Data Subject Rights

The data subjects have the following rights:

• Right to access your data: you have the right to be informed that we are processing your image and, if applicable, to obtain a copy of the processed data.
• Right to restrict the processing: you have the right to ask us to restrict the processing, for example not to erase data that you consider necessary to establish, exercise or support any legal claims.
• Right to object: you have the right to object to processing.
• Right to erasure: you have the right to request the deletion of your data.

You will be able to exercise your rights by sending an e-mail to the address [email protected], or via mail to our registered address, or by submitting your request in person at our address. To examine a request related to the processing of your image, you should inform us, approximately, when you were within range of the cameras and provide us with your image in order to enable us to locate your data and mask the data of any third parties captured in the footage.  Alternatively, we give you the opportunity to come to our facilities to present you the images in which you appear. It should be noted that exercising the right of objection or deletion does not imply the immediate deletion of data or the modification of the processing. In any case, we will reply to you in detail as soon as possible, within the deadlines set by the GDPR.

7. Right to lodge a complaint

In case you consider that the processing of your data violates Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Greece is the Hellenic Data Protection Authority (HDPA), Kifisias 1-3, 115 23, Athens, https://www.dpa.gr/,  tel. 2106475600.