Privacy Notice on the processing of personal data through a video surveillance system (CCTV)
1. Data Controller:
2. Data Protection Officer:
3. Purpose and legal basis of the data processing:
We use closed-circuit television (CCTV) in order to protect premises, ships, natural persons or/and goods (security). The processing is necessary for the purposes of the legitimate interests we pursue as a data controller (article 6 para. 1. (f) GDPR) and / or a statutory obligation in this regard to take measures for the protection of space (e.g. obligation of owner, ship-owner, etc.), as each time this arises or is imposed by applicable law.
4. Legal interests
Our legal interest is the need to protect our premises as detailed above and the goods included against illegal actions, such as, indicatively, thefts. We also need to ensure life safety, physical integrity, health as well as the property of our staff and of third parties lawfully located in the areas under surveillance. We only collect image data and limit the surveillance to places where we have previously assessed that there is an increased possibility of illegal actions e.g. such as thefts, on the cashiers, or in the entrance, without focusing on places where privacy of the persons captured by the CCTV may be severely restricted, including their right to respect of their personal data.
The material held is accessible only by our competent / authorized personnel who is in charge of security of the premises as detailed above. This material shall not be disclosed to third parties without the consent of the data subject, except in the following cases: (a) to the competent Judicial, Prosecutorial and Police Authorities when it contains information necessary to investigate a criminal offense involving persons or goods of the data controller; (b) to the competent Judicial, Prosecutorial and Police Authorities when lawfully requesting data in the performance of their duties, and (c) to the victim or perpetrator of a criminal offense, in the case of data which may constitute evidence of the offense.
6. Data Retention
We keep the data of the building premises for three (3) days, following which, they are automatically deleted. In the ships, we keep the data for as long as it is provided by the Safety Regulations and in accordance with the principles of proportionality and minimization for a time period not exceeding fifteen (15) days. In the event that during these periods an incident occurs, we isolate part of the video and keep it for another (1) month, in order to investigate the incident and initiate legal proceedings to defend our legal interests, while if the incident concerns third parties, we will keep the video for up to three (3) more months.
7. Data subjects’ rights
Data subjects have the following rights:
- Right of access: you have the right to be aware whether we process your images and if so, to receive a copy of them.
- Right to restriction of processing: you have the right to request us to restrict processing, for example, you may ask us not to delete data that you deem necessary to establish, exercise or support legal claims.
- Right to object: you have the right to object to the processing.
- Right to erasure: you have the right to request that we erase your personal data.
8. Right to lodge a complaint
In case you consider that the processing of your data violates Regulation (EU) 2016/679, you have the right to lodge a complaint with the competent Supervisory Authority. The competent Supervisory Authority in Greece is the Hellenic Data Protection Authority, 1-3 Kifisias Avenue, 11523, Athens, https://www.dpa.gr/, telephone number +30-210-6475600.