VIDEO SURVEILLANCE (CCTV)
Skrivanek Sp. z o.o. („organization”) carries out video surveillance of its immovable property at Podlaska 12, 20-304 Lublin.
1. Purpose of video surveillance
Video surveillance is necessary for the protection of property, for the safety of employees and persons visiting Skrivanek sp. z o.o. office and building and for insuring secrecy of information whose unauthorized disclosure could cause damage to the organisation.
2. Areas under video-surveillance
Video- surveillance is carried out in the limited areas in the building at Podlaska 12 in Lublin: entrances to the building, staircase and in the areas in close proximity to the building, including limited parts of a parking lot and of Podlaska street. Graphic signs containing organisation details are displayed in the monitored area.
Camera locations are chosen to minimise viewing of spaces not relevant to the legitimate purpose of the monitoring. CCTV monitoring does not cover sanitary facilities or any other locations mentioned in art. 22 2§2 of Labour Code of 26 June 1974 r.
3. Data processing information
3.1. Data controller and contact data
Skrivanek Sp. z o.o. with its seat at pl. Konstytucji 6/75, 00-550 Warszawa is the Data Controller of all the data collected as a result of the operation of its CCTV .
Contact person with regard to issues related to the processing of personal data: Data Protection Officer – Elżbieta Majcher, tel.: 609 446 720; e-mail: [email protected].
3.2. Legal basis
Art.6.1 (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR); art. 222 of the Act of 26 June 1974 – Labour Code.
It is the Controller’s legitimate interest to ensure the safety of persons and the protection of property within the area under video surveillance. A legitimate interest assessment has been conducted to ensure that the interests of the organisation does not outweigh that of the data subject and that video surveillance is proportionate and necessary to achieve its purpose.
3.3. Data collection
Data is collected automatically upon entering the monitored area. Cameras capture video footage but do not record sound. Recording is continuous, 24 hours a day.
3.4. Access to data; Recipients
Only data controller and its authorised personnel has access to the data collected as a result of the operation of CCTV.
Video footage may be disclosed upon request of the data subject as well as to entities authorised by law, e.g. police, investigating and judicial authorities for the execution of their legitimate tasks and upon providing legal basis of such disclosure.
Video footage may be secured upon a justified written request of a third party, who will show the legitimate interest in doing so.
Each request for disclosure/securing of video footage by agencies/third parties is subject to registration and assessment with the involvement of a data protection officer, seeing that the rights of individuals are not prejudiced.
3.5. Data transfers outside the EEA
Personal data are not intended to be transferred to a third country which is not a Member State of the EU or EEA or to an international organisation.
3.6. Retention of data
CCTV footage is stored for the period not exceeding 3 months from the date of recording. If the footage is used, or there is a reasonable information that it may be used as evidence in proceedings on the basis of provisions of law, the retention period is prolonged until the conclusion of such proceedings. Afterwards, the footage is deleted.
3.7. Data security
The footage is stored in a secure, local place in a way that prevents its inappropriate and unauthorised use. No backup copies are made of the video surveillance recordings and the data shall not be disclosed to third parties, except as provided for in 3.4 above. Each case when personal data recorded on CCTV footage is legally disclosed is subject to registration in accordance with internal regulations of the Data Controller.
3.8. Profiling
During processing of data no automatic decisions shall be made, including profiling.
3.9. Data subject rights
3.9.1. A person recorded by CCTV has a right of access to personal data collected about him/her and to obtain information on data recipients to whom such data was disclosed within a specified period of time.
The right of access/information may be restricted in justified cases such as protection of the data of other parties covered by CCTV or the establishment, exercise or defence of legal claims and proceedings conducted by parties authorised by law. The Data Controller shall take measures not to display images of parties other than the requesting data subject. The information to be provided to the data subject shall not include public authorities that are conducting criminal proceedings, subjects of operational activities or other authorities about which the law prohibits disclosure of such information.
To facilitate the processing of such request, the controller will require of the data subject to provide the details necessary to identify the data subject and the personal data requested, e.g. indication of date and time of the footage. Without such details, the Controller may refuse to provide requested information.
3.9.2. A person recorded by CCTV has a right to request erasure of his/her data ( under art. 17 of the GDPR e.g. if the data processing violates the law).
3.9.3. A person recorded by CCTV has a right to request that processing of his/her data be restricted e.g. when data is required for the establishment, exercise or defence of legal claims.
3.9.4. A person recorded by CCTV has a right to file a complaint with the President of the Office for Personal Data Protection (ul. Stawki 2, 00-193 Warsaw), if he/she believes that the Data Controller’s processing violates the provisions of the GDPR