Special CCTV Statement
1. Data Controller
EPAFOS Single-Member S.A., 46-48 Eleftheriou Venizelou Avenue, 17676, Athens, Tel. 2106990401
Purpose and Legal Basis of Processing:
We use a surveillance system for the purpose of protecting individuals and property. The processing is necessary for the purposes of legitimate interests pursued by us as the data controller (Article 6, paragraph 1(f) of the GDPR).
2. Analysis of Vested Interests
Our vested interest lies in the need to protect our premises and the property located within them from illegal acts, such as theft. The same applies to the safety of life, physical integrity, health, and property of our staff and third parties lawfully present in the monitored area. We collect only image data and limit recording to areas evaluated as having a higher likelihood of illegal acts occurring, e.g., theft, such as entrances, without focusing on areas where individuals’ privacy might be excessively restricted, including their right to respect for personal data.
3. Recipients
The recorded material is accessible only to our authorized/appointed personnel responsible for site security. This material is not disclosed to third parties, except in the following cases:
- To competent judicial, prosecutorial, and police authorities when it contains elements necessary for investigating a criminal act involving persons or property of the data controller.
- To competent judicial, prosecutorial, and police authorities when they lawfully request data in the exercise of their duties.
- To the victim or perpetrator of a criminal act when the data may constitute evidence of the act.
4. Retention Period
We retain the data for thirteen (13) days, after which it is automatically deleted. In case an incident is detected within this period, we isolate a segment of the video and retain it for up to one (1) additional month to investigate the incident and initiate legal proceedings to defend our legitimate interests. If the incident involves a third party, we retain the video for up to three (3) additional months.
5. Rights of Data Subjects
Data subjects have the following rights:
- Right of Access: You have the right to know whether we are processing your image and, if so, to receive a copy of it.
- Right to Restriction: You have the right to request that we restrict processing, such as refraining from deleting data you deem necessary for the establishment, exercise, or defense of legal claims.
- Right to Object: You have the right to object to the processing.
- Right to Erasure: You have the right to request that we delete your data.
To exercise any of the above rights, you may contact the Data Protection Department at: [email protected].
If you wish to contact the Data Protection Officer, please email: [email protected], call 2106990401, or send a letter to our postal address, or submit your request in person. To process a request related to your image, you must specify approximately when you were within the cameras’ range and provide us with a photo of yourself to help identify your data and obscure the data of other individuals depicted. Alternatively, you can visit our premises to view the images in which you appear. Note that exercising the right to object or erasure does not entail the immediate deletion of data or modification of processing. In any case, we will provide a detailed response as soon as possible, within the GDPR deadlines.
6. Right to File a Complaint
If you believe that the processing of your data violates Regulation (EU) 2016/679, you have the right to file a complaint with a supervisory authority.
The competent supervisory authority in Greece is the Hellenic Data Protection Authority, 1-3 Kifisias Ave., 115 23, Athens, https://www.dpa.gr/, Tel. 2106475600
Written on July 31, 2023.
Last updated: May 24, 2024.