Information on the processing of personal data through video surveillance system
Data Controller:
HELLENIC HYDROCARBONS AND ENERGY RESOURCES MANAGEMENT COMPANY (HEREMA), 18 Dimitriou Margaris, Athens, Greece
Purpose of processing and legal basis:
We use a surveillance system for the purpose of protecting persons and property. The processing is necessary for the purposes of legitimate interests pursued by us as a Controller (Article 6(1)(f) General Data Protection Regulation - GDPR).
Analysis of legitimate interests
Our legitimate interest consists in the need to protect our premises and the goods therein from unlawful acts, such as theft. The same applies to the safety of the life, physical integrity, health and property of our staff and third parties lawfully present in the premises under surveillance. We only collect image data and limit the capture to areas critical to the security of the building (e.g. entrance, stairwell, parking lot), without focusing on areas where the privacy of the persons whose image is captured may be unduly restricted, including their right of respect of personal data.
Recipients
The recording that is maintained is accessible only by our competent/authorized personnel who are in charge of the security of the site. This recording is not transmitted to third parties, except in the following cases:
(a) to the competent judicial, prosecutorial and police authorities where it contains information necessary for the investigation of a criminal offence involving persons or property of the controller;
(b) to the competent judicial, prosecutorial and police authorities when they request data, lawfully, in the exercise of their duties ; and
(c) to the victim or perpetrator of a criminal offence, where the data concerned are likely to constitute evidence of the offence.
Time of retention
We keep the data for seven (7) days, after which it is automatically deleted. In the event that during this period we detect an incident, we will isolate part of the video and keep it for up to one (1) additional month, in order to investigate the incident and initiate legal proceedings to defend our legitimate interests, while if the incident concerns a third party we will keep the video for up to three (3) additional months.
Rights of the data subjects
Data subjects have the following rights:
- Right of access: you have the right to know whether we are processing your image and, if so, to receive a copy of it.
- Right to restriction: you have the right to ask us to restrict processing, such as not deleting data that you consider necessary for the establishment, exercise or support of legal claims.
- Right to object: you have the right to object to processing.
- Right to erasure: you have the right to request that we delete your data.
You can exercise your rights by sending an e-mail to dpo@herema.gr or by submitting your request to us in person at the company's address. In order for us to consider a request related to your image, you will need to identify approximately when you were in range of the cameras and provide us with an image of you to help us identify your own data and hide the data of third-party subjects. Alternatively, we give you the option of coming to our premises to show you the images in which you appear. We highlight that exercising the right to object or erasure does not imply the immediate deletion of data or the modification of processing. In any case, we will reply to you in detail as soon as possible, within the time limits set by the GDPR.
Right to lodge a complaint
If you believe that the processing of your data infringes Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority.
The competent supervisory authority for Greece is the Data Protection Authority, Kifissias 1-3, 115 23, Athens, Greece, https://www.dpa.gr/ , tel. 2106475600.