CCTV Special Statement

Special information on the use of video surveillance systems

Data controller:

iStorm M.A.E. 19-20 Filikis Eterias Square, Athens, Postal Code 10673, email:info@istorm.gr, tel. : 211 9997590, website: www.istorm.gr

Purpose of processing and legal basis:

We use a surveillance system for the purpose of protecting persons and property. Processing is necessary for the purposes of legitimate interests pursued by us as the controller (Article 6(1)(f) GDPR).

Analysis of legitimate interests

Our legitimate interest consists in the need to protect our premises and the goods located therein from illegal acts, such as, for example, theft. The same applies to the safety of life, physical integrity, health and property of our staff and third parties who are legally present in the monitored premises. We only collect image data and limit the recording to areas where we have assessed that there is an increased possibility of committing illegal acts, e.g. theft, such as at our cash desks and at the entrance, without focusing on areas where the privacy of the persons whose image is taken may be excessively restricted, including their right to respect for personal data.

Recipients

The material kept is accessible only by our competent/authorized personnel who are in charge of the security of the site. This material is not transmitted to third parties without the consent of the subject, with the exception of the following cases: a) to the competent judicial, prosecutorial and police authorities when it includes data necessary for the investigation of a criminal act, which concerns persons or goods of the controller, b) to the competent judicial, prosecutorial and police authorities when they request data, lawfully, in the exercise of their duties, and c) to the victim or perpetrator of a criminal act, when it concerns data that may constitute evidence of the act.

Time of observance

We keep the data for up to fifteen (15) days, after which it is automatically deleted. In the event that we detect an incident during this period, we isolate part of the video and keep it for up to one (1) more month, in order to investigate the incident and initiate legal proceedings to defend our legitimate interests, while if the incident concerns a third party, we will keep the video for up to three (3) more months.

Rights of data subjects

Data subjects have the following rights:

• Right of access: you have the right to know whether we are processing your image and, if so, to receive a copy of it.
• Right to restriction: you have the right to ask us to restrict processing, such as not deleting data that you consider necessary for the establishment, exercise or defense of legal claims.
• Right to object: you have the right to object to processing.
• Right to erasure: you have the right to request that we delete your data.

To exercise any of your above rights, you can contact the Data Protection Department (DPO) of iStorm, at the following contact details: email: dataprotection@istorm.gr. In case you wish to contact the Data Protection Officer (DPO), email: dpo@istorm.gr, telephone: 211 9994480. Alternatively, you can send a letter to our postal address or submit the request to us in person, at the store address. In order for us to consider a request related to your image, you will need to specify to us approximately when you were within the range of the cameras and provide us with an image of you, in order to facilitate us in identifying your own data and in hiding the data of third parties depicted. Alternatively, we give you the opportunity to come to our facilities to show you the images in which you appear. We also point out that exercising the right to object or delete does not imply the immediate deletion of data or the modification of the processing. In any case, we will respond to you in detail as soon as possible, within the deadlines set by the GDPR.

Right to file a complaint

In case you consider that we have not adequately satisfied your request and the protection of your personal data is affected in any way, you can submit a complaint via a special web portal to the Personal Data Protection Authority (Athens, 1-3 Kifissias Avenue, P.C. 115 23 | tel: +30 210 6475600). Detailed instructions for submitting a complaint are provided on the Authority's website .