PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA THROUGH A VIDEO SURVEILLANCE SYSTEM (CCTV)
1. Data Controller:
SUPERFAST FERRIES, an Attica Group company, headquartered in Kallithea at the junction of 1-7, Lysikratous Street & Evripidou Street, GR-17674, e-mail: marketing@superfast.com, Tel. No: +30 210-8919000
2. Data Protection Officer:
PISTIOLIS – TRIANTAFYLLOS & ASSOCIATES LAW FIRM, ANDERSEN LEGAL, Greece, email: dpo@attica-group.com
3. Purpose and legal basis of the data processing:
We use closed-circuit television (CCTV) in order to protect premises, ships, natural persons or/and goods (security). The processing is necessary for the purposes of the legitimate interests we pursue as a data controller (article 6 para. 1. (f) GDPR) and / or a statutory obligation in this regard to take measures for the protection of space (e.g. obligation of owner, ship-owner, etc.), as each time this arises or is imposed by applicable law.
4. Legal interests
Our legal interest is the need to protect our premises as detailed above and the goods included against illegal actions, such as, indicatively, thefts. We also need to ensure life safety, physical integrity, health as well as the property of our staff and of third parties lawfully located in the areas under surveillance. We only collect image data and limit the surveillance to places where we have previously assessed that there is an increased possibility of illegal actions e.g. such as thefts, on the cashiers, or in the entrance, without focusing on places where privacy of the persons captured by the CCTV may be severely restricted, including their right to respect of their personal data.
5. Recipients
The material held is accessible only by our competent / authorized personnel who is in charge of security of the premises as detailed above. This material shall not be disclosed to third parties without the consent of the data subject, except in the following cases: (a) to the competent judicial, prosecutorial and police authorities when it contains information necessary to investigate a criminal offense involving persons or goods of the data controller; (b) to the competent judicial, prosecutorial and police authorities when lawfully requesting data in the performance of their duties, and (c) to the victim or perpetrator of a criminal offense, in the case of data which may constitute evidence of the offense. 6. Data Retention We keep the data of the building premises for three (3) days, following which they are automatically deleted. In the ships, we keep the data for as long as it is provided by the Safety Regulations and in accordance with the principles of proportionality and minimization for a time period not exceeding fifteen (15) days. In the event that during these periods an incident occurs, we isolate part of the video and keep it for another (1) month, in order to investigate the incident and initiate legal proceedings to defend our legal interests, while if the incident concerns third parties, we will keep the video for up to three (3) more months.
6. Data Retention
We keep the data of the building premises for three (3) days, following which they are automatically deleted. In the event that during these periods an incident occurs, we isolate part of the video and keep it for another (1) month, in order to investigate the incident and initiate legal proceedings to defend our legal interests, while if the incident concerns third parties, we will keep the video for up to three (3) more months.
In particular, it is pointed out that, in the case of video surveillance systems installed on ships, some of them monitor the movements of individuals in real time, without storing and recording the data received.
7. Data subjects’ rights
Data subjects have the following rights:
- Right of access: you have the right to know if we process your image and if so, to receive a copy of it, if the image is recorded.
- Right to restriction of processing: you have the right to request us to restrict processing, for example, you may ask us not to delete data that you deem necessary to establish, exercise or support legal claims.
- Right to object: you have the right to object to the processing.
- Right to erasure: you have the right to request that we erase your personal data.
You may exercise your rights by sending an e-mail to dpo@attica-group.com or a letter to our postal address 1-7, Lysikratous Street & Evripidou Street, GR-17674, Kallithea or by submitting the request to us in person, at the address of the company. To examine a request related to your image, you should tell us when you were within the range of the cameras and give us a picture of you to facilitate us to locate your data and hide the data of third parties pictured. Alternatively, we give you the opportunity to come to our facilities to show you the images in which you appear. Moreover, we would like you to note that exercising the right to object or the right to erasure does not imply the immediate erasure of data or the modification of the processing. In any case, we will answer you in detail as soon as possible, within the deadlines set by the GDPR.
8. Right to lodge a complaint
In case you consider that the processing of your data violates Regulation (EU) 2016/679, you have the right to lodge a complaint with the competent supervisory authority. The competent supervisory authority in Greece is the Hellenic Data Protection Authority, Kifisias Avenue 1-3, 11523, Athens, https://www.dpa.gr/, telephone number +302106475600.