GDPR Information Notice (Article 13) – Video Surveillance

1. Data collected

Images (without audio recording) are captured by video surveillance cameras installed in areas identified by information signage.
Areas open to the public are subject to image blurring.

2. Purposes and legal basis

Data are processed for the following purposes:

  • security of persons, premises and equipment;

  • prevention, detection and investigation of incidents.

The legal basis for the processing is legitimate interest (Article 6(1)(f) GDPR).

Information signs specify in particular the purposes of the video surveillance system, the data retention period, the contact details of the DPO, and the rights of data subjects.

3. Recipients / access

Access to the images is strictly limited to authorized personnel (security, human resources).
Images may be disclosed to competent authorities where necessary.

4. Transfers outside the European Union

No routine transfers outside the European Union are carried out.
Recordings are stored on secure systems located within the European Union.

5. Data retention periods

Images are retained for a maximum period of 30 days.
This period may be extended only in the event of an incident or investigation, for the duration strictly necessary for the related procedure.

6. Mandatory nature of data and consequences

Image capture is automatic in areas covered by the video surveillance system.
No data are required from data subjects; however, presence in these areas may result in the recording of their image.

7. Automated decision-making

No automated decision-making producing legal or similarly significant effects is based on video surveillance images.

8. Your GDPR rights and how to exercise them

You have the following rights:

  • right of access to your data (Article 15);

  • right to rectification (Article 16);

  • right to erasure (Article 17);

  • right to restriction of processing (Article 18);

  • right to object (Article 21);

  • right to data portability (Article 20, where applicable);

  • right to withdraw your consent at any time (without retroactive effect).

To exercise your rights, you may contact the Data Protection Officer (DPO) or the data controller.
The response time is one month and may be extended by two months in the event of a complex request.