CCTV

CCTV Information on personal data processing through a video surveillance system

• Data controller:

MYTILINEOS S.A., 8 Artemidos Street, GR-15125 Maroussi, Tel. 210 6877300

• Purpose of processing and legal basis:

We use a surveillance system for the purpose of protecting people and goods. Processing is necessary for the purposes of the legitimate interests pursued as controller (Article 6, para. 1f of GDPR).

• Analysis of legitimate interests

Our legitimate interest means the need to protect our premises and the goods located thereof against illegal acts, including, but not limited to, theft. The above statement also applies for the protection of life, physical integrity, health and property of our staff and third parties who are legally present in the premises under surveillance. We only collect image data and limit recording to premises where we have assessed that there is an increased likelihood of unlawful acts, such as theft, such as our coffers and entry, without focusing on areas where the privacy of the persons whose image is being captured may be severely restricted, including their right to personal data respect.

• Recipients

The kept material can only be accessed by our competent / authorized personnel responsible for the premises safety. This material shall not be transferred to third parties, except in the following cases: (a) to the competent judicial, prosecution and police authorities if it contains information necessary for the investigation of a criminal offense concerning persons or commodities of the controller; (b) to the competent judicial, prosecution and police authorities when requesting data, lawfully, in the exercise of their functions; and (c) to the victim or the offender of a criminal offense, in the case of data likely to constitute evidence of the offense.

• Time of record-keeping

We retain data for fourteen (14) days; upon lapse of this period, data are automatically deleted. Should an incident be observed during that time, we isolate part of the video and keep it for up to one (1) month longer, to investigate the incident and initiate legal proceedings to defend our legitimate interests; if the incident involves a third party, we will keep the video for up to three (3) months more.

• Data subject's rights

Data subjects shall have the following rights:

1. Right of access you have the right to know whether we are processing your image and, if so, to obtain a copy of it.
2. Right to restrict processing: you have the right to ask us to restrict processing, for example not to delete data that you consider necessary to establish, pursue or support legal claims.
3. Right to Object: you have the right to oppose processing.
4. Right to erasure: you have the right to request that we delete your data.

You may exercise your rights by sending an e-mail to DPO@mytilineos.gr or a letter to our mailing address or by submitting the request to us in person at the address of the branch or office premises for the attention of DPO. To review a request related to your image, you should determine approximately the time when you were within the range of the cameras and provide us with a picture of you to help us identify your data and to hide the data of depicted third-parties. We also note that the exercise of the right to object or delete does not incur immediate deletion of data or modification of processing. In any event, we will respond in detail to you as soon as possible, within the deadlines set by the GDPR.

• Right to file a complaint

If you consider that the processing of your data infringes Regulation (EU) 2016/679, you are entitled to file a complaint with a supervisory authority.

The competent supervisory authority in Greece is the Data Protection Authority, 1-3 Kifisias Street, GR-115 23, Athens, https://www.dpa.gr/, tel: 2106475600