CCTV Personal Data
CUSTOMER NOTICE
Processing of Personal Data through a Video Surveillance System
Data Controller:
MARKS AND SPENCER HELLAS SINGLE MEMBER INDUSTRIAL, COMMERCIAL AND TECHNICAL S.A.
Ermou 33–35, Athens, GR-10563
Tel.: +30 211 1087300
Purpose of Processing and Legal Basis:
We use a video surveillance system for the purpose of safeguarding individuals and property. The processing is necessary for the purposes of the legitimate interests we pursue as the data controller, in accordance with Article 6(1)(f) of the General Data Protection Regulation (GDPR).
Analysis of legitimate interests
Our legitimate interest is the need to protect our premises, and the goods located therein from unlawful acts, such as, but not limited to, theft. The same applies to the safety of life, physical integrity, health and property of our staff and third parties lawfully present in the premises. We only collect image data and limit the capture to areas where we have assessed that there is an increased likelihood of committing illegal acts e.g. theft, such as in our cashiers and entrances, without focusing on areas where the privacy of the persons monitored may be excessively restricted, including their right to respect for personal data.
Recipients
The material held is accessible only by our competent/authorised personnel who are responsible for the safety of the site. Such material shall not be transferred to third parties, except in the following cases: a) to the competent judicial, prosecutor and police authorities when it contains data necessary for the investigation of a criminal offence concerning persons or property of the controller, b) to the competent judicial, prosecutorial and police authorities when they request data lawfully in the exercise of their duties, and c) to the victim or perpetrator of a criminal offence when it concerns data which may constitute evidence of a criminal offence.
Data retention period
We keep the data for fifteen (15) days, after which they are automatically deleted. In the event that during this period we detect an incident, we will isolate part of the video and keep it for up to one (1) month more, in order to investigate the incident and initiate legal proceedings to defend our legal interests, while if the incident concerns a third party we will keep the video for up to three (3) months more.
Rights of data subjects
Data subjects have the following rights:
– Right of access: you have the right to know whether we are processing your image and, if so, to receive a copy of it.
-Right to Restriction: You have the right to request the restriction of processing, for example, not to delete data that you consider necessary for the establishment, exercise, or defense of legal claims.
– Right to object: you have the right to object to processing.
– Right to erasure: you have the right to request that we erase your data.
You may exercise your rights by contacting us via email at GR.dataprivacy@marks-and-spencer.com or by post, via a letter to our postal address 33-35 Ermou Street, Athens P.O. Box 10563, to the attention of our Data Protection Officer, Mr. Anastasopoulos Konstantinos.
In order for us to assess a request related to your image, you will need to specify the approximate time you were within camera range and provide a photo of yourself to help us facilitate the identification of your own data and the concealment of the data of third persons depicted. Please note that exercising the right to object or the right to erasure does not imply immediate deletion of data or cessation of processing. In any case, you will receive a detailed response as soon as possible and within the timeframes established by the GDPR.
Right to file a complaint
If you believe that the processing of your data infringes Regulation (EU) 2016/679, you have the right to file a complaint with a supervisory authority.
The competent supervisory authority for Greece is the Data Protection Authority, Kifissias 1-3, 115 23, Athens, Greece, https://www.dpa.gr/, tel. 2106475600.
