Video Surveillance Policy

This information has been prepared in compliance with the provisions of art. 13 of EU Regulation 2016/679 (also known by the acronym GDPR) and art. 3.1 of the Privacy Authority’s Provision on video surveillance – 8 April 2010 in order to provide information relating to video surveillance systems, their use and the rights of data subjects.

A. Data Controller and Data Protection Officer

Erbe Mate, as identified on the appropriate Legal Information page, informs that it is the Data Controller of personal data pursuant to Article 4, no. 7 of EU Regulation 2016/679. The data provided will be processed in a lawful, correct and transparent manner, in compliance with the principles set forth in art. 5 of the aforementioned regulation and, in general, of the rights and freedoms of the data subject. Further communications may be provided at a later date, including verbally.

B. Data subject to processing

Article 4(1) of EU Regulation 2016/679 defines “personal data” as any information relating to an identified or identifiable natural person (“data subject”); An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In the specific case of video surveillance, the data subject to processing are images of people and things that are within the shooting range of the cameras installed on the Data Controller’s premises.

C. Purpose of the processing

The personal data provided will be processed exclusively for the following purposes:

  • safety and security of the Data Controller’s employees, customers and suppliers;
  • protection of the Data Controller’s assets, preventing and prosecuting the performance of any unlawful acts.

D. Legal basis for the processing

The legal basis of the video surveillance activity must be identified in the legitimate interest of the Data Controller (Article 6, paragraph 1, letter f, of EU Regulation 2016/679) to carry out the processing for the purposes indicated in Paragraph C.).

E. Nature of the provision of data

The provision of data is mandatory in relation to the purposes referred to in Paragraph C.) it is related to the reasons why employees, customers and suppliers access the Data Controller’s premises.

In case of failure to provide it, it is not possible to access the Data Controller’s premises.

F. Communication to third parties and/or dissemination of data

The viewing and management of the images taken through the video surveillance system are reserved to the Data Controller and/or to the employees authorized by the former in writing.

The data may also be communicated to parties external to the Data Controller, if this is necessary to comply with an obligation provided for by law and/or an order of the judicial and/or public security authority.

G. Intention to transfer data abroad

The data will not be transferred to third countries (not belonging to the European Union).

H. Data Retention Period

The images contained in the video recordings are normally kept for a maximum of 1 days from the recording, except for special needs of further storage in relation to holidays or the closure of offices and services, as well as in the event that it is necessary to comply with a specific investigative request from the judicial authority or the police. After this period, the images will be automatically deleted.

I. Methods of data processing

Personal data will be processed and stored exclusively for the purposes referred to in Paragraph C.), through the use of automated and telematic supports, inserted in relevant databases and processed with suitable tools to guarantee the integrity, security and confidentiality of the data themselves.

The Data Controller adopts all appropriate technical and organizational measures to ensure that the processing is carried out in compliance with EU Regulation 2016/679. Access to personal data is granted only to persons authorised to process personal data.

J. Rights of the data subject

The interested party may, at any time, exercise the rights referred to in EU Regulation 2016/679 and, in particular:

  • right of access to personal data;
  • the right to obtain the rectification or erasure of the same or the limitation of the processing of data concerning him/her;
  • the right to object to processing;
  • right to data portability;
  • the right to withdraw consent, where provided for (the withdrawal of consent does not affect the lawfulness of the processing based on the consent given before its withdrawal);
  • the right to lodge a complaint with the supervisory authority (Garante Privacy).

In consideration of the type of data processed and the retention times, the right to update or integration, as well as the right to rectification referred to in Article 16 of the GDPR, will not always be exercisable in practice. The right to data portability pursuant to art. 20 of the GDPR as the images acquired with the video surveillance system – except in the cases referred to in Paragraph F.), paragraph 2 above – cannot be transferred to other subjects.

The exercise of the aforementioned rights may take place by sending a communication to the addresses indicated on the appropriate Legal Information page.