CCTV System & Personal Data

Information on the processing of personal data through video surveillance system (CCTV)

1. Data Controller

Centre for Research and Technology Hellas (CERTH) – Chemical Process and Energy Resources Institute (CPERI).
Headquarters: 6th km Charilaou – Thermi Rd, 57001 Thermi, Thessaloniki (Greece).
Branch: 4th km Ptolemais -Mpodosakeio Hospital, Region of Kouri, 50200, Ptolemais (Greece).

2. Purpose and legal basis of processing

The Chemical Process and Energy Resources Institute of CERTH (hereinafter referred to as the “Institute” or “CPERI”) uses a surveillance system at its branch facilities in Ptolemais (Greece) for the purpose of protecting persons and property. Processing is necessary for the purposes of the legitimate interests pursued by the Institute as the data controller (Article 6 par. 1 (f) GDPR).

3. Analysis of legitimate interests

The Institute’s legitimate interest lies in the need to protect its premises and the goods contained therein from unlawful acts, such as theft, robbery, vandalism, etc. The same applies to the safety of life, physical integrity, and health, as well as the property of the Institute’s staff and third parties legally present in the area under surveillance. Only visual information (images and videos) is collected through the surveillance system. The capture of this information is limited only to the necessary areas to achieve the intended processing purposes, such as areas with an increased likelihood of illegal activity, e.g., the entrance of the building. Image data is not collected from areas where the privacy of individuals may be excessively impacted, including their right to the protection of personal data.

4.  Recipients

The recorded material is accessible only by the competent authorized personnel of the Institute. This material is not transmitted to third parties, except in the following cases: a) to the competent judicial, prosecuting, and police authorities when it contains information necessary for the investigation of a criminal offense involving persons or property of the Institute, b) to the competent judicial, prosecuting, and police authorities when they lawfully request data in the performance of their duties, and c) to the victim or perpetrator of a criminal act in the case of data which may constitute evidence of such act. Access to the material may also be granted to external partners of the Institute for fulfilling the purposes of processing, such as technical support or maintenance needs of the surveillance system. It is noted that these partners are contractually bound to the Institute regarding confidentiality and security of personal data.

5. Retention Period

The Institute retains the data for fifteen (15) days, after the lapse of which they are automatically deleted. If an incident is identified within this period, a part of the video is isolated and kept for up to thirty (30) additional days to investigate the incident and start legal proceedings to defend the Institute’s legitimate interests. If the incident concerns a third natural or legal person, the video may be kept in a separate file for up to three (3) more months.

6. Rights of Data Subjects

Data subjects have the following rights:

• Right of Access: You have the right to know if your image is being processed and, if so, to receive a copy of it.
• Right to Restriction of Processing: You have the right to request the restriction of the processing, such as not deleting data you deem necessary to establish, exercise, or defend legal claims.
• Right to Object to processing: You have the right to object to the processing.
• Right to Erasure: You have the right to request the deletion of your data.

You may exercise your rights by sending an email to dpo@certh.gr or a letter to the postal address of the Institute, or by submitting your request in person at the CPERI branch in Ptolemais (Greece). To examine a request related to your image, you must prove your identity, specify approximately when you were within the camera’s range, and provide an image of yourself to help the Institute identify your data and hide the data of third-party images. Alternatively, you may visit the Institute’s premises in Ptolemais to view the images in which you appear. Note that the exercise of the right to object to processing or erasure does not imply the immediate erasure of data or the modification of the processing. In any case, you will receive a response to your request as soon as possible within the deadlines set by General Data Protection Regulation (EU) 2016/679.

7. Right to Lodge a Complaint

In case you consider that the processing of your data violates General Data Protection Regulation (EU) 2016/679, you have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 11523, Athens, https://www.dpa.gr/, tel. 210 6475600.

Last update: July, 2024