Notice on CCTV Personal Data Processing

1. Data controller:

“NAXOS RESORT BEACH HOTEL SINGLE MEMBER S.A.”, with the distinctive title “NAXOS RESORT” with registered office in Agios Georgios, Naxos, Greece, email: [email protected], tel: +30 22850 26650, website: https://naxosresort.gr/, hereinafter referred to as “the Company”.

2. Purpose of processing and legal basis:

We use a CCTV system to protect persons and goods in the hotel unit “NAXOS RESORΤ BEACH HOTEL” at Agios Georgios, Naxos, Greece, P.O. 84300. Processing is necessary for the purposes of the legitimate interests which we, as a data controller pursue (Article 6(1)(f) GDPR).

3. Analysis of legitimate interests

Our legitimate interest is the need to protect our premises and the goods located there from illegal acts, such as theft. The same also applies to the safety of life, physical integrity, health and the property of our staff and third parties who are lawfully present in the area under surveillance. We only collect image data and limit the recording of images to locations where we have determined that there is an increased likelihood of unlawful acts being committed e.g. theft, such as at our counters, entrances and exits, without focusing in on areas where the privacy of persons whose image is obtained, including their right to respect for personal data, may be excessively restricted.

4. Recipients

The materials held can only be accessed by our competent / authorised staff who are charged with site security. This material is not sent to third parties, with the exception of the following cases: data sent: a) to the competent judicial, prosecuting and police authorities when it includes information necessary to investigate a criminal act which relates to persons or the data controller’s goods, b) to the competent judicial, prosecuting and police authorities when they request data lawfully when discharging their duties, and c) to the victim or perpetrator of a criminal act in the case of data which could constitute evidence of the crime.

5. Retention period

We keep the data for seven (7) working days, subject to more specific provisions of the applicable legislation, after which they are automatically deleted. In the event that during this period we detect an incident, we will isolate part of the video and keep it in a separate file for up to thirty (30) days, in order to investigate the incident and initiate legal proceedings to defend our legitimate interests, while if the incident concerns a third party we will keep the video for up to three (3) months. In exceptional cases where the incident concerns the Company itself and requires further investigation (e.g. investigation of fraud or corruption in the context of internal control), the Company is obliged to notify the Data Protection Authority of the period of time needed to keep the record.

6. The rights of data subjects

Data subjects have the following rights:

  • Right of access: You are entitled to learn whether we are processing your image and, if so, to receive a copy of it.
  • Right to restrict processing: You are entitled to request the restriction of the processing, such as not deleting data you consider necessary to establish, exercise or support legal claims.
  • Right to object: You are entitled to object to the processing.
  • Right of erasure: You are entitled to request the deletion of your data.

You can exercise your rights by sending an email to the address [email protected] or a letter to our postal address or by submitting a request in person to the address where the CCTV system relevant to you is installed. To enable us to examine a request relating to your image, you need to specify when you were in the vicinity of the cameras and provide us with an image of you to make it easier for us to identify your own data and to conceal the data of third parties who were involved. Alternatively, we will allow you to visit our facilities to show you the images you appear in. We would also point out that the exercise of the right of objection or deletion does not imply the immediate deletion of data or the modification of the processing. In all events, we will respond in detail as soon as possible within the deadlines laid down by the GDPR.

7. Right to submit a complaint

If you consider that the processing of data relating to you is contrary to the Regulation (EU) 2016/679, you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) through the following link: https://eservices.dpa.gr/ and the completion of the appropriate electronic form depending on the kind of complaint.