INFORMATION ON THE PROCESSING OF PERSONAL DATA

SUBJECTED TO VIDEO SURVEILLANCE

The information is prepared in compliance with the provisions of Article 13 of the EU Regulation 2016/679, Article 3.1 of the Video Surveillance Measure of the Privacy Authority – April 8, 2010.

This document is intended to provide interested parties with information about video surveillance systems, their use and their rights.

1. DATA CONTROLLER

The data controller is Thai si with registered office at Via G. Vecellio, No. 56/a in Lovadina di Spresiano, in the person of the legal representative.

The following contact information is given:

telephone: 0422/881350

email address: amministrazione@thai-si .it;

pec address: thai-si@pec.it;

2. INTERNAL EMPLOYEE – Video Surveillance System Administrator.

According to Art. 4 n. 10) EU Reg. 679/2016 and Articles 4 paragraph 1(h) and 30 of Leg. 196/2003 and ss.mm.ii. The Data Controller has entrusted Mr. DISA FEDERICO with the processing of data related to the installed Video Surveillance systems.

The following contact details are given

telephone: 0422/881350;

email address: amministrazione@thai-si .it;

pec address: thai-si@pec.it;

3. PURPOSE OF THE TREATMENTS

The personal data collected and processed through the video surveillance system are the images of people and things that are within the range of the cameras. These images are processed exclusively in pursuit of the purposes of ensuring the safety and security of the Owner’s personnel, visitors as well as for the purpose of protecting the company’s assets by preventing and prosecuting the commission of any unlawful acts.

4. LEGAL BASIS FOR PROCESSING

The video surveillance activity is based on the pursuit of the legitimate interest (Article 6(1)(f) of the GDPR) to carry out the processing for the purposes stated in Section III. Of this disclosure. The Holder reserves the right to exhibit whatever is necessary to justify its use.

5. DATA RECIPIENTS

They will be able to access the data for the purposes stated in Section III:

– The Data Controller;

– The in-house appointee and a limited number of employees appointed by the appointee on the basis of specific instructions from the Controller, who will carry out the processing activities in accordance with the principle of minimization.

– The Data Processor (if appointed) and his/her appointees.

6. EXTERNAL SUBJECTS

The data may be disclosed to public entities with the legitimacy to request the data, such as judicial and/or public security authorities.

7. TRANSFER OF DATA TO THIRD COUNTRIES AND/OR INTERNATIONAL ORGANIZATIONS

The data acquired, will not be transferred abroad, either within or outside the European Union.

8. PROCESSING METHODS AND DATA RETENTION PERIOD

The video surveillance system is equipped with No. 4 total cameras and allows:

– The viewing of images in real time (“live”);

– The recording of images.

The video surveillance system is in operation 24/7.

The viewing and management of images taken through the video surveillance system are reserved for the data controller and/or persons formally appointed by them. Data are stored with the use of appropriate security measures to prevent access by unauthorized personnel and to ensure the confidentiality and integrity of the data.

The images contained in the video recordings shall be retained, ordinarily, for a maximum of 48 hours after detection, subject to special requirements for further retention in connection with holidays or closure of offices and services, as well as in the case of adhering to a specific investigative request of the judicial authority or law enforcement agencies. After that time, the images will be automatically deleted.

9. RIGHTS OF THE DATA SUBJECT

The data subject (i.e., the person who believes he or she has been filmed), may exercise all the rights provided for in Article 15 et seq. of the European Regulation against the Controller. In particular:

– Ask the owner for access to the images;

– object to the processing;

– Request restriction of processing and/or cancellation where applicable.

The right to update or supplement as well as the right to rectification under Article 16 of the GDPR cannot be exercised in practice in view of the intrinsic nature of the data processed (images collected in real time concerning an objective fact). The right to data portability under Article 20 of the GDPR cannot be exercised because the images captured by the video surveillance system-except in the cases referred to in Section VI of this notice-cannot be transferred to other parties.

You may request to see the images in which you believe you were filmed by showing, or attaching to your request, appropriate identification documents. The response to a request for access may not include any data referring to third parties, unless the breakdown of the data processed or the deprivation of certain elements renders the personal data relating to the data subject incomprehensible.

After the above retention periods have expired, it will be impossible to fulfill the access request.

10. METHODS OF EXERCISING RIGHTS AND COMPLAINT TO THE DATA PROTECTION AUTHORITY

In order to exercise the rights just described, data subjects may contact the data controller using the contact details given in Section I. of this policy. To the same end, as well as to report any violations of the rules on the processing of personal data, the data subject may contact the Data Controller’s appointee Mr. by e-mail at amministrazione@thai-si.it as well as directly to the Data Controller by e-mail at amministrazione2@thai-si.it using the complaint form published at https://thai-si.it/videosorveglianza/

The request will be answered as soon as possible. The Regulations, in this regard, stipulate that a response must in any case be provided within one month of the request, extendable up to three months in cases of particular complexity.

The data subject also has the right to lodge a complaint with the supervisory authority under Article 77 of the Regulations. In Italy, the supervisory authority function is exercised by the Garante per la protezione dei dati personali (
https://www.garanteprivacy.it
).

11. MANDATORY OR OPTIONAL NATURE OF DATA PROVISION

The provision of data is mandatory and is strictly instrumental for access to the Owner’s premises. In case of failure to confer, no access to the premises is possible.

This policy may be modified and/or updated over time. Therefore, it is recommended to consult and refer to the most recent version.

Spresiano, 31/01/2024

The Data Controller