CCTV PBM Monitoring Privacy Notice

The company under the name “PBM S.R.L.”, having its registered seat at Via Barella, 1310, 41058 Vignola, Modena, Italy, telephone +39 059 770 5311, email info@gruppopbm.it (hereinafter the “Company”) is the Data Controller of your personal data, pursuant to EU General Data Protection Regulation 679/2016 (hereinafter “GDPR”) and applicable Italian legislation on the protection of personal data (in particular, Legislative Decree 196/2003 "Privacy Code", as novated by Legislative Decree 101/2018). This Privacy Notice is provided in order to inform you on the image and video data collected via CCTV monitoring.

Personal data we process

The personal data collected via CCTV monitoring is image and video data of employees, partners and third persons that visit the premises of our Company.

Purposes and legal basis of processing

The company uses the CCTV Monitoring System for the protection of people and assets in its premises and the support of any legal claims. The processing is necessary in the context of the legitimate interest of our Company that act as a Data Controller (article 6(1) (f) GDPR).

Analysis of legitimate interest

Our legitimate interest relies on the necessity to ensure the safety and security of our premises and our assets from illegal actions, such as thefts, as well as to ensure the physical integrity, health and safety of our employees, partners and third parties. Moreover, we process the abovementioned personal data for the effective management of any incidents and to provide relevant evidence to support any legal claims. We collect image and video data pursuant to the guidelines of the supervisory authorities and consequently, we do not monitor areas where your privacy would be excessively violated.

Recipients of your personal data

The CCTV footage is accessible by an external vendor, offering us security services for the purposes described above. We may transfer the CCTV footage in the following cases: a) to competent judicial and law enforcement authorities when the footage provides evidence that is necessary for the investigation of an illegal action, that affects people or assets related the data controller, b) to competent judicial and law enforcement authorities when they submit a request for data within the context of the exercise of their duties and c) to the victim or the perpetrator of an illegal action, when data may constitute evidence of proof

How does the Company protect your personal data?

We have implemented all appropriate organizational and technical measures, pursuant to applicable legal framework and standards in order to safeguard that processing of data, either by the Company or by any third-party which is legitimate, appropriate and secured against any non-authorized or illegal access, deletion, amendment or any other use of the data.

How long is your personal data retained?

The CCTV footage is retained for twenty-four hours (24h), except for the weekends, during which it is retained for forty-eight hours (48h). Upon the expiration of this period, the data is automatically deleted. In case we realize that an incident has occurred within this period, we shall proceed with the separate storage of this part of the video and it will be stored for one (1) month, in order for us to further investigate the incident and the initiation of any legal actions to ensure our legitimate interests. In case the incident refers to third persons, the footage will be retained for three (3) additional months.

What are your rights?

According to applicable legislation, you have the following rights:

a) right of access: you have the right to be informed about the processing of your data and if this is the case to receive a copy of your data

b) right to restriction of the processing of your personal data: you have the right to request the restriction of processing. For example, you have the right to request from the Company not to delete data that you consider necessary for the establishment, exercise or defense of legal claims

c) right to erasure: you have the right to request the deletion of your data

d) right to object: you have the right to object to the processing of your data

You may exercise the aforementioned rights by submitting a request and we will reply within one (1) month upon receipt of the request. This deadline might be extended for two (2) additional months, in case your requests are excessive or complicated. Additionally, we shall inform you without any delay on any breach of your personal data, unless such breach falls within one of the exceptions, provided by law.

What is the contact person for any issues/requests?

For any queries, clarifications of requests with regards to your personal data protection, you may contact our email privacy@sunlight.gr.

Complaint with the Italian Data Protection Authority

In case you feel that the processing of your personal data violates in any way the General Data Protection Regulation (GDPR), you have the right to lodge a complaint with the competent Data Protection Authority. The competent Data Protection Authority for Italy is the Italian Data Protection Supervisory Authority (Piazza Venezia, 11, 00187, Rome, email account: protocollo@gpdp.it , Phone: +39 06.696771).

Information on CCTV System:

The installed cameras do not record sound and are placed at specific areas of the factory (e.g. at entrances, at production areas), where the traffic is higher or/and serious incidents may occur, such as thefts, accidents and other incidents that may put at risk the health and safety of employees, partners and third parties that visit our offices and/or the security of assets and premises.