GDPR-FORM-16 Level 2 video recording information form

1. Data Controller:

ZAMPOURIS S.A., Kalochori Estate Area 0, P.C. 57009, Echedoros/Thessaloniki, Tel. +30 2310 753 551

2. Purpose of Processing and Legal Basis:

We use a surveillance system to protect individuals and property, in accordance with Law 4624/2019, Article 27, Paragraph (f). The processing is necessary for the purposes of legitimate interests pursued by us as the data controller (Article 6, Paragraph 1(f) of the GDPR).

3. Analysis of Legitimate Interests:

Our legitimate interest lies in the need to protect our premises and the assets within them from illegal activities, such as theft. This also extends to ensuring the safety of life, physical integrity, health, and property of our staff and third parties lawfully present in the monitored area.
We collect only image data and limit recording to areas where there is an increased likelihood of illegal activities, such as theft (e.g., at our cash registers and entrances). We avoid monitoring spaces where the privacy of individuals may be excessively restricted, including their right to personal data protection.

4. Receivers

The recorded material is accessible only to our authorized security personnel. It is not shared with third parties, except in the following cases:
a) Judicial, prosecutorial, and police authorities when the footage contains information necessary for investigating a criminal act affecting individuals or assets of the data controller.
b) Judicial, prosecutorial, and police authorities when they lawfully request data in the course of their duties.
c) Victims or perpetrators of a criminal act, if the data may serve as evidence.

5. Retention Period

We retain data for fifteen (15) days, after which it is automatically deleted. If an incident is detected within this period, we isolate the relevant footage and retain it for up to one (1) additional month in order to investigate the incident and initiate legal procedures to protect our legitimate interests. If the incident involves a third party, the footage may be retained for up to three (3) additional months.

6. Rights of Data Subjects:

Data subjects have the following rights:

• Right of Access: You have the right to know if we process your image and, if so, obtain a copy.
• Right to Restriction: You may request that we limit processing, e.g., to prevent deletion of data necessary for legal claims.
• Right to Object: You may object to the processing.
• Right to Erasure: You may request the deletion of your data.

To exercise your rights, you can use a special form and submit it via email to dpo@zampouris.gr, by post, or in person at our company’s address.
If your request relates to your recorded image, you must specify when you were likely in the camera’s range and provide an image of yourself to facilitate identification and the anonymization of third-party data. Alternatively, you may visit our facilities to review the footage in which you appear.
Please note that objecting to or requesting deletion of data does not necessarily lead to immediate data erasure or processing modification. We will respond as soon as possible, within the GDPR-mandated deadlines.

7. Right to Lodge a Complaint:

If you believe that the processing of your data violates Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority.

The competent authority in Greece is the Hellenic Data Protection Authority,
Kifisias 1-3, 115 23, Athens, https://www.dpa.gr/, Tel. +30 210 647 5600.