Privacy Notice on the Processing of Personal Data via a Video Surveillance System

1. Data Controller

The Data Controller is the Legal Entity under Private Law (N.P.I.D. - Legal Entity under Private Law) under the name "AUXILIARY FUND FOR MOTOR ACCIDENTS LIABILITY INSURANCE", abbreviated as "AUXILIARY FUND", having its registered office in Athens, at 91 Michalakopoulou Street, PC 115 28 (contact telephone: +30 2103327400).

2. Purpose of Processing and Legal Basis

We use a surveillance system for the purpose of protecting persons and property. The legal basis for the processing is that it is necessary for the purposes of the legitimate interests pursued by us as the data controller (Article 6(1)(f) of the GDPR).

3. Analysis of Legitimate Interests

Our legitimate interest consists in the need to protect our premises and the assets located therein from illegal acts, such as, indicatively, theft. The same applies to the safety of life, physical integrity, health, as well as the property of our staff and third parties who are lawfully present in the monitored area. We collect only image data and limit the recording to areas where we have assessed that there is an increased probability of illegal acts being committed, e.g., theft, such as at the entrance and in our archive storage areas, without focusing on areas where the private life of the persons whose image is captured might be excessively restricted, including their right to respect for personal data.

4. Recipients

The retained material is accessible only by our competent/authorized personnel charged with the security of the premises. This material is not transmitted to third parties, with the exception of the following cases:

  • a) to the competent judicial, prosecutorial, and police authorities when it contains information necessary for the investigation of a criminal offense concerning persons or property of the data controller,
  • b) to the competent judicial, prosecutorial, and police authorities when they lawfully request data in the performance of their duties,
  • c) to the victim or perpetrator of a criminal offense, when the data may constitute evidence of the act,
  • d) to cooperating security services and security systems maintenance companies, which, in the context of providing their services, process your data on behalf of the Auxiliary Fund.

The said cooperating companies operating as data processors have been informed and have committed in advance to maintaining data confidentiality, know and follow the instructions of the Auxiliary Fund regarding the processing of personal data, and take all appropriate measures to protect them.

5. Retention Period

We retain the data for fifteen (15) days, after the lapse of which they are automatically deleted. In the event that during this period we detect an incident, we isolate a part of the video and retain it for up to one (1) additional month, for the purpose of investigating the incident and initiating legal proceedings to defend our legitimate interests, whereas if the incident concerns a third party, we will retain the video for up to three (3) additional months.

6. Rights of the Data Subjects

Data subjects have the following rights:

  • Right of access: you have the right to know if we are processing your image and, if so, to receive a copy thereof.
  • Right to restriction: you have the right to request that we restrict processing, such as, for example, not to delete data that you consider necessary for the establishment, exercise, or defense of legal claims.
  • Right to object: you have the right to object to the processing.
  • Right to erasure: you have the right to request that we delete your data.

You may exercise your rights by sending an e-mail to the address dpo@epikef.gr , or a letter to our postal address, or by submitting the request yourself in person at the address of the Auxiliary Fund. In order to examine a request related to your image, you must specify approximately when you were within the range of the cameras and provide us with an image of yourself, to facilitate the location of your own data and the masking/anonymization of the data of third parties depicted. Alternatively, we offer you the possibility to come to our premises so that we can show you the images in which you appear.

We also point out that the exercise of the right to object or erasure does not imply the immediate deletion of data or the modification of the processing. Our response to your request will take place within one (1) month from its receipt and does not entail any cost for you. The above deadline may be extended for a period of two (2) additional months, due to the complexity or the number of requests, in which case you will be informed of the extension and the reasons for it as soon as possible and at the latest within a month from the receipt of the request.

7. Right to Lodge a Complaint

In the event that you consider that your rights have not been sufficiently satisfied or that the processing of data concerning you violates Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Greece is the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23, Athens, https://www.dpa.gr/, tel. +30 2106475600.