1. Data Controller

The Company under the name «EMPORIKI MICHANIMATON KAI VIOMIHANIKON EIDON ANONYMI EMPORIKI ETAIREIA» and the distinctive title «ERGOTRAK» (hereinafter the “Company” or “we“), a member of the Sfakianakis Group, with VAT number: 094394592, which has its registered office in Athens, 5-7 Sidirokastrou Street, PC 11855, email: ergotrak@ergotrak.gr,  tel.: 2106293400, processes personal data in accordance with the EU Regulation 2016/679 (GDPR), as well as the relevant applicable European and national legislation on the protection of personal data, from which it is fully bound.

2. Purpose of processing and legal basis

We inform you that a closed circuit of video surveillance operates around the perimeter of our facilities (inside and outside), with the sole purpose of protecting and ensuring the safety of the persons and goods of the facilities (inside and outside) of our Company. The processing is necessary for the purposes of legitimate interests pursued by us as a Data Controller (Article 6 par. 1 f’ of the GDPR). Your personal data that may be recorded is your image.

3. Analysis of legitimate interests

Our legitimate interest consists in the need to protect our facilities and the goods found in it from illegal acts, such as but not limited to theft. The same applies to the safety of life, physical integrity, health as well as the property of our staff and third parties who are legally in the supervised area. We only collect image data and limit capture to areas where we have assessed that there is an increased likelihood of illegal acts e.g. theft and unauthorized access, such as at the entrance and the strictly necessary side area, without focusing on areas where the privacy of the persons whose image is being taken, including their right to respect for personal data, may be unduly restricted.

4. Recipients

The recipients of the aforementioned personal data are exclusively the employees of our Company and/or the Data Processor (Security Company) responsible for the processing in question, who are bound by confidentiality and personal data protection clauses. No transfer of your aforementioned personal data to third parties takes place, unless such a relevant obligation arises to comply with a legal obligation. This material is not transferred to third parties, except in the following cases: a) to the competent judicial, prosecutorial and police authorities when it contains information necessary for the investigation of a criminal act, which concerns persons or property of the controller or b) to the competent judicial, prosecutorial and police authorities when they lawfully request data in the exercise of their duties.

5. Retention period

The above data are kept for a reasonable period of time in view of the intended purpose of their processing. In any case, if no event occurs that falls within the intended purpose of the above, your data is destroyed within fifteen (15) working days from its receipt.

6. Data subjects Rights

Data subjects have the following rights:

• Right of access: you have the right to know if we are processing your image and, if applicable, to receive a copy of it (Art. 15 GDPR)
• Right to restriction: you have the right to ask us to restrict processing when the conditions of the Regulation are met (Article 18 GDPR)
• Right to object: you have the right to object to processing (Art. 21 GDPR)
• Right to erasure: you have the right to request that we erase your data. We will grant the deletion request if the conditions set out in the Regulation are met (Article 17 GDPR)

You can exercise your rights by sending an e-mail to the email address dataprotection@sfakianakis.gr or by writing to our postal address or by submitting the request to us in person at our Group’s premises, at 5-7 Sidirokastrou Street, P.C. 11855, Athens, Greece to the attention of the Data Protection Officer. In order to consider a request related to your image, you will need to specify to us approximately when you were in range of the cameras and provide us with a picture of you, so that it will make it easier for us to identify your data and hide the data of third parties pictured. Alternatively, we are giving you the opportunity to come to our premises to show you the images in which you appear. We also point out that exercising the right to object or erasure does not entail the immediate deletion of data or the modification of the processing. In any case, we will reply to you in detail as soon as possible, within the deadlines set by the GDPR.

7. Right to lodge a complaint

In case you consider that the processing of your data violates the Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Greece is the Data Protection Authority, 1-3 Kifisias Avenue, 115 23, Athens, https://www.dpa.gr/, tel. 2106475600.