1. Data Controller
This CCTV policy (the “Closed-Circuit Television Policy”) describes our policies and procedures on the collection, use and disclosure of personal data collected through CCTV (the “Personal Data”) and helps you understand the type of data we collect, the reasons we collect it, what we do with it and what your privacy rights are. This policy governs the CCTV at Iconic Santorini hotel (the “Hotel”).
2. Purpose of processing and Lawful basis of processing
The monitoring of the Hotel’s exterior and reception area aims to protect its premises and the equipment contained therein, such as protection of goods, as well as the natural persons working or entering the premises for any reason, such as protection of persons. The processing of personal data through the video surveillance system is necessary for the purposes of the legitimate interests pursued by the Controller (Article 6. par. 1 (f) of the General Data Protection Regulation 2016/679/EU).
3. Legitimate interests of the Data Controller
The legitimate interest of the Data Controller consists of the need to protect the premises of its Hotel, including the goods located therein, from unlawful acts, such as theft, unauthorized entry and vandalism, as well as from natural phenomena capable of causing damage, such as fire. Furthermore, the Data Controller seeks to ensure, through video surveillance, the safety, physical integrity, health and property of the natural persons within the Hotel premises (employees, guests or any third party). In addition, the Controller declares that his processing of data through the video surveillance system does not extend to places where it may unduly restrict the privacy of the persons whose image is taken. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.
4. Recipients
The material recorded by the video surveillance system is accessible only by authorized personnel of the Controller. The Controller shall take all appropriate and reasonable measures to ensure the security of the place where the material recorded is kept. The retained material shall not be disclosed, communicated or transmitted to any third party, except if required by law.
5. Your Rights
You have several rights in relation to the Personal Data that can be summarized as follows:
(a) Right to Access
You have the right to request access your Personal Data that we hold including the right to be informed about the purpose of the processing and the recipients of your Personal Data. Provided the rights of others are not affected, we will provide you a copy of your Personal Data that we hold but in doing so we may ask you to verify your identity.
(b) Right to Rectification
You have the right to have any inaccurate Personal Data rectified and, taking into account the purposes of the processing, to have any incomplete Personal Data about you completed.
(c) Right to Erasure
Under some circumstances, you have the right to the erasure of your Personal Data without undue delay. Those circumstances can come about when:
• your Personal Data is no longer necessary in relation to the purpose for which it was collected or otherwise processed;
• you withdraw consent in circumstances where you had previously provided it;
• you object to the processing under certain rules of applicable data protection law;
• the processing is for direct marketing purposes;
• your Personal Data was unlawfully processed.
The right to erasure is not absolute and exclusions include circumstances where processing is necessary for exercising the right of freedom of expression and information; for compliance with a legal obligation; and/ or for the establishment, exercise or defense of legal claims.
(d) Right to Restrict Processing
Under certain circumstances, you have the right to restrict the processing of your Personal Data. Examples of such circumstances include cases where you contest the accuracy of your Personal Data or our need to have access to your Personal Data for the declared processing purposes. If and when processing has been restricted on this basis, we may continue to store your Personal Data, but we cannot otherwise process it.
(e) Right to Object to Processing
If we have been processing your Personal Data on certain legal basis (such as legitimate interest) you have the right to object to such processing in certain circumstances. On the submission of such objection and unless we can demonstrate compelling legitimate grounds for the continuance of the processing which override your interests or if the processing is for the establishment, exercise or defense of legal claims, we shall seize the processing.
(f) Right to Data Portability
If the processing is carried out by automated means and the legal basis for our processing of your Personal Data is:
1. consent; or
2. performance of a contract to which you are party or
3. preparatory work at your request prior to entering into a contract; you have the right to receive your Personal Data from us in a structured, commonly used and machine-readable format, unless it would adversely affect the rights and freedoms of others.
(g) Right to Lodge a Complaint to a Supervisory Authority
If you consider that our processing of your Personal Data infringes applicable data protection legislation, you have a legal right to lodge a complaint with the applicable Personal Data protection authority.
(h) Right to Withdraw Consent
To the extent that the legal basis for our processing of your Personal Data is consent, you have the right to withdraw that consent at any time.
Withdrawal will not affect the lawfulness of processing before the withdrawal. You may exercise any of your rights in relation to your personal data by written notice to us via [email protected]
