Video surveillance personal data
Information on the processing of personal data through a video surveillance system
1. Controller:
The company ALIMOS MODERN PRIVATE MEDICAL GROUP PRACTICE S.A operating under the trademark MEDIFIRST ALIMOS, MEDIFIRST MAROUSI and MEDIFIRST PERISTERI, will process your personal data resulting from the use of a video surveillance system as Controller. You can contact us for any questions or complaints by sending a letter to the address, 1 Geroulanou Street and Polemiston, Argyroupoli – Attica with the relevant indication on the cover of the letter, or by e-mail to dpo@medifirst.gr
2. Purpose of processing and legal basis:
We use a surveillance system for the purpose of protecting persons and property in accordance with the law. The processing is necessary for the purposes of the legitimate interests pursued by the above company as Controller (article 6 par. 1. f GDPR).
3. Analysis of legitimate interests
Our legitimate interest consists of the need to protect the area where our facilities are located and the goods located therein, from illegal acts. The same applies to the safety of life, physical integrity, health and property of our personnel and third parties who are lawfully present in the monitored area. We want you to be aware that the installed cameras focus on the asset they protect, i.e. the safety of our property and people, which is why we have limited the scope to the absolutely necessary area in front of the entry and exit points, in the cashier/reception area, in the corridors, but also in areas of our critical facilities (such as electromechanical facilities, medical and pharmaceutical warehouses, computer rooms, car parks, etc. where, in principle, a visitor does not have access to these areas) without recording images of people or sound from adjacent areas, indoors or outdoors. Our cameras, as they are installed, do not in any way monitor the movement of people in adjacent outdoor areas and streets, nor internally in the workplaces of our medical and nursing staff, medical examination rooms, waiting areas, recreation areas or toilets. In addition, our company applies privacy masks to all installed cameras when capturing images, i.e. the faces and adjacent traffic areas (roads, passers-by, etc.) are obscured. Our company applies all modern and appropriate technical and organizational measures for the processing of video surveillance data, the meeting of which we check at regular intervals. In addition to all of the above, before a person enters the range of the video surveillance system, we inform them, in a convenient, visible and understandable manner, that they are about to enter a space where closed circuit television is in operation and we provide all the required information on the purpose of processing, the nature of the system used, the Data Controller. Where there is a camera inside, an appropriate information sign has been placed for the public and our employees.
4. Recipients
The material kept is accessible only by the competent authorized personnel, ours and the cooperating security service company, who are responsible for the security of the area. This material is not transmitted to third parties, with the exception of the following cases: a) to the competent judicial, prosecutorial and police authorities when it includes data necessary for the investigation of a criminal act, which concerns persons or goods of the controller, b) to the competent judicial, prosecutorial and police authorities when they request data, lawfully, in the exercise of their duties, and c) to the victim or perpetrator of a criminal act, when it concerns data that may constitute evidence of the act.
5. Retention period
Our recorder processes and keeps the images it receives from the video surveillance system in obscured form. Closed-circuit television (CCTV) recording data is retained for 15 days, according to the law, after which it is automatically deleted. In case we detect an incident during this period, we isolate part of the video and keep it for up to one (1) more month, in order to investigate the incident and initiate legal proceedings to defend our legitimate interests, while if the incident concerns a third party, we will keep the video for up to three (3) more months.
6. Rights of data subjects
Data subjects have the following rights:
- Right of access: you have the right to know whether we are processing your image and, where applicable, to receive a copy of it.
- Right to restriction: you have the right to ask us to restrict processing, such as not deleting data that you consider necessary for the establishment, exercise or defense of legal claims.
- Right to object: you have the right to object to processing.
- Right to erasure: you have the right to request that we delete your data.
You can exercise your rights by sending an e-mail to dpo@medifirst.gr or a letter to our postal address or by submitting the request to us in person at our company address. In order for us to consider a request related to your image, you will need to specify to us approximately when you were within the range of the cameras and provide us with an image of you, to facilitate our identification of your data and the concealment of the data of third parties depicted. Alternatively, we can provide you with the opportunity to come to our premises to view the images in which you appear. We also point out that the exercise of the right to object or delete does not entail the immediate deletion of data or the modification of the processing. In any case, we will respond to you in detail as soon as possible, within the deadlines set by the GDPR.
7. Right to lodge a complaint
If you consider that the processing of your data violates Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Greece is the Data Protection Authority, Kifissias 1-3, 115 23, Athens, https://www.dpa.gr/ , tel. 2106475600. 2106475600.