GDPR

Privacy Notice regarding the Processing of Your Personal Data via Closed-Circuit Television (CCTV)

We invite you to carefully read this information notice, which has been drafted in compliance with the provisions of the General Data Protection Regulation No. 2016/679/EU, to adequately inform you regarding the processing of your personal data via closed-circuit television.

1. General Information and Data Controller

The company “CANAVES OIA SA”, headquartered in Oia, Santorini, with VAT number 998665147, represented by Mr. Ioannis Chaidemenos, is the data controller responsible for the collection, storage, and overall processing of personal data of individuals through closed-circuit television. Hereinafter referred to as the “Company.”

1. What Personal Data We Collect and How

We collect and process your personal image data.

1. Purposes of Processing

The operation of the closed-circuit television aims to ensure the protection of goods and individuals within our company premises. Consequently, the legal basis for this processing is the legitimate interest of the Company in monitoring the area to ensure the protection of goods and individuals. When we receive relevant court orders or requests from public authorities, we process your personal data to comply with these requests. In this case, the legal basis for processing your personal data is compliance with our legal obligations.

1. Exercise of Rights

You may exercise all rights of data subjects provided for in the General Data Protection Regulation (GDPR) (right of access / rectification / erasure / restriction of processing, etc.). Please note that requests that do not meet the requirements set by applicable law may require their re-submission or may be rejected. Requests regarding the exercise of the aforementioned rights of users can be sent to the Data Protection Officer of our Company at the email address dpo@canaves.com.

Users may also submit complaints to the Hellenic Data Protection Authority regarding the exercise of their rights (www.dpa.gr). According to the Authority’s website, complainants must first submit their complaint to the data controller or the data protection officer.

1. Retention of Personal Data

The data collected via closed-circuit television are retained for 15 days.

1. Sharing of Personal Data

Your personal data are processed within the company by those employees who absolutely need access to them. We may need to share your personal data with third parties to assist us in operating/maintaining the closed-circuit system. These third parties include:

• Collaborating companies for the purpose of operating/technical support of the closed-circuit system.

In any case, we require collaborating companies to take appropriate measures to protect the confidentiality and security of personal data.

Additionally, we may need to provide image data to law enforcement agencies or administrative authorities (e.g., police/judicial authorities) to comply with a legal obligation or court order.

1. Data Security

The Company assures individuals whose data are processed (customers/employees/visitors) through the closed-circuit system that it takes all appropriate technical and organizational measures to ensure the security of their personal data, to safeguard the confidentiality of their processing, and to protect them from accidental or unlawful destruction, loss, alteration, unauthorized dissemination or access, and any other form of unlawful processing.