Information on the Processing of Personal Data through a Video Surveillance System
1. Data Controller:
DIMITRA Education & Consulting S.A.
- Head Office: 170 Farsalon Str., 41335 Larissa, Tel: +30 2410 554026
- IEK Branch: 4 Iliodorou Str., 41222 Larissa, Tel: +30 2410 554024
- Athens Branch: 16 Ferron Str., 10434 Athens, Tel: +30 210 8838540
- Thessaloniki Branch: 24 Koletti Str., 54627 Thessaloniki, Tel: +30 2310 547180
- Volos Branch: 65 Ferron Str., 38334 Volos, Tel: +30 24210 38333
- Trikala Branch: 1-3 Nikis Str., 42100 Trikala, Tel: +30 24310 33033
2. Purpose of Processing and Legal Basis:
We use a surveillance system for the purpose of protecting individuals and property. The processing is necessary for the purposes of the legitimate interests pursued by us as the data controller (Article 6(1)(f) of the GDPR).
3. Legitimate Interests Assessment
Our legitimate interest lies in the need to protect our premises and the property within them from unlawful acts, such as theft. The same applies to the safety of life, physical integrity, health, and property of our staff and third parties who are lawfully present in the monitored area. We collect only image data and limit recording to areas we have assessed as having a high probability of unlawful acts (e.g., theft), such as our cash registers and entrances, without focusing on areas where individuals’ privacy may be excessively restricted, including their right to the protection of personal data.
4. Recipients
The recorded material is accessible only by our competent/authorized personnel responsible for site security. This material is not disclosed to third parties, except in the following cases:
- (a) to the competent judicial, prosecutorial, and police authorities when it includes information necessary for the investigation of a criminal offense involving persons or assets of the data controller;
- (b) to the competent authorities upon lawful request in the performance of their duties; and
- (c) to the victim or perpetrator of a criminal offense, when the data may constitute evidence of the offense.
5. Retention Period
We retain the data for fifteen (15) days, after which they are automatically deleted. If an incident is identified within this period, we isolate the relevant video segment and retain it for up to one (1) additional month for investigation purposes and initiation of legal proceedings to safeguard our legitimate interests. If the incident involves a third party, we may retain the footage for up to three (3) additional months.
6. Rights of Data Subjects
Data subjects have the following rights:
- Right of access: You have the right to know whether your image is being processed and, if so, to receive a copy.
- Right to restriction: You may request that we restrict processing, for example, to prevent deletion of data needed to establish, exercise, or defend legal claims.
- Right to object: You have the right to object to the processing.
- Right to erasure: You have the right to request the deletion of your data.
You can exercise your rights by sending an email to dpo@dimitra.gr, by post to our mailing address, or by submitting your request in person at our premises. To process a request concerning your image, you will need to specify the approximate time you were in camera range and provide an image of yourself to help us identify your data and obscure other individuals appearing in the footage. Alternatively, we offer you the option to visit our premises so we can show you the footage in which you appear.
Please note that exercising your right to object or to erasure does not imply the immediate deletion of data or alteration of processing. In all cases, we will respond to you in detail as soon as possible and within the time limits set by the GDPR.
7. Right to Lodge a Complaint
If you believe that the processing of your personal data violates Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority.
The competent supervisory authority in Greece is the Hellenic Data Protection Authority.