Surveillance Cameras

Privacy Notice concerning personal data processing deriving from video surveillance

1. Who is responsible for the processing of the data?
Trade up S.A., a Greek company headquartered in Heraklion Crete, Eirinis & Filias str. 181, as data controller.

2. Which is the purpose and the legal basis of this data processing?

Trade up uses video-surveillance equipment for security and access control purposes. The processing is necessary for the purposes of the legitimate interests we pursue as a data controller, therefore, the processing is lawful under Article 6 paragraph 1(f) of the General Data Protection Regulation (EU) 2016/679 (GDPR).

3. Why do we collect personal data?

Our legal interest is the need to protect our premises as detailed above and the goods included against illegal actions, such as, indicatively, thefts. We also need to ensure life safety, physical integrity, health as well as the property of our staff and of third parties lawfully located in the areas under surveillance. We only collect image data and limit the surveillance to places where we have previously assessed that there is an increased possibility of illegal actions e.g. such as thefts, on the cashiers, or in the entrance, without focusing on places where privacy of the persons captured by the CCTV may be severely restricted, including their right to respect of their personal data.

4. Who can see my data?

The images can be accessed only by our authorized personnel who is in charge of security. This material shall not be disclosed to third parties, except in the following cases: (a) to the competent judicial, prosecutorial and police authorities when it contains information necessary for the investigation of a criminal offense involving persons or property of the controller; (b) to the competent judicial, prosecutorial and police authorities when lawfully requesting data, in the performance of their duties, and (c) to the victim or perpetrator of a crime, in the case of data which may constitute evidence of the act.

5. How long do we keep your data?

Trade up will keep your personal data for fifteen (15) calendar days after your visit to our premises. After that period any CCTV recorded footage is automatically deleted. In the event that during this period an incident occurs, we isolate part of the video and keep it for another one (1) month, in order to investigate the incident and initiate legal proceedings to defend our legal interests, while if the incident concerns a third party we will keep the video for up to three (3) more months.

6. What are my rights concerning data processing?

You as data subjects have the following rights:
• Right of access: you have the right to know if we are processing your image and, if applicable, to receive a copy of it.
• Right to restriction of processing: you have the right to ask us to restrict processing, such as not deleting data that you deem necessary to establish, exercise or support legal claims.
• Right to object: you have the right to object to the processing.
• Right to erasure: you have the right to request that we erase your personal data.

You may exercise your rights by sending an e-mail to dpo@tradeup.gr or a letter to our postal address Irinis & Filias 181, 71500 or by submitting the request to us in person. To examine a request related to your image, you should tell us approximately when you were within the range of our cameras and give us a picture of you to facilitate us to locate your data and hide the data of third parties pictured. Alternatively, we give you the opportunity to come to our premises to show you the images in which you appear. We also note that exercising the right to object or the right to erasure does not imply the immediate erasure of data or the modification of the processing. In any case, we will answer you in detail as soon as possible, within the deadlines set by the GDPR.

7. What can I do in the event of a problem?

In case you consider that the processing of your data violates Regulation (EU) 2016/679, you have the right to lodge a complaint with the competent Supervisory Authority.
The competent Supervisory Authority in Greece is the Hellenic Data Protection Authority, 1-3 Kifisias Avenue, 11523, Athens, https://www.dpa.gr, telephone number +30-210-6475600..