Video Surveillance Privacy Notice

Privacy notice pursuant to Article 13 of EU Regulation 2016/679

This notice has been prepared in compliance with Article 13 of EU Regulation 2016/679 (also known by the acronym GDPR) and Article 3.1 of the Provision on Video Surveillance issued by the Italian Data Protection Authority on 8 April 2010, in order to provide you with information regarding the video surveillance systems, their use and your rights.

A. Data Controller and Data Protection Officer

Continental Terme S.r.l. (hereinafter, the “Controller”), with registered office in Naples (ZIP code 80133), Via M. Cervantes De Savaedra 55, Tax Code and VAT No. 03376570630 (telephone: +39 081.991588; email: info@hotelcontinentalischia.it; certified email (PEC): continentaltermesrl@pec.it), hereby informs you that it is the Data Controller of personal data pursuant to Article 4, No. 7), of EU Regulation 2016/679. The data provided by you will be processed lawfully, fairly and transparently, in compliance with the principles set out in Article 5 of the aforementioned Regulation and, more generally, with the rights and freedoms of the data subject. Further information may subsequently be provided, including verbally.

The company has appointed a Data Protection Officer, who can be contacted at the following email address: palmieri@aptconsulting.it.

B. Data Subject to Processing

Article 4, paragraph 1, of EU Regulation 2016/679 defines “personal data” as any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

With specific reference to video surveillance, the data subject to processing are briefly listed below:

• images of persons and objects located within the field of view of cameras installed on the Controller’s premises.

C. Purposes of Processing

The personal data concerning you will be processed exclusively for the following purposes:

1. to ensure the safety and security of the Controller’s employees, customers and suppliers;
2. to protect the Controller’s assets by preventing and pursuing any unlawful acts.

D. Legal Basis for Processing

The legal basis for video surveillance activities is the legitimate interest of the Controller (Article 6, paragraph 1, letter f, of EU Regulation 2016/679) in carrying out the processing for the purposes set out in Section C.).

E. Nature of the Provision of Data

The provision of data is mandatory in relation to the purposes referred to in Section C.) and is connected with the reasons for which employees, customers and suppliers access the Controller’s premises.

If the data are not provided, access to the Controller’s premises will not be possible.

F. Disclosure to Third Parties and/or Dissemination of Data

The viewing and management of images captured through the video surveillance system are reserved for the Controller and/or employees authorised in writing by the Controller.

The data may also be disclosed to parties external to the Controller where this is necessary to comply with a legal obligation and/or an order issued by a judicial authority and/or public security authority.

G. Intention to Transfer Data Abroad

The data will not be transferred to third countries (countries outside the European Union).

H. Data Retention Period

Images contained in video recordings are ordinarily retained for a maximum of 24 hours from the time of recording, without prejudice to specific needs requiring longer retention in connection with public holidays or the closure of offices and services, as well as where it is necessary to comply with a specific investigative request from the judicial authorities or law enforcement agencies. Once this period has elapsed, the images will be automatically deleted.

I. Methods of Data Processing

Your personal data will be processed and stored exclusively for the purposes referred to in Section C.), through the use of paper-based, automated and electronic systems, entered into relevant databases and processed using tools suitable for guaranteeing the integrity, security and confidentiality of the data.

The Controller adopts all appropriate technical and organisational measures to ensure that processing is carried out in compliance with EU Regulation 2016/679. Access to personal data is permitted only to persons authorised to process personal data.

J. Rights of the Data Subject

The data subject may, at any time, exercise the rights provided for by EU Regulation 2016/679 and, in particular:

a. the right to access personal data;

b. the right to obtain rectification or erasure of such data or restriction of the processing of data concerning them;

c. the right to object to processing;

d. the right to data portability;

e. the right to withdraw consent, where applicable (withdrawal of consent shall not affect the lawfulness of processing based on consent given before its withdrawal);

f. the right to lodge a complaint with the supervisory authority (Italian Data Protection Authority).

Considering the type of data processed and the applicable retention periods, the right to updating or supplementation, as well as the right to rectification pursuant to Article 16 of the GDPR, may not always be exercisable in practice. The right to data portability pursuant to Article 20 of the GDPR is not applicable, since the images acquired through the video surveillance system – except in the cases referred to in Section F.), paragraph 2 above – cannot be transferred to other parties.

The above rights may be exercised by sending a communication to:

Continental Terme S.r.l. Via M. Cervantes De Savaedra 55, Naples (ZIP code 80133), by certified email (PEC) to: continentaltermesrl@pec.it