Information on the processing of personal data when implementing video surveillance
Information for individuals regarding the processing of personal data in the implementation of video surveillance at TBP d.d., pursuant to Article 13 of the General Data Protection Regulation (GDPR) and Article 3 paragraph 76 of the Personal Data Protection Act (ZVOP-2).
Who is the controller of your personal data and where can you obtain more information regarding this?
TBP d.d. is aware of the importance of protecting your personal data when implementing video surveillance. With this general information about the protection of personal data when implementing video surveillance, we wish to inform you in a clear and understandable way about which personal data are collected when implementing video surveillance, why they are processed, the period of their storage, your rights and the way they can be exercised.
The controller is TBP d.d., Gradiška cesta 3, 2230 Lenart. More information about the processing of your personal data can be found at the link. https://tbp.si/varstvo-osebnih-podatkov/, You can also contact the employee in the HR and Legal Department, who is authorized to protect data, via e-mail. info@tbp.si.
Video surveillance is carried out by TBP d.d. on its behalf and is regulated in more detail in the »Rules for the implementation of video surveillance in TBP d.d.«.
What personal data do we process?
During video surveillance, a video recording of the person who was in the field of view of the video camera installed at the entrances or in the areas and facilities of TBP d.d. is processed for a certain period of time, as well as the date and time of the video recording.
Your data will be processed exclusively by authorized personnel employed by TBP d.d. The company monitors events in real time through video surveillance, and the recordings are also archived in accordance with point 07.
What is the purpose of processing personal data and on what legal basis are they processed?
Video surveillance is carried out under Article 76–80 of the Personal Data Protection Act (ZVOP-2) (Official Gazette of the RS, No. 163/22) for the purposes of:
- ensuring the protection of property and the safety of people in internal areas,
- providing technical and fire safety,
- entry and exit controls in or from internal areas,
- control of entry and exit in or from office or business premises (by unauthorized persons) and ensuring the security of office or business premises,
- protection of confidential data,
- the enforcement of legal claims in the event of damage to property owned or managed by TBP d.d.,
- ensuring the safe, intended and uninterrupted pre-set operation of work equipment (as part of protecting the company's assets and ensuring the safety of people).
Sources and recipients of personal data
TBP d.d. forms the data on video surveillance itself. The recipients of the data are state authorities (e.g. courts, police) and other beneficiaries at their legitimate request, provided that there is a legal basis for this.
Scope of personal data processing
The scope of processing depends on how long the individual stays in the area that is under video surveillance.
Video surveillance monitors live footage and creates an archive; there are no other special processing operations related to video surveillance. There are no audio interventions in the case of live image monitoring. No other further processing of the recordings of the video surveillance system is performed.
Notification regarding automated decision-making
Pursuant to provisions 13 and 22(2)(a) of the GDPR, we inform you that TBP d.d. does not carry out automated decision-making or create profiles when implementing video surveillance.
Time for data storage
To achieve the purpose of video surveillance, a minimum time period for storing recordings is set; this is at least seven days after the recording is made and at most as long as the maximum storage period set by law. If no special circumstances are detected, the recordings are automatically deleted or overwritten with new recordings and are not stored.
Individual rights
With regard to your personal data, you have the right to:
- the right to access the data,
- the right to rectification,
- the right to erasure (the »right to be forgotten«);,
- the right to restrict processing,
- the right to object,
- the right to data portability.
The General Regulation grants you a series of rights regarding the processing of personal data, which are regulated in Articles 15 to 22. Under the right to information, you may obtain access to your data in accordance with and under the conditions set out in Article 15 of the General Regulation. We would like to specifically clarify that the eligibility for exercising the right to delete data as set out in Article 17 of the General Regulation is assessed in accordance with point 07 of this document.
You can exercise the rights under this point by submitting a request to TBP d.d., Gradiška cesta 3, 2230 Lenart; you can also send it by post to the aforementioned address or to the e-mail address info@tbp.si.
The request will be decided within 30 days of receiving the complete request, except in exceptional cases.
We inform you that you have the right to file a complaint with the supervisory authority for the protection of personal data or with the Information Commissioner (IP) at the address Dunajska 22, 1000 Ljubljana.
Transfer to third countries
Transfers to third countries are not made, or are made only in exceptional cases, strictly within the scope permitted by law, or using the appropriate safeguards specified in Article 46.2(c) of the GDPR, in accordance with the Standard Contractual Clauses for the transfer of personal data to third countries under the GDPR, as set out in the implementing decisions of the EU Commission 2021/914 of 4 July 2021.