1. Introduction
Wildcard EOOD, a limited liability company incorporated under the laws of Republic of Bulgaria, member of the EU, with a company number 208843848, registered in the Commercial Register and Register of Non-Profit Legal Entities, with seat and registered address at 1000 Sofia, 1 Alabin Str., 14th floor, (the Company) operates a video-surveillance system (VSS), in the form of an integrated closed-circuit television (CCTV) system. The VSS is intended to ensure the safety and security of Company’s premises, assets, staff and visitors, and safeguard physical, informational and environmental security at the Company by preventing unauthorised physical access to premises, damage to property and interference with information and information-processing facilities.
The video-surveillance policy (‘this Policy’) describes how this system is designed and
operated, and details the safeguards in place to minimise its impact on personal data,
privacy and other fundamental rights and legitimate interests of individuals affected by the VSS.
2. Objective
The objective of this Policy is to describe the VSS and the safeguards put in place by the Company to ensure the protection of personal data, privacy and other fundamental rights and legitimate interests of individuals affected by the VSS. This Policy also sets internal procedures to ensure the VSS is in continuous compliance with the applicable legal framework.
The Company shall process any images in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
3. Areas under surveillance
The VSS comprises 10 cameras at the moment of publication of this Policy. Cameras monitor and/or record the external perimeter at the Company’s office floors, external emergency exit, server room, access points through gates and entrance.
Cameras do not monitor any areas subject to heightened expectations of privacy such as individual offices (including offices shared by two or more people and large, open-plan offices with cubicles), leisure areas, canteens, cafeterias, bars, kitchenettes, lunchrooms, lounge areas, waiting rooms, restrooms.
The location of all cameras is carefully scrutinised in order to ensure that they minimise the monitoring of areas that are not relevant for the intended purposes.
4. Type of personal data collected.
The VSS collects images of data subjects entering/leaving/walking in public areas of the Company premises. The cameras record digital images indicating time, date and location. The system does not collect any special category of data.
5. Purposes of the VSS
The purposes of the VSS are as follows:
· Detecting, deterring and preventing all kind of attacks, unlawful entry or other
incidents (e.g. theft of assets, vandalism, flood, fire) at the Company’s office;
· Detecting, deterring and preventing attacks or unlawful entry in the entrance and exit areas;
· Investigating the facts following physical security incidents and securing evidence to prosecute the perpetrator(s). The VSS is not an investigative tool. In exceptional
cases the images may be transferred to investigatory bodies as part of a formal criminal investigation.
The VSS will not be used for any other purpose. There will be no use of hidden cameras for ad-hoc investigations or covert surveillance activities. There will be no special video
surveillance for events. The VSS will not be used to monitor the work of employees or to monitor attendance.
The footage will be used for its original purpose and the VSS will not be installed or designed for use in internal investigations beyond physical security incidents or electronic incidents (for instance, theft of information stored on a PC). Only in exceptional circumstances may the images be transferred to investigatory bodies or enforcement authorities as part of a formal criminal investigation.
6. Description of the VSS
The VSS is an integrated CCTV system. The VSS comprises detection and observation
cameras, specifically fixed detection/observation cameras. The cameras may be set up or configured differently depending on the area monitored.
7. Legal basis for video surveillance
The use of the VSS is necessary for the legitimate interest of the controller and functioning of the Company in line with the purposes stated above and in accordance with Article 6 (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. In case of transferring data to the police authorities when such is required, the legal basis shall be a necessity for compliance with a legal obligation to which the controller is subject under Article 6 (c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
8. Access to the VSS images and retention period
The images can only be accessed in two ways: via live monitoring or via access to stored
footage. Access shall be available to the director of the Company and, if specifically instructed to supply a particular record, to the system administrators. For the purposes of an investigation and on the instructions of the director, access may be granted to the data protection officer as well as to employees of the high management with a view to forming a working group.
Camera footage will not be stored for more than 3 days. When this period expires, the data will be automatically deleted. In case of an incident, a backup of the corresponding video footage may be stored for the time necessary to investigate and solve the incident. This period can be extended until the resolution of a possible complaint or appeal. Any
additional retention period is documented and registered, and its necessity is reviewed
regularly. As soon as the purpose of the investigation and eventual complaint or appeal
ends, the images will be deleted.
9. Data and information protection measures
The Company will put in place a number of protective technical and organisational measures, as follows:
· Internal and external premises are to be protected by physical security measures. Servers where recorded images are stored are to have additional physical protection measures. Archives of stored footage are to be placed in restricted areas.
· Recorded and stored data is to be encrypted in order to mitigate the risk of unauthorised access.
· The PC where these files are located is also to be password protected.
· The IT infrastructure’s logical network perimeter is to be protected by firewalls.
· The main computer systems holding the data are to be hardened with additional security measures.
10. Public information and rights of data subjects
Information on the presence of the VSS will be made available to the public. This information will be provided by means of local signage and by the publication of this Policy.
The signs are to be placed near the cameras and at the access points (including the main entrance). These signs are to inform the public of the presence of video-surveillance cameras and provide the following information:
· the identity of the controller, (Wildcard EOOD);
· the purpose(s) of the surveillance (for safety and security);
· contact information and a link to this Policy.
Persons recorded by the VSS will have the right to access the footage, and the right to rectification, object, erasure and restriction of processing as described in our Privacy Policy.
Persons recorded by the VSS will also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State at your habitual place of residence, place of work or place of the alleged breach. The supervisory authority in the Republic of Bulgaria is the Commission for Personal Data Protection, address: Sofia 1592, 2 Prof. Tsvetan Lazarov Blvd., website: Home Default .
Individuals can address queries to the Company at privacy@wildcard.bg or at address: 1000 Sofia, 1 Alabin Str., 14th floor.