VIDEO SURVEILLANCE POLICY AT INA GROUP LOCATIONS MANAGED BY INA, d.d.
VIDEO SURVEILLANCE IN GENERAL
INA, d.d. (INA) and its affiliated companies use video surveillance systems operated by INA d.d. at facilities/premises at the locations of INA and its affiliated companies throughout the Republic of Croatia with the aim of protecting facilities and other related assets owned by Ina and its affiliated companies, as well as protecting persons: employees, other staff, suppliers, business partners, customers and visitors, as well as all other persons arriving to, moving about and using the abovementioned assets at protected locations.
In order to achieve these objectives, INA d.d. may use video surveillance recordings to reconstruct and investigate security incidents (including the possible malfunctions that may indicate potential security incidents), potential hazards or unauthorized access to protected areas.
INA is an independent video surveillance controller on the premises owned by INA, i.e. INA and the relevant Affiliated Company are considered joint video surveillance controllers on the premises owned by the relevant Affiliated Company.
The processing of personal data by means of video surveillance is based on applicable regulations governing financial operations (Act on Protection of Monetary Institutions) and the legitimate interest of protecting persons and assets, achieved by controlling entry and exit from the site and reducing the exposure of the persons to the risk of robbery, burglary, violence, theft, work-related irregularities and similar occurrences. The analysis of the legitimate interest of the controller and data subjects (balancing test) has shown that regarding video surveillance, the legal, economic and other interests of the data controller prevail over the interests of data subjects.
PURPOSE AND LEGAL BASIS
The processing of personal data by means of video surveillance is carried out in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on data protection, the Act on the Implementation of the General Data Protection Regulation, the Act on Protection of Monetary Institutions and other applicable regulations used for regulating the subject area, as well as in accordance with the internal documents valid in the relevant companies of INA Group. Each video surveillance system is designed and installed in accordance with the provisions of the Private Protection Act, the Occupational Health and Safety Act and the Regulation on the Conditions and Methods of Implementing Technical Security Measures.
The processing of personal data by means of video surveillance is based on applicable regulations governing financial operations (Act on Protection of Monetary Institutions) and the legitimate interest of protecting persons and assets, achieved by controlling entry and exit from the site and reducing the exposure of the persons to the risk of robbery, burglary, violence, theft, work-related irregularities and similar occurrences.
INA as the controller, i.e. INA and the relevant Affiliated Company as joint controllers, shall inform all data subjects that video surveillance is performed, using a special notice at the location where video surveillance has been set up, as well as that the recordings are stored for a certain period of time.
INA business partners, which provide services at INA sites as part of the service station partnership management system or in another way, shall inform their employees about the collection of their personal data by means of video surveillance at a particular site. They shall also:
- take action to prevent any misuse of such personal data
- act in accordance with the applicable regulations governing the processing and protection of personal data.
A special notice shall be placed in all facilities or premises where video surveillance has been set up. The video surveillance notice is made in accordance with the best applicable business practices at the time, in a format which is visible and transparent with regard to the data subjects and shall, along with the symbol or image of the video surveillance camera, contain at least the following brief information in Croatian:
- contact information of the data controller (one or several)
- information of the Data Protection Officer that data subjects can contact
- general information on video surveillance (whether video surveillance is carried out continuously, recording retention period and other relevant information)
- concise information on the purpose and legal basis of data processing
- brief information on data subject rights
- information on where more details can be found regarding data processing by means of video surveillance and exercising data subject rights (at the service station/reception of the building, on the website – where it is also possible to use a QR code for easier access to information, etc.).
The notice that a certain location is under video surveillance when referring to more information on the processing of personal data by means of video surveillance and the manner of exercising data subject rights shall complement the information on the processing of personal data by means of video surveillance published on INA’s website.
The notice that the location is under video surveillance must be placed in such a way that the data subject sees it when entering the perimeter of the area under surveillance at the latest.
DATA PROTECTION AND RIGHT OF ACCESS
Video surveillance equipment (cameras, recorders, routers) is part of the INA, d.d. business network, but it is a part of separate, virtually partitioned network segment (VLAN) which is as protected as possible in terms of logistics and physical access.
INA, d.d. video surveillance devices are accessed and operated by employees of the organizational unit in charge of the company security.
Employees of the organizational unit in charge of the company’s security may assign the right of access to video surveillance equipment for the purposes of performing their duties to employees of the contractual security service, managers and employees at the individual sites where video surveillance has been set up, i.e. the organizational unit in charge of maintenance. Thorough records of access to the video surveillance system recordings will show the time and place of access as well as the identification of the person who accessed the data.
All video recordings are clearly identified (marked) by date, time and place of origin, including a unique way of marking individual cameras.
Video recordings on video recorders and/or storage devices are not permanently archived, but are stored in accordance with the legally prescribed deadlines, up to a maximum of 30 days, depending on the capacity of the recorder or data storage device, after which they are automatically deleted. In cases where the Act on the Protection of Monetary Institutions forms the legal basis for video surveillance, video recordings must be kept for a minimum of 168 hours from the moment the recording was made and cannot be deleted during that period.
In the event that certain recordings are necessary for the purposes of establishing or defending of legal claims in court, administrative, arbitration or other equivalent proceedings, INA Corporate Security will put away the subject recordings and store them until the proceedings are completed.
All videos are the property of INA, d.d. and are considered a business secret.
INA, d.d. will not deliver video recordings or make them available to unauthorized persons in any manner and in any form.
All security video surveillance recorders must be connected to the INA, d.d. Surveillance Center, and surveillance with regard to the 24/7 video surveillance is performed by a contractual security company with which INA, d.d. has entered into an appropriate contract with all necessary elements for personal data processing.
COOPERATION WITH COMPETENT AUTHORITIES, EXERCISE OF DATA SUBJECT RIGHTS
Public authorities, in relation to the performance of activities within the scope of their competence stipulated by law and under the conditions prescribed by law, have the right of access and right to the delivery of the video surveillance recordings. INA Corporate Security is in charge of cooperation with public authorities.
Data subjects have the right to request the exercise of their rights prescribed by the General Data Protection Regulation, as described in detail in the Information on the processing of personal data by means of video surveillance, published on INA’s website. The request for exercising rights is referred to the Data Protection Officer. In the event that the request for exercising rights of the data subjects is delivered to INA Corporate Security, It shall be forwarded to the INA Data Protection Officer as soon as possible.
INA, d.d. Data Protection Officer is obliged to act immediately after receiving the request for exercising the rights of the data subject.
The data subject may exercise the rights related to the processing of personal data by means of video surveillance by contacting the data protection officer:
Avenija Većeslava Holjevca 10
attn.: Data Protection Officer
PROCEDURE IN CASE OF PERSONAL DATA BREACH
In the event that a certain person notices a possible personal data breach, they will notify the competent responsible person/manager or employee authorized for personal data protection without delay, and they shall inform the INA Data Protection Officer thereof without delay.
Further procedure is regulated by the valid internal rules of INA Group regarding personal data protection.