Video surveillance system

Information on the processing of personal data through a video surveillance system

1.Data Controller
K. & I. Thomopoulos Hotel Enterprises S.A., Monastiriou 8, 546 29 Thessaloniki,
tel.: 2310563100.

2.Purpose of processing and legal basis
We are using a surveillance system for the purpose of protecting persons and property.
Processing is necessary for the purposes of our legitimate interests pursued as a data controller
(article 6, paragraph 1.f of GDPR).

3.Analysis of legitimate interests
Our legitimate interests consist of the need to protect our establishment and the property
located therein from illegal acts, such as theft. The same applies to the safety of life, physical
integrity, health as well as the property of our staff and third parties who are legally located in
the monitored area. We only collect image data and limit monitoring in areas assessed as high
risk to commit illegal acts e. g. theft, like the entrance, without focusing on areas where it may
be possible to limit excessively the private life of the individuals captured in the images,
including the right to respect their personal data.

4.Recipients
The recorded material is accessible only by our competent/authorised staff that is responsible
for the safety of the area. This material is not transmitted to third parties, except in the following
cases: a) to the competent judicial, prosecution and police authorities when it includes
information necessary for the investigation of a criminal offence concerning persons or property
of the data controller, b) to the competent judicial, prosecution and police authorities when they
legally request data, during the exercise of their duties, and c) to the victim or the perpetrator of
a criminal offense, when it concerns data which may constitute evidence of an act.

5.Storage period
We keep the data for seven (7) days, after which it is automatically deleted. If an incident is
identified during that period, we isolate that section of the video and keep it for up to one (1)
month to investigate the incident and to commence legal proceedings to safeguard our
legitimate interests, and if the incident relates to a third party, we will keep the video for up to
three (3) more months.

6.Rights of data subjects
Data subjects have the following rights:

· Right to access: You are entitled to learn whether we are processing your image and, if so, to
receive a copy of it.
· Right to restrict: You are entitled to request that processing be limited, such as not deleting
data you consider necessary to establish, exercise or support legal claims.
· Right to object: You are entitled to object to processing.
· Right to erasure: You are entitled to request that we delete your data.

You may exercise your rights by sending an e-mail to privacy@hithessaloniki.gr or by mail at our
postal address or by submitting a request in person at our company’s address. To enable us to
examine a request relating to your image, you need to specify when you were in the vicinity of
the cameras and provide us with an image of you to make it easier for us to identify your own
data and to conceal the data of third parties who were involved. Alternatively, we will allow you
to visit our facilities to show you the images you appear in. We would also point out that
exercising your right to object or delete data does not entail the immediate deletion of data or
modification of how it is processed. In all events, we will respond in detail as soon as possible
within the deadlines laid down by the GDPR.

7.Right to file a complaint
If you consider that the processing of data relating to you is contrary to Regulation (EU)
2016/679, you are entitled to submit a complaint to the supervisory authority.
The competent supervisory authority for Greece is the Hellenic Data Protection Authority, 1-3
Kifisias Avenue, 115 23, Athens, https://www.dpa.gr/, Tel. 2106475600.