This document expands on the information on the “Video surveillance area” sign at the entrances to the establishment of Andrei Gabriel Danila Paparuz (Caramit), in compliance with Article 13 of Regulation (EU) 2016/679 (GDPR) and Article 22 of Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

Identity: Andrei Gabriel Danila Paparuz

Trade name: Caramit

Contact: info@caramit.es

Postal address: Calle Caolín 11, 12530 Burriana (Castellón)

Establishment under video surveillance: Caramit, Calle Caolín 11, 12530 Burriana (Castellón), with the “Video surveillance area” sign at its entrances.

Data Protection Officer: None is required: the processing does not meet any of the cases in Article 37.1 GDPR (it is not a public authority, nor regular and systematic monitoring on a large scale, nor special categories of data on a large scale).

2. What data is processed

Only images captured by the cameras installed inside the establishment.

What is captured. Only the bar and the hall of the premises. No camera points at toilets, staff rest areas, terraces, the public street or other people's premises or spaces.

Images are recorded, not sound. Images are recorded on a memory card inside each camera. The cameras do not capture sound: conversations are never recorded.

No facial recognition or biometric identification systems are used. The system uses motion detection only to generate alerts to the controller; no profiles are created and no automated decisions producing legal effects or significantly affecting people are made.

3. For what purpose

To preserve the safety of people, property and the facilities of the establishment.
To detect robberies, thefts, damage, assaults or other incidents, when they happen or by later reviewing the recording of the period in which they occurred.
To make images of an event of that kind available to the competent authority.
The deterrent effect of a properly signposted video surveillance system.

Regarding staff. The purpose of the system is security, not the supervision of work. As a consequence of that purpose, if a recording documents a specific event affecting the safety of people, property or facilities, or constituting an unlawful act (for example, theft, damage or assault), and an employee is involved, the company may use it as evidence, including in disciplinary proceedings, in accordance with Article 20.3 of the Spanish Workers’ Statute and Article 89.1 of the LOPDGDD. Only the period corresponding to the incident will be reviewed, and only where there are indications that it has occurred. Images are not used to measure performance, monitor working time, schedules or breaks, or check compliance with ordinary work instructions. Recordings are not routinely viewed.

4. Legal basis

Legitimate interest of the controller (Art. 6.1.f GDPR), in relation to Article 22 of the LOPDGDD, which expressly allows the processing of images to preserve the safety of people, property and facilities.
Regarding staff, the same legitimate interest, in relation to Article 20.3 of the Spanish Workers’ Statute and Article 89.1 of the LOPDGDD, staff having been informed expressly, clearly and concisely, with acknowledgement of receipt.

5. How long they are kept

Images are kept for a maximum of one month from capture (Art. 22.3 LOPDGDD). In practice, the memory card of each camera automatically overwrites the oldest recordings within days, and every month it is checked that no recording exceeds the period.

Exception. When a recording documents an event affecting the safety of people, property or facilities, the corresponding period is extracted and kept, separately and under the control of the controller, only until it is handed to the competent authority or until the end of the proceedings for which it serves as evidence. It is then deleted.

6. Who they are disclosed to

To the police and security forces, the courts and other authorities with the legal power to request them, when they so request or when the images document an event of the kind described. In that case they are made available within a maximum of 72 hours from becoming aware of the recording (Art. 22.3 LOPDGDD).
To no one else. Images are not given to private individuals, insurers or other companies: anyone needing images of an event must request them through the competent authority.

No cloud, no third parties and no international transfers. No cloud storage service or external provider with access to the images has been contracted. There are no data processors or international data transfers. Images are not stored outside the camera itself, except for the copies extracted from an incident described in section 5.

7. Your rights and how to exercise them

You may exercise your rights of access, rectification, erasure, restriction of processing and objection, as well as the right not to be subject to automated individual decisions, by writing to info@caramit.es or to the postal address in section 1. Your request will be answered within a maximum of one month.

Right of access to images. To locate them, state in your request the date and time slot when you were on the premises; you may be asked for a recent photograph to identify you in the recording. On receiving the request, if the period still exists, it is extracted and preserved so that automatic overwriting does not delete it. You will be given a copy of the images in which you appear where this is possible without affecting the rights of other people who also appear; if not, you will be told in writing that the images exist, the period they cover and the characteristics of the processing, and they will remain available to the competent authority if you so request. If more than one month has passed since the date given, the images no longer exist, unless they were extracted for documenting an incident (section 5), and you will be told so in writing.

Erasure and restriction. Images are deleted automatically within a maximum of one month. A request for erasure will only be refused, with reasons, when the images are necessary for the establishment, exercise or defence of legal claims (Art. 17.3.e GDPR). If you request restriction of processing, the period concerned is extracted and kept without being used until it is resolved. The right to object will be resolved with reasons. Before replying, you will be asked to prove your identity, without requiring more data than necessary.

8. Complaints

If you consider that the processing does not comply with the regulations, you may file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es), without prejudice to first contacting the controller through the contact given.

9. Source of the data

The data comes from the data subject themselves, captured by the cameras installed inside the establishment and signposted at all its entrances.

Document available to the public at the establishment and at caramit.es/videovigilancia.

Additional information on the processing of personal data through video surveillance