Privacy Policy

VIDEO SURVEILLANCE PERSONAL DATA RECORDING POLICY OF “VATISTAS AND ASSOCIATES ACCOUNTING S.A.”

GENERAL – DEFINITIONS

    This “VIDEO SURVEILLANCE PERSONAL DATA RECORDING POLICY” (hereinafter the “Policy”) concerns the operation of a video surveillance system (hereinafter the “System”) at the operating premises of the societe anonyme under the name “VATISTAS AND ASSOCIATES ACCOUNTING S.A.” and the distinctive title “VATISTAS ACCOUNTING SA,” headquartered in Glyfada, Attica, at 107 Vouliagmenis Ave. and Megalou Alexandrou St., with Tax ID 800398071 (Tax Office: KE.FO.DE. Attica) and G.E.MI. No. 120077103000 (hereinafter the “Company”), by the latter. The Policy describes the manner, terms, conditions, and extent of the System’s operation. Furthermore, the Policy provides information to visitors/customers/contractors/employees at the Company’s premises (hereinafter the “Data Subjects”) regarding the above, the purpose of the System’s operation, the processing of their personal data through the System (hereinafter the “Data”), and the rights of the Data Subjects regarding the protection of their Data, as well as the method for exercising these rights.

    1. SYSTEM OPERATION – PURPOSE
      1. The System consists of cameras permanently installed in various visible locations within the Company’s operating premises, and it records the movements of Data Subjects who enter/move/remain within and around the Company’s premises. Specifically, the System includes cameras positioned to record all potential entry points to the Company’s premises, which operate continuously and uninterruptedly, as well as cameras within the reception and transaction areas of the Company, which operate during the Company’s business hours.
      2. The System is installed solely for the protection of persons and goods, specifically for the purpose of preventing the commission of offenses against the company’s fixed assets, property, and ownership rights (theft, embezzlement, etc.), as well as protecting the safety of life, physical integrity, and property of the Data Subjects.
      3. The System is not used for monitoring the Company’s employees in their workplaces for the purpose of controlling/evaluating or training them, nor for recording the movements and habits of the Data Subjects.
      4. The System does not record audio.
      5. The Company processes only the Data strictly necessary to fulfill the aforementioned purposes; specifically, only image data is collected, and recording is limited to areas where existing conditions indicate an increased probability of illegal acts (e.g., theft, robbery).
      6. Focusing is not conducted in a way that excessively restricts the private life of the Data Subjects or, in general, where there is a possibility of excessive interference with the Data of the Data Subjects.
      7. The Company does not further process the collected Data for purposes other than those predetermined and described in the Policy.
    1. DATA CONTROLLER

    The Company is the Data Controller for the Data received through the System, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”), Law 4624/2019 as in force, the relevant Directives of the Hellenic Data Protection Authority (HDPA) (Directive 1/2011 “Use of video surveillance systems for the protection of persons and goods”), and the relevant guidelines of the European Data Protection Board (“Guidelines 3/2019 on processing of personal data through video devices”).

    The Company has placed information signs in its operating areas where the System is present—in accordance with the standards and instructions of the HDPA—so that Data Subjects are informed upon entry into these areas about the recording cameras, as well as the Company’s contact details, so that anyone who wishes may send a request regarding the processing of their Data (see Article 9 of the Policy for details).

    1. LEGAL BASIS FOR PROCESSING

    The legal basis for processing the Data recorded through the System is Article 6(1)(f) of the GDPR. Processing is necessary for the protection of the fixed assets and property of the Company and the Data Subjects, as well as for the protection of the safety of life, physical integrity, and property of the Data Subjects. The Company’s premises, which are accessible to Data Subjects, must be protected from illegal acts, such as theft and damage to its own property and/or that of its staff and/or its customers, or even robberies or other illegal actions that may endanger the life, physical integrity, or general safety of the Company’s employees or Data Subjects on the Company’s premises. After balancing the interests of the Data Subjects whose Data may be processed against the legitimate interest of the Company as the Data Controller for the security of the monitored area and the defense of the rights of the persons present, the latter prevails.

    1. DATA PROCESSING – DATA PROCESSOR
      1. The System allows the real-time transmission of images captured by each camera to the data collection-recording equipment. Image data is encoded using a compression algorithm and stored on digital storage media.
      2. Access to the System and its recorded material is restricted to specifically authorized individuals associated with the Company (hereinafter the “Authorized Persons”). Authorized Persons are aware of the purpose of the processing and the extent of the permitted use of the Data and are bound by relevant confidentiality and secrecy clauses.
      3. The Data recorded and stored by the System is not disclosed or transmitted to third parties except with the consent of the Data Subjects. Exceptionally, Data of the Data Subjects may be transmitted securely without their consent to public authorities and/or other third parties when required by applicable law, including the Company’s compliance with court decisions, as well as in the event of illegal incidents where the competent judicial, prosecutorial, and/or police authorities, within the scope of their duties, lawfully request Data as part of an investigation, preliminary examination, or inquiry into the aforementioned incidents.
    1. SYSTEM INSTALLATION AREA – RETENTION PERIOD
      1. The System equipment, where visual data retrieved from the cameras is collected, recorded, and stored, is located in a suitably configured area (office) of the Company, situated within the Company’s operating premises. Entry to the area is possible only for Authorized Persons. Access to the System is also possible only for Authorized Persons and only through specific access codes.
      2. The retention period for the data recorded by the System is fourteen (14) days. In the event of an incident or occurrence against the Company or its goods, or against its staff or customers, the recording of the incident may be kept in a separate file for a period of thirty (30) days from the time the incident or occurrence took place. In the event of an incident or occurrence against a third party or their goods, the recording of the incident may be kept in a separate file for a period of three (3) months from the time the incident or occurrence took place. Upon expiration of the aforementioned time periods, the recorded data is deleted.
    1. DATA SECURITY MEASURES

    Within the framework of the aforementioned Data processing, the Company has taken the following organizational and security measures:

    1. Computers used for processing are equipped with anti-malware software (antivirus).
    2. Physical protection measures and measures to prevent access by unauthorized persons are applied to the equipment used for processing.
    3. Access to the electronic systems of the System (images and Data) is possible only through access codes known only to Authorized Persons and using approved software.
    4. Access rights to the System are periodically reviewed by the Company, and procedures for periodic password changes are in place.
    5. Maintenance is performed on the information systems used in the context of processing.
    6. The aforementioned security measures are updated either on a regular basis or as needed due to extraordinary circumstances, so that they are always effective and provide the highest possible degree of protection for the Data being processed.
    7. The Company will immediately inform the Data Subject of any breach or transmission of their Data, provided that it is not prohibited by applicable law or by the authority that imposed the transmission.
    1. DATA TRANSMISSION

    Within the scope of the Company’s operation, third-party natural or legal persons may receive Data of Data Subjects. Such persons are primarily the Company’s external legal advisors. The Company ensures that any transmission is limited to the Data strictly necessary for the fulfillment of the processing purpose and for the recipients’ compliance with confidentiality and data protection obligations. Furthermore, Data may be transmitted to public authorities and other third parties when required by applicable law, in accordance with the provisions of Article 5 of the Policy, namely when: a) the information is necessary for the investigation of a criminal act or b) the competent authorities lawfully request its provision in the exercise of their duties. Data may also be provided to the alleged victim or the alleged perpetrator of a criminal act in order to exercise their legal rights, following an order from a judicial or other authority.

    9. RIGHTS OF DATA SUBJECTS

    The Data Subject has—under specific conditions, as the case may be—the following rights:

    1. Right of access to the recorded Data concerning them.
    2. Right to receive the Data concerning them in a structured, commonly used, and machine-readable format (right to portability).
    3. Right to rectification, if their Data is inaccurate.
    4. Right to erasure of their Data, unless its retention is mandatory by law.
    5. Right to restriction of processing. This right is exercised when: a) the accuracy of the Data is contested by the Data Subject and applies for a period enabling the Company to verify the accuracy of the Data, b) the Company no longer needs the Data for the purposes of processing, but the Data is required by the Data Subject for the establishment, exercise, or defense of legal claims, and c) the Data Subject has the right to object to processing, pending verification of whether the Company’s legitimate grounds for processing override those of the Data Subject.
    6. Right to object to the processing of Data. Regarding the Data Subject’s right to object to the processing of their Data, it is noted that based on the Legal Basis for Processing (Article 4 of the Policy), there are compelling and legitimate grounds for processing that override the interests, rights, and freedoms of the Data Subject, as well as reasons related to the establishment, exercise, or defense of legal claims by the Company or third parties, which in principle preclude the satisfaction of the relevant right.

    9.7.1. To exercise the right of access (under 9.1.) and erasure (under 9.4.) of the Data, the Data Subject should contact the Company by sending an email to secretary@vatistasgroup.com requesting access to the recorded Data and, if they wish, its erasure. The Company responds to the aforementioned request within fifteen (15) business days, at which time it will inform the Data Subject about the progress and implementation of the request. Following the aforementioned request for erasure, the Company deletes the Data, provided there is no legal obligation or provision requiring its retention.

    9.7.2. To exercise the right to portability (under 9.2.), rectification (under 9.3.), restriction (under 9.5.), and objection (under 9.6.), the Data Subject should contact the Company by submitting their request via email to secretary@vatistasgroup.com. The Company takes every possible measure to satisfy the request within thirty (30) business days of receipt, at which time the Data Subject will be informed of its progress. The aforementioned deadline may be extended for two (2) additional months, taking into account the complexity of the request and the overall number of requests submitted. These rights are exercised at no cost to the Data Subject, unless they are repeated frequently and, due to volume, entail administrative costs for the Company, in which case the Data Subject will be charged the relevant cost.

    9.7.3. For the effective exercise of their request, the Data Subject must specify the time period during which they were within the range of the System. It may also be required, for the satisfaction of the request, to provide their image to facilitate the location of the Data concerning them and the masking of third-party Data.

    9.8. In any case, the Data Subject has the right to appeal to the Hellenic Data Protection Authority, 1-3 Kifissias Ave., Athens, P.C. 115 23, Tel. 210 6475600, e-mail: contact@dpa.gr, https://www.dpa.gr, if they consider that their rights regarding the processing of their Data are being infringed and/or they are not satisfied with the response from the Company as the Data Controller.

    10. Changes to this Policy.

    The Company reserves the right to modify the Policy at any time. Changes to this Policy will be posted on the website https://vatistasgroup.com. Data Subjects should review the Policy for any changes or additions, and the Company is under no obligation to individually inform each Data Subject about the Policy and/or their rights.

    Date of last update: 06/12/2026