UPDATE ON PERSONAL DATA PROCESSING THROUGH CLOSED-CIRCUIT TELEVISION (CCTV)

We inform you that DirectPay premises are monitored by a closed-circuit television (CCTV) system, which records images of visitors and employees 24/7 at the entrances (both internal and external) of the Company. The recording is conducted in accordance with applicable law.

1. DATA CONTROLLER – CONTACT INFORMATION

DIRECT PAY A.E. ΙΔΡΥΜΑ ΠΛΗΡΩΜΩΝ (διακριτικός τίτλος: DirectPay)

Address: 1 Androu Patission, 11257, Athens

Phone: +30-210-5243171

E-mail: info@directpay.gr

2. DATA PROTECTION OFFICER

For matters related to the processing and general management of personal data, you can contact the Company’s Data Protection Officer (DPO) at the email address privacy@directpay.gr.

3. PURPOSE LEGAL BASIS OF PROCESSING

We use a video surveillance system for the purpose of ensuring the safety and protection of individuals and property.

The legal basis for this processing is the protection of the legitimate interests of the Company, in accordance with Article 6(1)(f) of the General Data Protection Regulation (EU) 2016/679.

Our legitimate interest is understood as the protection of the premises and the property within it from illegal activities, such as theft or vandalism. Additionally, we are obligated to ensure the safety of the lives, physical integrity, health, and property of the Company’s employees and visitors.

Only image data is collected from the entrances of the Company (both internal and external), without any excessive intrusion into privacy.

4. RECIPIENTS OF PERSONAL DATA

The data collected through the operation of the video surveillance system is stored in an electronic file, which is kept in a secure area of the Company and is accessible only to our authorized and designated personnel. This material is not transmitted to third parties, except in the following cases: a) to the competent judicial, prosecutorial, and law enforcement authorities when it includes information necessary for the investigation of a criminal offense related to the persons or property of the data controller, b) to the competent judicial, prosecutorial, and law enforcement authorities when they request data lawfully in the performance of their duties, and c) to the victim or perpetrator of a criminal offense when the data may serve as evidence of the offense.

5. RETENTION PERIOD OF THE DATA

The data recorded by the system is retained for 15 calendar days, after which it is automatically deleted and cannot be recovered. If we detect an illegal incident, we will keep the specific recording in a separate file for 1 month for investigation and to initiate legal proceedings to protect our legitimate interests. In cases where the incident involves a third party, the specific recording may be retained in a separate file for 3 months.

6. RIGHTS THAT SUBJECTS HAVE IN RELATION TO THEIR PERSONAL DATA

In relation to the processing of your personal data, you may exercise the following rights:

• Right of access

You have the right to know if we are processing your image and to obtain a copy of it.

• Right to erasure (“right to be forgotten”)

You have the right to request the deletion of your personal data.

• Right to restriction of processing

You have the right to request the restriction of the processing of your personal data when:

• when their accuracy is contested and until the relevant verification is completed
• alternatively, instead of erasing them
• when they are no longer needed for the purposes for which we collected them, but are necessary for the establishment, exercise, or defense of legal claims.
• when you have objections to their processing and until it is verified that there are legitimate grounds for the processing by the Company.
• Right to object to processing

You have the right to object to the processing of your personal data when it is based on legitimate interests.

[It is noted that in typical cases of video surveillance systems, the rights to access, restriction, objection, and erasure apply, while in exceptional cases, other data subject rights may also apply.]

To exercise the above rights or for any questions, complaints, or further information regarding the processing of your personal data, you can contact us at privacy@directpay.gr or using the contact details provided in paragraph 1.

To review a request related to your image, you will need to specify the date and approximate time of the data recording, as well as the area of the Company where the recording took place. This will help us locate your data more efficiently and contribute to the masking of third-party images. Alternatively, you have the option to visit our premises to view the images in which you appear. Please note that exercising the right to object or erase does not imply immediate deletion of data or modification of processing. In any case, we will respond to you in detail as soon as possible, within the timeframes specified by the GDPR.

7. RIGHTS TO COMPLAIN TO THE PERSONAL DATA PROTECTION AUTHORITY (DPA)

You have the right to submit a complaint to the Personal Data Protection Authority (www.dpa.gr) regarding issues related to the processing of your personal data.

8. LATEST POLICY UPDATE

This policy may be updated periodically.

The current latest version is effective from 01.06.2024.