Video surveillance policy
1. Introduction
1.1 Axis Classic Auto S.R.L. has video surveillance systems in place at the properties where it operates. This policy details the purpose of surveillance and the procedure to be followed to respect the fundamental rights and freedoms of the persons concerned.
1.2. In drafting this policy, the provisions of the General Data Protection Regulation (GDPR), Law No. 190/2018, Law No. 333/2003, Government Decision No. 301/2012, and ANSPDCP Decision No. 174/2018 were taken into account.
1.3. This policy applies to all Axis Classic Auto SRL (hereinafter "Axis") workplaces where video surveillance cameras are used.
2. Locations of surveillance cameras
2.1. The video surveillance system operates in the premises where the company's activity takes place and is appropriately marked to inform staff, customers/suppliers, visitors, etc. (hereinafter "data subjects") that they are in the area covered by surveillance cameras.
2.2. Surveillance cameras are positioned in such a way as to cover all areas of the Axis premises as far as possible, and are therefore located both inside and outside the buildings, in vulnerable areas.
2.3. In principle, areas likely to offer a higher degree of discretion are not monitored.
2.4. Surveillance cameras shall be installed after an assessment of the impact on the privacy of the persons concerned.
3. Types of data collected and purpose of collection
3.1. Axis uses a closed-circuit television system as part of its burglar alarm system to protect its premises, property, and the safety of its employees and customers/visitors. The data provided by this video surveillance system is also used to monitor compliance with anti-Covid health protection measures by employees and customers/visitors, or to monitor and streamline its own activities.
3.2. The use of video surveillance systems for the purpose of ensuring the safety of premises, goods, and valuables is based on the legal obligation provided for by Law 333/2013 and its implementing regulations. In this regard, the processing of data obtained by video means contributes to the prevention, deterrence, management, and, where appropriate, investigation of incidents related to safety and security, potential threats, or unauthorized physical access. Surveillance cameras also serve to protect IT infrastructure.
3.3. Another purpose of processing was determined in the context of the Covid-19 pandemic, when it was necessary to establish a set of rules and measures to limit the spread of the virus, and the video surveillance system offered the benefit of increased control over compliance with these anti-Covid health protection rules. By monitoring the images provided by the system, especially from access areas, the aim is to increase the level of protection as a result of hand disinfection, mask wearing, and maintaining distance between people.
3.4. The data provided by the video surveillance system may be used for auditing purposes, based on Axis' legitimate interest in monitoring and streamlining its activities. Audits may concern employees' compliance with standards and work instructions (image or compliance audit) or may concern the prevention/detection/investigation of fraud or misconduct by employees.
3.5. All surveillance cameras operate 24 hours a day, 7 days a week, and capture images that allow the identification of persons and vehicles in the areas covered. The images are stored in digital format and can provide information such as the date, registration number, location monitored, and time, as applicable.
3.6. Surveillance systems are not used for purposes other than those mentioned above. Video recordings may be transmitted to state authorities at their express request (e.g., courts, prosecutors' offices, police, etc.).
3.7. Users with access rights and responsibilities in operating the video surveillance system receive regular training to ensure compliance with legislation on data protection and the fundamental rights of data subjects.
4. Requests for disclosure of information
Access to images by data subjects
4.1. Data subjects must submit their requests to the company in writing, by email todataprotection@autoklass.roor to the address in Chitila, 103 Rudeni Street, Ilfov County, providing sufficient details to locate the time when the image was captured and the data to be identified, as well as proof of the data subject's identity. Those involved in video surveillance and those responsible for managing the recorded images shall comply with the Procedure for exercising the rights of data subjects – PG 028.
4.2. If Axis is unable to comply with a request for access to data because it would disclose another person's data, it will reject the request, unless the other person sends Axis a statement giving their express consent for their data to be disclosed to the requester.
4.3. Any request for access shall be recorded in a register containing the name of the data subject, the date, time, surveillance camera, reason for disclosure, and date on which the request was answered.
Access and disclosure of images to third parties
4.4. A request by a third party for disclosure of images must be made in writing, in accordance with the provisions of Article 4.1. The provisions of Article 4.2 shall apply accordingly.
4.5. In exceptional circumstances, images may be disclosed to third parties if required by law (e.g., for the purpose of identifying a person who has committed a crime).
4.6. These disclosures will be made with the consent of the Data Protection Officer.
4.7. Any disclosure to a third party shall be noted in a register that shall include the requester, the date, the time, the surveillance camera, the reason for the disclosure, and the date on which the request was answered.
4.8. Additionally, images may be accessed, in exceptional cases and only with the prior approval of the system administrator, by service providers used by Axis to ensure the proper functioning of the video surveillance system.
5. Image storage and system users
5.1. CCTV footage shall not be stored for more than 30 days from the date of recording, except where a crime is being investigated or where Union or domestic law requires longer periods.
5.2. Stored images will be deleted by automatic procedures, in the order in which they were recorded.
5.3. If an image needs to be retained for further investigation or to provide evidence in a security incident, it will be stored for the duration of the investigation.
5.4. If it is necessary for an image to be stored for longer than 30 days, the Data Protection Officer shall be notified and shall authorize such a request.
5.5. The images/recordings collected through the video surveillance system are accessible to the system administrator—the company's general manager—and to persons designated with audit or health and safety compliance responsibilities, on a limited basis.
5.6. Access rights are granted to users by decision of the administrator, for specific purposes, based on the need to know, only for those resources that are strictly necessary for the performance of their duties.
6. Security
6.1. To protect the security of the video system and to respect the rights of the persons concerned, the following technical and organizational measures have been introduced:
- limiting the storage time of images;
- storage media (servers on which recorded images are stored) are located in secure premises, protected by physical and software security measures;
- all users with access rights have signed confidentiality agreements, whereby they undertake to comply with the relevant legal provisions;
- only the company administrator has the right to grant, modify, or revoke users' access rights;
- the system administrator keeps an up-to-date list of all persons who have access to the video surveillance system, specifying the type of access;
- The data protection officer will be consulted before any new video system is purchased or installed.
7. Informing data subjects about video surveillance
Axis will provide a copy of this policy upon request to data subjects. This policy describes the purpose, procedures to be followed, and provides contact details of the data protection officers for those who wish to discuss how video surveillance is conducted.
Data subjects will be notified that Romstal premises are under video surveillance by means of appropriate signage indicating that the video surveillance system is in operation. Appropriate signage (Annex 1) will be displayed prominently at the entrance to the Axis premises and will include essential information regarding the processing of personal data:
- (i) The identity of the operator and contact details;
- (ii) Information regarding processing;
- (iii) Purpose(s) of video surveillance;
- (iv) Rights of the data subject.
In order to exercise the rights of a data subject (access, deletion of data, restriction of processing, opposition, filing a complaint), the data subject must submit a request to this effect, using the following contact details: Chitila, Str. Rudeni nr. 103, jud. Ilfov, e-maildataprotection@autoklass.ro.