CCTV privacy notice
FundRock LIS S.A. (“LIS” or “we”) and its Apex affiliates are committed to protecting the privacy and security of all personal data.
This notice summarises the nature of the personal data that is stored by LIS, why and how it is used, and your rights in regard to this data, as well as the protections in place to safeguard it. It should be read in conjunction with the Apex global privacy notice, the Apex Employee privacy notice and the Data Privacy and Data Protection Policy.
This notice applies to current and former employees, workers, agency staff and contractors. The policy applies to all current and former employees of LIS and its Apex affiliates, including permanent employees and temporary/contingent workers. It also applies to all visitors to the secured premises monitored by the CCTV.
Identification of the Controller
FundRock LIS S.A.
5 Heienhaff, L-1736 Senningerberg, Luxembourg
RCS n°B148473
1. Data protection principles
We comply with data protection law and principles, which means that your personal data will be:
- Used lawfully, fairly and in a transparent way.
- Collected only for valid explicitly defined purposes and not used in any way that is incompatible with those purposes.
- Relevant to the purposes we have told you about and limited only to those purposes.
- Accurate and, where necessary, kept up to date.
- Kept only as long as necessary for the purposes.
- Kept securely.
2. What kind of personal data do we collect and DO NOT collect and when?
We COLLECT:
- Video footage of entrances/exits (including emergency exits)
The CCTV monitors access points inclusive of entrances/exits and emergency exits) only.
The CCTV DOES capture video footage of employees entering and exiting the office premises, as well as any other person authorised or unauthorised entering the premises.
We DO NOT COLLECT:
- No footage of other areas and workstations
The CCTV DOES NOT capture footage of common areas (i.e. kitchens), the mothers’ rooms and the restrooms.
The CCTV DOES NOT capture footage of workstations (e.g. employees’ desks, individual offices, meeting rooms etc.) - No Automatic processing of the video footage
The footage captured by the CCTV IS NOT automatically processed.
The CCTV DOES NOT have the facial recognition capability to identify a natural person (e.g. employee, contactor, visitor etc.). - No sound recording
The CCTV DOES NOT record any sound.
3. How do we collect your personal data?
We collect information by way of installed CCTV cameras monitoring and recording certain areas of the premises situated at 5 Heienhaff, L-1736 Senningerberg, Luxembourg.
4. How will we use information about you and the legal basis of processing ?
LIS processes the personal data collected primarily on the basis of a legitimate interests of LIS, in compliance with Article 6.1 (f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”) exclusively for the purposes listed below:
- Secure access to the premises;
- Ensure the safety of the employees, clients, contractors and any other visitors;
- Detect and identify suspicious or dangerous behaviours which may cause incidents;
- Pinpoint the origin and the time of an incident;
- Protect LIS’ equipment and furniture; and
- Defend, exercise, or demonstrate in court of the rights and interests of LIS.
5. Limitation of purpose
We will only use your personal data for the purposes for which we collected it as stated in section 4. Any changes to the above purposes listed in section 4 related to CCTV operations will be subjected to the procedure required by Article 261-1 of the Luxembourg labour code and an update of this privacy notice in compliance with Articles 12 and 13 of GDPR.
6. Data sharing
We may share your personal data with the competent authorities, where required (e.g. emergency services, police, courts of law) or with other Apex entities for the purposes of the relevant investigations.
7. Data security
We have put appropriate security measures in place to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees and third parties who have a legitimate need to know.
We have put procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
8. Data retention
How long will we store your information for?
Personal data collected by the CCTV (i.e. video footage) will be stored for thirty (30) calendar days (the “Retention Period”). Footage older that the Retention Period is automatically replaced by new footage.
In case of an incident, the video footage might be stored for a longer period, in order to assist an investigation and/or be used in legal proceedings.
9. Rights of access, correction, erasure and restriction
Your rights in connection with personal data
Under certain circumstances, by law you have the right to:
- Request information in relation to this privacy notice.
- Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
- Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes.
- Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
10. What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
11. Data protection officer
The Data Protection Officer oversees compliance with this privacy notice in each office. If you have any questions about this privacy notice or how we handle your personal data, please contact your local Data Protection Officer at dpo.luxembourg@apexgroup.com
12. Right to lodge a complaint with the Data Protection Authority
If you are not satisfied with our response, you can make a complaint to the Commission nationale pour la protection des données (“CNPD”).
Commission nationale pour la protection des données
Service des réclamations
15, Boulevard du Jazz
L-4370 Belvaux
Changes to this privacy notice
We will update this privacy notice when necessary to reflect changes in the law, our practices, as well as to ensure it is accurate and up to date. When we make an update we will amend the date at the top of this notice, you are therefore advised to check this privacy notice periodically. We may also notify you in other ways from time to time about the processing of your personal information. Any changes to the purposes of CCTV operations will be subjected to the procedure required by Article 261-1 of the Luxembourg labour code and an update of this privacy notice in compliance with Articles 12 and 13 of GDPR.
