1.Data Controller

The société anonyme with corporate name “MICHAIL GIAOURTAS AS TOURISTIKAI KAI XENODOCHEIAKAI EPICHEIRISEIS ANONYMOS ETAIREIA” and distinctive title “SOFIA S.A.” with G.E.MI. number 123658027000, Greek Tax Identification Number 094090676 of the Heraklion Tax Office, with registered seat at N. Alikarnassos of Heraklion Crete, 57 Stadiou str., 71601, with phone number (+30) 2810.240.002 and email address info@hotel-sofia.gr.

2. Purposes and legal basis for processing

We use surveillance system for the safety and protection of our staff, customers, visitors, office premises, goods and other assets, after assessing the impact on the rights of data subjects. The system is not used for the surveillance and evaluation of employees within their offices and workplace. The operation of cameras ensures increased protection of our assets (indicatively, prevention and proof of criminal acts, such as theft, violence and vandalism, early detection of malicious actions, immediate fire containment, etc.) especially during the night where such risks may be increased. The video surveillance system has been installed according to the principle of proportionality, so that it is limited to the processing that is necessary for the above purposes (article 6 par. 1. in Regulation 2016/679/EU).

3. Legitimate interests’ analysis

Our legitimate interest is composed of the need to protect our real estate property and the goods located in it, against illegal acts, such as theft. The same applies to the safety of life, physical integrity, health as well as the property of our staff and third parties legally located in the supervised area. We only collect image data and limit the surveillance to areas where we have assessed that there is an increased chance of committing illegal acts e.g. theft, as near our coffers and at the entrance/exit of our premises, without focusing on areas where the privacy of the persons being surveilled may be severely restricted, including their right to respect for their personal data.

4. Video Surveillance Data and Recipients

The video surveillance system consists of special recording machines and fixed cameras, some of which operate twenty-four (24) hours a day, seven (7) days a week. The video surveillance system records the monitored area together with the respective date and time.

Collected material from the video surveillance system is accessible only by competent / authorized personnel in accordance with their specialized work roles or by our partners who are in charge of security.

This material is not transmitted to any third parties, except in the following cases: a) to the competent judicial, prosecutorial and police authorities when it contains information necessary for the investigation of a criminal offense involving persons or property of the data controller; and b) to the competent judicial, prosecutorial and police authorities when such authorities are requesting data, lawfully, in the context of performing their duties.

5. Retention Time

We retain the collected data for fifteen (15) days, after which period such data is automatically deleted. In case we find that an incident occurred during this period, we isolate a part of the video and keep it for one (1) additional month, in order to investigate the incident and initiate legal proceedings to defend our legitimate interests, while in the case where the incident concerns a third party we may keep the video for up to three (3) more months.

6. Rights of data subjects

Data subjects have the following rights:

– Right of access: you have the right to know if we are processing your image and, if so, to receive a copy thereof.

– Right of restriction: you have the right to ask us to restrict processing, such as not deleting data that you deem necessary to establish, exercise or support legal claims.

– Right to object: you have the right to object to the processing.

– Right of erasure: you have the right to request the erasure of your data.

You can exercise your rights by sending an e-mail to info@hotel-sofia.gr or a letter to our postal address or by submitting the request to us in person, at the premises of our hotel. In order to examine a request related to your image, we require that you inform us about when you were within range of the cameras and give us a picture of you, to make it easier for us to locate your data and hide the data of third parties depicted. We also note that exercising the right of objection or erasure does not imply the immediate deletion of data or the modification of the processing. In any case, we will answer you in detail as soon as possible, within the deadlines set by Regulation (EU) 2016/679.

7. Right to file a complain

In case you consider that the processing of your personal data violates Regulation (EU) 2016/679, you have the right to file a complaint to a supervisory authority. The competent supervisory authority for Greece is the Hellenic Data Protection Authority, at 1-3 Kifissias avenue, 115 23, Athens, www.dpa.gr, telephone number (+30)210-6475600.