NOTICE PURSUANT TO ART. 13 OF THE GDPR
REGARDING THE VIDEO SURVEILLANCE SYSTEM OPERATED BY THE COMPANY

Pursuant to Art. 13 of EU Regulation No. 2016/679, the General Provision of the Italian Data Protection Authority dated April 8, 2010, and Guidelines 3/19 on the processing of personal data through video devices,
S.A.I.T. SRL, with registered office at Via Vettor Pisani 56, 30013 Cavallino-Treporti (VE), VAT/Tax ID 01952110276, represented by its current legal representative, acting as Data Controller, wishes to inform you that, pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data, the General Provision of the Italian Data Protection Authority dated April 8, 2010, and taking into account Guidelines 3/19 on the processing of personal data through video devices—for reasons of prevention, organizational security, and protection of assets—certain areas and premises of the Company – duly indicated by signage required by the Italian Data Protection Authority – are monitored by a video surveillance system.

Type of data subject to processing

Only personal data originating from the video surveillance system will be processed, namely the images captured by the installed video system.

Purpose and Legal Basis of the Processing

Video surveillance systems have been installed for the following purposes:

  • protection of company property;
  • prevention and protection of the safety of employees and visitors;
  • access control.

The legal basis for the processing is the legitimate interest of the data controller pursuant to Article 6(f) of
EU Regulation 679/2016.

Methods of processing and retention period for images

The images collected are processed in accordance with the principles of lawfulness, fairness, and transparency, and in any case in such a way as to ensure their security and protect the data subject’s maximum confidentiality. In particular, the data collected are protected by appropriate security measures to reduce the risk of destruction, loss, and/or unauthorized access. The images are recorded and stored for a maximum of 72 hours. Only in certain cases, due to specific needs and/or in the event of particular occurrences, may the retention of the aforementioned data be extended for a period not exceeding 7 days, except in the event of a request by the Judicial Authority and/or the Judicial Police.

Categories of recipients of personal data

The processed data will not be disclosed to third parties. Recipients of the collected data may, however, include—in addition to the data controller:

  • individuals, entities, and authorities to whom disclosure is mandatory pursuant to laws, regulations, or orders from authorities;
  • our employees, provided they have been previously designated as persons acting under the authority of the Data Controller, in accordance with Article 29 of the European General Data Protection Regulation, or as System Administrators;
  • maintenance technicians or external parties responsible for system maintenance, provided they have been previously designated as external data processors, in accordance with Article 28 of the European Regulation.

Transfer of Personal Data to Third Countries

The data controller does not intend to transfer your personal data to third countries. In fact, all processing of personal data takes place within the borders of Italy, or in certain limited cases within the European Union.

Rights of Data Subjects

Pursuant to Articles 15–22 of EU Regulation 679/2016, we inform you that with regard to the processing of your personal data, you may exercise the following rights, if applicable:

  • Right of access to personal data and the following information: confirmation as to whether or not your personal data is being processed; purposes of the processing; categories of personal data; recipients or categories of recipients to whom the personal data have been or will be disclosed; if the data were not collected from the data subject, all available information regarding their origin; existence of automated decision-making, including profiling; a copy of the personal data undergoing processing.
  • Right to rectification and completion of personal data.
  • Right to erasure of data (“right to be forgotten”) if one of the following grounds applies: the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; the data subject withdraws consent to the processing of the data and there is no other legal basis for the processing; personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject. If the controller has made personal data public and is required to erase it, the controller must inform other controllers processing the personal data of the request to remove any links, copies, or reproductions of the data.
  • Right to restriction of processing in cases where: the data subject contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data; the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead that its use be restricted; although the controller no longer needs the personal data for the purposes of the processing, the data subject requires the personal data for the establishment, exercise, or defense of legal claims; the data subject has objected to the processing, pending verification as to whether the legitimate grounds of the data controller override those of the data subject.
  • Right to lodge a complaint with the Data Protection Authority, following the procedures and guidelines published on the Authority’s official website www.garanteprivacy.it.

The exercise of these rights is not subject to any formal requirements and is free of charge.

How to Exercise Your Rights

To exercise any of your rights, you may do so at any time by sending a certified letter with return receipt addressed to the Data Controller’s registered office or by sending an email to privacy.sait@vacanze-natura.it.
Any changes to the video surveillance system will require a modification and/or amendment to the authorization granted by the competent Labor Inspectorate, and all affected parties will be provided with adequate and timely notice through an update to this privacy notice.