CCTV privacy

This Privacy Notice explains the kind of personal data GWU collects from you when visiting GWU and how GWU uses this data.

1. Why do we collect personal data?
   GWU collects data through the CCTV system for various reasons:
   
   a. To control access to the building and to ensure the security of the building, the safety of GWU staff and visitors, as well as property and information located or stored on the premises.
   
   b. To prevent, deter, and if necessary, investigate unauthorized physical access, including unauthorized access to secure premises and protected rooms, IT infrastructure, or operational information.
   
   c. To prevent, detect and investigate a theft of equipment or assets owned by GWU, visitors or staff or threats to the safety of personnel working at the office (e.g. fire, physical assault). The CCTV system is not used for any other purpose, such as to monitor the work of employees or their attendance. It is important to notice that the location and positioning of the video-cameras are such that they are not intended to cover the surrounding public space; the cameras aim to give a general overview of what’s happening in certain places but not to recognize persons. The system is also not used as an investigative tool or to obtain evidence in internal investigations or disciplinary procedures unless a security incident is involved. (In exceptional circumstances, the data may be transferred to investigatory bodies in the framework of a formal disciplinary or criminal investigation). The CCTV cameras are installed as follows:
   – Level -2: Youth Hub
   – Level  0: Reception area
   – Level  1: Corridor and hall
   – Level  2: Corridors, including those in the school area
   – Level  3: Corridor
   
   Cameras located at the entrances are placed and focused in a way that only people who want to access the site or the annexed facilities including parking areas property are filmed.
   The CCTV system covers the area of entry and exit points of the building, entry points inside the building, delivery, and outer area of the building.
   
   
2. What kind of data does GWU collect?
   a. GWU collects just images caught on camera, and no voice is recorded.
   
   
3. Who is responsible for the processing of the data?
   a. GWU is the legal entity who initiated the processing of personal data and who determines the objective of this processing activity.
   
   
4. Which is the legal basis for this processing operation?
   a. GWU uses video-surveillance equipment for security and access control purposes, which is an action necessary for the management and functioning of GWU. Therefore, the processing is lawful under GDPR. Carrying out video-surveillance is necessary for compliance with a legal obligation.
   In addition, there are on-the-spot-notices about the video-surveillance activity, clearly visible so in this case using the specific sign-posted part of the facility may constitute the fact that the processing is lawful because “the data subject has unambiguously given his or her consent”.
   
   
5. Who can see my data?
   a. The images can be accessed by the security staff members of GWU and by the contracted security company. Access to the hard-disc recorder is highly limited, being protected by a password and recording any log or action from the staff members. The data cannot be accessed without the authorization of the Data Controller.
   
   
6. How to control your data?
   a. GWU appointed Dr. Antonello Florio has its own Data Protection Officer as per art. 39 of GDPR. So in case of need you can send an email request to [email protected]
   
   
7. Can I access my data?
   a. You have the right to access your data at any time and free of charge, by sending an email request to [email protected]
   
   
8. Can I modify my data?
   a. Modifying the CCTV footage is not allowed. However, you can modify the report written by the security staff in connection with a security incident, if applicable in your case.
   
   
9. Can I block you from processing my data?
   a. You have the right to block the processing of your personal data at any time by sending an email request to [email protected] when you contest the accuracy of your personal data or when the GWU no longer needs the data for completing its tasks. You can also block the processing activity when the operation is unlawful, and you oppose to the erasure of the data. However, blocking is not possible in case of an official investigation.
   
   
10. Can I delete my data?
    a. You have the right to delete your data at any time by sending an email request to  [email protected] when the processing activity is unlawful.
    
    
11. Do you share my data with other organisations?
    a. We keep your data inside GWU unless you ask us or give us your permission to share it. In case we share your data with third parties, you will be notified to whom your personal data has been disclosed.
    
    
12. Do I have the right to object?
    a. Yes, you have the right to object at any time by sending an email request to  [email protected] when you have legitimate reasons relating to your particular situation. Moreover, you will be informed before your information is disclosed for the first time to third parties, or before it is used on their behalf, for direct marketing purposes. GWU will address your requests within 15 working days from the receipt of the request.
    
    
13. What can I do in the event of a problem?
    a. The first step is to notify GWU by sending an email to  [email protected] and ask us to take action.
    b. The second step, if you obtain no reply from us or if you are not satisfied with it, contact our Data Protection Officer (DPO) at dpo@adminuserc.
    c. At any time you can lodge a complaint with the IDPC at IDPC Complaint Form, who will examine your request and adopt the necessary measures.
    
    
14. When will we start the processing operation?
    a. We will start the processing operation when you are visiting GWU premises.
    
    
15. Security of personal data
    a. GWU is committed to protecting the security of your personal data. Therefore, we use several security technologies and procedures to help us to protect your personal data from unauthorized access, use or disclosure. We keep your data on computer systems with limited access and inside controlled facilities.
    
    
16. How long do we keep your data?
    a. GWU will keep your personal data for seven calendar days after your visit to our premises. After that period any CCTV recorded footage is automatically deleted