Surveillance

CCTV SURVEILLANCE PRIVACY NOTICE

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), we provide the following information on the processing of personal data through CCTV surveillance at Centrum Medyczne Tartaczna 2 in Gdańsk, Poland.

1. Data Controller

The controller of personal data collected through CCTV surveillance is Centrum Medyczne Tartaczna 2 spółka z ograniczoną odpowiedzialnością spółka komandytowa, with its registered office at ul. Tartaczna 2/1A, 80-839 Gdańsk, Poland, REGON 386604641, KRS 0000851660, hereinafter referred to as the "Controller" or the "Medical Centre".

Contact details:

• telephone: +48 58 719 10 25;
• email: kontakt@tartaczna2.pl;
• for personal data protection matters: iod@tartaczna2.pl.

2. Purposes and Legal Basis of CCTV Surveillance

CCTV surveillance is used to ensure the safety of patients, staff and other persons present at the Medical Centre, to protect property and to prevent incidents that may threaten safety and security.

The legal basis for processing personal data is Article 6(1)(f) GDPR, namely the Controller's legitimate interest in ensuring the safety of individuals and protecting property, taking into account Article 23a of the Polish Act of 15 April 2011 on Medical Activity.

Surveillance is conducted only to the extent necessary to achieve these purposes, with due respect for the privacy, dignity and personal intimacy of patients and other individuals.

3. Areas Covered by CCTV Surveillance

CCTV surveillance covers selected publicly accessible areas of the Medical Centre at ul. Tartaczna 2/1A in Gdańsk, in particular:

• the entrance area;
• the reception area;
• the waiting room;
• the corridor leading to the office rooms.

Surveillance does not cover rooms where healthcare services are provided or sanitary facilities.

4. Scope of Personal Data Processed

CCTV surveillance involves recording images of individuals within the monitored areas, including their likeness, the date and time of their presence and events captured by the cameras.

Audio is not recorded.

5. Retention Period of Recordings

CCTV recordings are stored on a local recording device for approximately 30 days from the date of recording, after which they are automatically overwritten.

The retention period does not exceed three months from the date of recording, in accordance with Article 23a of the Polish Act on Medical Activity.

If a recording constitutes or may constitute evidence in proceedings conducted under applicable law, it may be preserved and retained for the period permitted by the relevant legal provisions, taking into account the necessity and purpose of further processing.

6. Recipients of Personal Data

Access to CCTV recordings is restricted to persons authorised by the Controller and only to the extent necessary for the performance of their duties.

Personal data obtained through CCTV surveillance may be disclosed to competent authorities and institutions, in particular courts, the Police and other authorities conducting proceedings under applicable law.

Authorised service providers carrying out maintenance on the Medical Centre's premises may also be given access to recordings where necessary for the provision of those services and where an appropriate legal basis exists.

7. Transfers Outside the European Economic Area

The Controller does not transfer personal data obtained through CCTV surveillance outside the European Economic Area (EEA) or to international organisations.

Recordings are stored locally, and no external remote access to the CCTV system is provided.

8. Rights of Data Subjects

Individuals whose personal data are processed through CCTV surveillance have the following rights, where and to the extent applicable under the GDPR:

• the right of access to personal data;
• the right to obtain a copy of personal data, taking into account the rights and freedoms of others;
• the right to request erasure of personal data;
• the right to request restriction of processing;
• the right to object to processing;
• the right to rectification, insofar as it is applicable to data processed through CCTV surveillance.

The exercise of certain rights may be subject to limitations arising from applicable law and the need to protect the rights and freedoms of other individuals captured in recordings.

Requests concerning the exercise of these rights may be submitted to the Controller, in particular by email to iod@tartaczna2.pl.

9. Right to Lodge a Complaint

If you believe that the processing of your personal data through CCTV surveillance infringes the GDPR, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), the Polish supervisory authority.

Information about the supervisory authority is available at www.uodo.gov.pl.

10. Method of Personal Data Collection

Personal data are collected automatically in the form of images when individuals enter monitored areas. Individuals are not required to actively provide personal data.

Entering a monitored area does not constitute consent to the processing of personal data.

11. Automated Decision-Making and Profiling

The Controller does not use data obtained through CCTV surveillance for decisions based solely on automated processing, including profiling, which would produce legal effects concerning individuals or similarly significantly affect them within the meaning of Article 22 GDPR.