1. Data Controller:
The Company under the trade name “Public Power Corporation Societe Anonyme” and the distinctive title “PPC S.A.”, having its registered seat in Athens, 30 Chalkokondyli St., GR-10432, as well as the subsidiaries of the PPC Group (hereinafter referred to as the “Subsidiaries”) in their capacity as independent Data Controller, hereby inform, in accordance with Regulation (EU) 2016/679 (hereinafter “GDPR”) and the relevant provisions of Greek legislation on the protection of personal data, as currently in force, about the type of personal data they collect, the source of their collection, the reason behind their collection and processing, any recipients thereof, their retention period, any transfer outside the E.U., as well as your rights in relation to your data and how you can exercise them, when using video surveillance systems (CCTV) on their premises.
2. Scope and Group Subsidiaries
This notice applies uniformly to all building facilities, headquarters, customer service stores, data centres, technical infrastructure, warehouses, and surrounding areas owned or managed by PPC or the following Subsidiaries:
Each Group company acts as an independent Data Controller for the premises it manages.
3. Purpose of processing and legal basis:
We use video surveillance systems for the purpose of protecting persons (employees, visitors, customers, partners), premises and goods, as well as critical infrastructure and communication systems (Control Rooms, Data Centres, Server Rooms, telecom nodes).
The processing is necessary for the purposes of legitimate interests we pursue as a Data Controller [GDPR, Article 6, paragraph 1(f)]. Our legitimate interest consists of the need to protect the premises and goods located therein from unlawful acts, such as theft. The same applies to the safety of life, physical integrity, health and property of our personnel and third parties located within the monitored area.
Furthermore, video surveillance systems operate in premises for the purpose of compliance with legal obligations of PPC and its subsidiaries [Article 6, paragraph 1(c) of the GDPR], such as the protection of areas where systems requiring enhanced protection are installed in accordance with the current regulatory framework, and in particular the provisions on network and information security (NIS), the Regulation for the Assurance of Privacy of Electronic Communications [Hellenic Authority for Communication Security and Privacy (ADAE)], as well as Article 32 of the GDPR.
The recording is limited to areas that we have assessed as having an increased likelihood of committing unlawful acts, e.g. theft, such as entry/exit points, stores, power plant facilities, parking lots, system installation areas, without focusing on areas where the privacy of the persons whose image is captured may be excessively restricted, including their right to the protection of their personal data.
4. Data type and data subject categories
We collect image data of our employees and third parties, customers, visitors and partners, who are in the monitored area, as well as recording metadata, such as the date, precise time, and the code/location of the capturing camera.
5. Recipients
The stored surveillance material is accessible only by the competent/authorised personnel responsible for the security of the premises of PPC and its subsidiaries, and authorised partners who provide technical support services for the video surveillance systems.
Access to video surveillance material, in real time, is provided to security personnel as well as to Store Managers and Power Plant Managers, to the extent necessary for the fulfilment of their duties.
This material is not transmitted to third parties, except in the following cases: a) to the competent judicial, prosecutorial and police authorities when it includes information necessary for the investigation of a criminal offence, which concerns persons or goods of the data controller, b) to the competent judicial, prosecutorial and police authorities when they lawfully request data in the exercise of their duties, and c) to the victim or perpetrator of a criminal offence, when it concerns data that may constitute evidence of the act.
6. Data retention period
We retain the data for a period of fifteen (15) days, after which it is automatically deleted.
The retention period may be extended in the event of an incident where the material may be used as evidence, or if a corresponding right is exercised by a data subject.
7. Technical and organisational security measures
PPC and its subsidiaries implement technical and organisational security measures to ensure the integrity and confidentiality of personal data. They deploy security technologies to protect them from unauthorised access, inappropriate use, alteration, unlawful or accidental destruction, and accidental loss, and continue to strengthen their security procedures, including, among others and as applicable:
Additionally, for the CCTV systems, the following measures are implemented:
8. Rights of data subject and how to exercise them
Data subjects have the following rights:
You can exercise your rights by sending an e-mail to dpo.office@dei.gr or a letter to our postal address or by submitting the request to us in person at our company address [30 Chalkokondyli, 10432 Athens]. Please note that in case there are reasonable doubts about the identity of the data subject, we may request additional information to confirm the identity.
In order to evaluate a request related to your image, you will need to specify to us approximately when you were within the range of the cameras and provide us with an image of you, in order to facilitate our identification of your data and the concealment of the data of third parties depicted. Alternatively, we give you the opportunity to come to our premises to show you the images in which you appear. We also point out that exercising the right to object or delete does not imply the immediate deletion of data or modification of the processing. In any case, we will respond to you in detail as soon as possible, within the deadlines set by the GDPR.
Our website has detected that you are using an outdated browser that will prevent you from accessing certain features.
In order to improve your browsing experience we strongly recommend you use the links below to update to one of the following modern browsers.
