The company “Designer Outlet Athens S.M. Ltd.” (hereinafter the “Company”), with its registered offices at Greece (Block E71/Location “Gyalos”, Postal Code: 19004 Spata, Athens) is the Data Controller of your personal data, pursuant to EU General Data Protection Regulation 679/2016 (hereinafter “GDPR”) and Greek Law 4624/2019. This Privacy Notice is provided in order to inform you on the image and video data collected via CCTV monitoring at the shopping mall and the Company’s offices.

Personal data we process

The Company collects image and video data of visitors and employees of the shopping mall or/and our Company’s offices via the CCTV Monitoring System.

Purposes and legal basis of processing

The Company uses the CCTV Monitoring System for the protection of people and assets in the shopping mall and the Company’s offices. The processing is necessary in the context of the legitimate interest of the Company that acts as a Data Controller (article 6(1) (f) GDPR).

Analysis of legitimate interest

The legitimate interest of the Company consists of the necessity of the latter to protect its premises and its assets from illegal acts. Moreover, the Company aims to protect life, physical integrity, health and property of our personnel and third parties that are legally in the monitored area. We only collect image and video data from areas, where there is an increased possibility of committing illegal acts (for example crimes against persons or crimes against property), or acts that may put in danger the security of persons and property. Consequently, we do not monitor areas where your privacy would be excessively violated.

Recipients of your personal data

The CCTV footage is accessible by specifically authorized personnel of the Company that provides security services, as well as third parties, to which your data may be disclosed, for the fulfillment of the aforementioned purposes, such as:

• The security company of the Company.
• Other legal entities of our Group that collaborate with us for the purposes described above.
• Insurance companies/insurance intermediaries.
• Competent judicial and law enforcement authorities, when they submit a request for data within the context of the exercise of their duties or when the footage provides evidence that is necessary for the investigation of an illegal action.
• The victim or the perpetrator of a crime when data may constitute evidence of its commitment.
• Companies that operate as Data Protection Officer.

How does the Company protect your personal data

Our Company has implemented all appropriate organizational and technical measures, pursuant to applicable legal framework and standards in order to safeguard that processing of data, either by the Company or by any third party is legitimate, appropriate and secured against any non-authorized or illegal access, deletion, amendment or any other use of the data.

How long is your personal data retained

The CCTV footage is retained for fifteen (15) days. Upon the expiration of this period, the data is automatically deleted. In case we realize that an incident has occurred within this period, we shall proceed with the separate storage of this part of the video and it will be stored for one (1) month, in order for the Company to further investigate the incident and the initiation of any legal actions to ensure the legitimate interests of the Company. In case the incident refers to third persons, the footage will be retained for three (3) additional months.

Your rights

According to applicable legislation, you have the following rights:

• Right of access: you have the right to be informed about the processing of your data and if this is the case to receive a copy of your data.
• Right to restriction of the processing of your personal data: you have the right to request the restriction of processing. For example, you have the right to request from the Company not to delete data that you consider necessary for the establishment, exercise or defense of legal claims.
• Right to object: you have the right to object to the processing of your data.
• Right to erasure: you have the right to request the deletion of your data.

You may exercise the aforementioned rights by submitting a request to our Company and we will reply within one (1) month upon receipt of the request. This deadline might be extended for two (2) additional months, in case your requests are excessive or complicated.

Contact point for any issues/for exercising my rights

For any queries, clarifications of requests with regards to your personal data protection, you may contact via email: personaldata@lamdadev.com

Complaint with the Hellenic Data Protection Authority

In case you deem that we have not duly satisfied your request and the protection of your personal data is somehow affected, you may lodge a complaint through the dedicated online portal of the Hellenic Data Protection Authority (Athens, 1-3 Kifissias Avenue, 11523 Athens, Greece | +30 210 6475600). You may find detailed guidelines on how to lodge a complaint on the DPA’s website.

Information on CCTV System

The Company has installed cameras that do not record sound at crucial places of its premises, where serious incidents may occur, such as thefts, accidents and other incidents that may put the health of visitors and employees of the Company and the safety of the latter’s premises at risk.