1. Data Controller:

Data Controller is «REVIVAL CONSULTING SERVICES S.A.», 161, Lenorman & 2, Viantos Str., 104 42 Athens, Greece, Attica, tel. +30 210-5156800.

2. Purpose of processing and legal basis:

We use a surveillance system for the purpose of protecting persons and goods. The processing is necessary for purposes of legal interests that we seek as a Data Controller (Art. 6 par. 1 f GDPR).

3. Analysis of legal interests:

Our legal interest is the need to protect our space and the goods located in it form illegal acts, such as theft. The same applies to the safety of life, physical integrity, health as well as the property of our staff and third parties who are legally in the supervised area. We only collect image data and limit the capture to places where we have assessed that there is an increased possibility of committing illegal acts e.g. theft, such as in our cash registers and at the entrance, without focusing on places where the privacy of the persons being photographed may be severely restricted, including their right of respect of their personal data.

4. Recipients

The kept material is accessible only by our competent/authorized personnel who are in charge of the security of the space. This material shall not be transferred to third parties, except the following cases: a) to the competent judicial, prosecutorial and police authorities when it contains necessary information for the investigation of a criminal offense involving persons or goods of the Data Controller, b) to the competent judicial, prosecutorial and police authorities when requesting data, lawfully, in the performance of their duties, and (c) to the victim or perpetrator of a crime, when it comes to data which may constitute evidence of the act.

5. Retention time

We keep data for fourteen (14) days, after which they are automatically deleted. In case we find an incident during this period, we isolate part of the video and keep it for another one (1) month, in order to investigate the incident and initiate legal proceedings to defend our legal interests, while if the incident concerns a third part, we will keep the video for up to three (3) more months.

6. Rights of data subjects

Data subjects have the following rights:

• Right of access: you have the right to know if we process your image and, if we do so, to receive a copy.
• Right to restrict: you have the right to ask us to restrict processing, such as not deleting data that you deem necessary to establish, exercise or support legal claims.
• Right to object: you have the right to object to the processing.
• Right to delete: you have the right to request that we delete your data.

You can exercise your rights by sending an e-mail to the Data Protection Officer at gdpr@revivalsa.gr or a letter to our postal address or by submitting the request to us in person, to the secretariat of the General Directorate of our clinics. To consider a request related to your image, you should tell us approximately when you were within range of the cameras and give us an image of you to help us locate your data and hide the data of third-parties images. Alternatively, we give you the opportunity to come to our facilities to show you the images in which you appear. We also note that exercising the right of objection or deletion does not imply the immediate deletion of data or the modification of the processing. In any case, we will answer you in detail as soon as possible, within the deadlines set by the GDPR.

7. The right to lodge a complaint

In case you consider that the processing of the data concerning you violates Regulation (EU) 2016/679, you have the right to lodge a complaint to a supervisory authority.
Competent supervisory authority for Greece is the Data Protection Authority, Kifissias 1-3 str., 115 23, Athens, https://www.dpa.gr/, tel. 2106475600.