CCTV policy of the D. Trading d.o.o.

Data protection is of a particularly high priority for the management of D. Trading d.o.o. This CCTV Policy describes the Closed-circuit television system (hereafter - CCTV system) that operates in our office and explains the safeguards we have put in place to protect the personal data of any individuals who may be captured by our CCTV cameras.

Who we are
We are D. Trading d.o.o. (OIB 76011767004) - an energy trading company that trades electricity, gas, petroleum, and other energy commodities in Southeastern Europe. As far as we operate the CCTV system and process data from CCTV – we are also a Data controller.
You may find our contact information in How you may contact us.

Why do we use CCTV
Our company locates in Zagreb, ulica Roberta Frangeša - Mihanovića 9, 16 floor (hereafter - Office). It’s our head office, where we make decisions and deals, arrange meetings with our partners and counterparties.
We want to make our Office safe for our guests and staff, protect property of D.Trading d.o.o.
The CCTV System is not the single safety measure - it is used as a complement to other security measures implemented to safeguard the security of Office, networks and systems and the safety of our visitors and personnel. The CCTV system enhances other access control within our premises.
We process data by the CCTV system for purposes of the legitimate interests - of the security of our property, providing and managing a safe environment for our visitors and personnel, including without limitation:

- protection of visitors and our personnel;

- protection of D. Trading d.o.o. property.

We confirm that our CCTV system is not used for purposes other than those described above.

What data do we process with the CCTV system
We record footage of movement detected in the area under surveillance. The images and/or footage produced by our equipment will as far as possible be of a quality that is effective for the purpose for which they are intended. So, our CCTV cameras operate even in absolute darkness and even without electricity. At the same time, our CCTV system can’t:

- records your voice or any sounds;

- recognizes you automatically;

- zooms in on or otherwise follows you.

How do we process with data with the CCTV system?
We inform all our personnel and visitors of Office about CCTV surveillance operations due to notices. Notices installed near all entrances to Office before you enter the monitored area. All notices are made in Croatian and English. We expect that all visitors and personnel entering in Office are informed about their data processing within the CCTV system.
Our CCTV system includes 14 stationary and 2 portable cameras that are installed in Office. 14 stationary cameras operate full-time (24 hours a day, 7 days a week) and 2 portable cameras, installed in CEO’s meeting room, operates only when CEO is out of the Office. All CCTV equipment is maintained regularly.
Our CCTV system provides coverage over the following areas in our office:

- entrances to the office;

- exits from the office, including emergency exits;

- entrances to technical rooms;

- technical room;

- printing and shredding areas;

- CEO’s meeting room (operates only when CEO is out of the Office, switches-off manually when CEO is in the Office);

- corridors.

Our CCTV cameras don’t intrude on the privacy of individuals. Our CCTV systems do not infringe on restricted areas (i.e. toilets/restrooms and other similar places).
Access to the images recorded by our CCTV System is restricted and carefully controlled. The security of the IT systems containing the CCTV footage is safeguarded through technical, organizational, and physical means.
Footage recorded by our CCTV cameras is encrypted and otherwise stored in a secure manner to protect their confidentiality, integrity and availability.
The CCTV monitoring and storing equipment is kept in a segregated, secure area to which only authorized professionals with security clearance are granted access.
Security protocols have been put in place to ensure that only authorized professionals are allowed to monitor and otherwise process CCTV footage.
Footage captured and recorded by the Controller is accessible only to professionals and the Data Protection Officer (only in case of DSAR response preparation), authorized by Controller.
Right to access to CCTV system granted only to qualified professionals which is under binding/contractual confidentiality commitments.
All records must be clearly identified (tagged) by date, time and location, including a unique way of marking each camera.
We also use an automatic system of event records (logs) to record access to video surveillance footage, which contains the time and place of access, and the information about the person who accessed the data.
All footages are the property of D. Trading d.o.o. and they are trade secrets.
We do not transfer personal data to a country outside the European Economic Area, which ensures the protection of your personal data by the GDPR. If we will do this – we will inform you and use all remedies, needed for safety transfer.

How long do we process data
CCTV recordings are generally maintained for fifty (50) calendar days and are thereafter overwritten making recovery impossible, except that they may be kept for a longer duration in certain instances including:

- where there is a legal basis;

- where we are legally required to do so, or

- where the footage otherwise has investigative value (such as where a security incident occurs) and the recordings are stored as necessary for the duration of the investigation, the prosecution of the incident or the exercise, enforcement or defense of any legal claims.

The foregoing list is not exhaustive and there may be other circumstances where the CCTV is retained for longer than fifty (50) calendar days as is justified under the circumstances.
Where an incident or suspected incident has been identified, the pertinent portion of the CCTV footage is to be retained for that incident.

Your privacy rights

You have privacy rights. If you would like to exercise them or learn more - please contact us! You can find our contact detail at the end of this policy. Please note that some of the rights may not be applicable to your situation.

Right of access
You have the right to know what personal information we process and why. That’s why we inform you in advance about our processing activities via notices of CCTV operations installed near all entrances before you enter in the monitored area and this policy. If you have any questions, or would you like to learn more about what information we process from you, you are always welcome to contact us and we will provide you with further information.

Right to erasure / right to be forgotten
You have the right to tell us to permanently erase your personal data from our records. You can do this for example if you believe there’s no longer any need for us to keep it.

Right to data portability
In certain situations, you have the right to ask us to send your personal information in digital form to you so that you can forward it to someone else.

Right to object
You have the right to object to the processing of your information, even when we have a legitimate legal reason to process it. You can do this when we process your information on the basis of our legitimate interest, and you believe that your personal interest outweighs ours. If you do not want us to use your information for direct marketing purposes, including profiling, we will comply in any case.

Right to restriction of processing
In some situations, you have the right to obtain from the controller restriction of processing your data.

Right to lodge a complaint with a supervisory authority
If you aren’t satisfied with the way we treat your personal data, you have the right to lodge a complaint about us to the Croatian national supervisory authority - Agencija za zaštitu osobnih podataka, Selska cesta 136, HR-10 000 Zagreb. E-mail: azop@azop.hr Tel. 00385 (0)1 4609-000, Fax. 00385 (0)1 4609-099, https://www.azop.hr

How do we disclose or transfer data

Access granted to CCTV footage is tiered: either by viewing or providing a copy, the latter option is allowed only when proportional to the purpose of the request. At all times, the footage to be disclosed, either by viewing or providing a copy, are only those that are necessary and not excessive to the purpose for which they are being disclosed.

CCTV footage may be disclosed in the following instances:

- Law enforcement and criminal investigations. On requests for CCTV footage to be disclosed in relation to a criminal investigation, the Company shall require the law enforcement officer or the requesting party to provide sufficient proof as to the occurrence of a crime and the investigation thereof as well as proof of authority of the law enforcement officer before release of the CCTV footage.

- Court Order. Requests for disclosure and use of CCTV footage and images by virtue of a lawful order of a court of the competent authority are allowed, taking into consideration the pertinent rules on the issuance of the subpoena.

- Administrative investigations. Use of CCTV footage for purposes of an administrative investigation may be allowed. The requesting party must provide sufficient proof of the investigation being conducted or the pending complaint before an administrative body.

- Data subject access request. You are, as a data subject, may request access to your personal data, processed by our CCTV system.

What is the procedure for Data Subject Access Requests

You may request access to your personal data, processed by our CCTV system. If you decide to do this, please, send us a letter to szop@d.trading or to 10 000, Zagreb, ulica Roberta Frangeša - Mihanovića 9, D. Trading d.o.o. “for Data protection officer”.

In this letter, please, provide us with further information:

-  your name and surname

-­ your E-mail

­- details to identify the section of footage with which they are concerned and to enable the Company to determine that the person making the request is the data subject of that specific recording (area, date and time of footage)

We respect your privacy and need to make sure, that the request was sent by a person, who has a right to access. For identification and verification, we may send you an E-mail and ask you for additional information - please, check your E-mail folders (i.e., Inbox, SPAM).
We won’t process with this additional information except for the purpose of identification.
Please note, if you don’t provide us with such additional information – we can’t verify and identify you thus such an access request may leave without an answer.
Upon receipt of the written request, it is referred to the Data Protection Officer who will determine whether disclosure is appropriate.
Our response in allowing access to CCTV footage will consider ease of access to the footage and the need to protect other people’s privacy.
Please, keep in mind that in some cases we may charge a reasonable fee for providing a copy of the CCTV footage to cover administrative costs.

How we review our CCTV policy

D.Trading d.o.o. undertakes yearly periodic reviews of the CCTV System and the associated internal policies, procedures, protocols and processes. These reviews will be used to assess the continued need for the CCTV System, as well as the adequacy, necessity and proportionality of the CCTV System.

How you may contact us

For getting additional information about CCTV system or this CCTV policy, or in cases of realization of your rights, you may contact us in a suitable way for you:

- D.Trading d.o.o., 10 000, Zagreb, ulica Roberta Frangeša - Mihanovića 9, or

- our Data protection officer’s address: 10 000, Zagreb, ulica Roberta Frangeša - Mihanovića 9, D. Trading d.o.o. for Data protection officer, or

- our Data protection officer: E-mail: szop@d.trading