CCTV policy

1 GENERAL CONDITIONS
2 WHAT CONSTITUTES PERSONAL DATA
3 WHOSE PERSONAL DATA WE PROCESS
4 SOURCES OF PERSONAL DATA
5 WHAT PERSONAL DATA WE PROCESS
6 REASON AND PURPOSE OF PERSONAL DATA PROCESSING
7 CCTV SYSTEM
8 DURATION OF PERSONAL DATA PROCESSING
9 PROTECTION OF PERSONAL DATA
10 SHARING AND TRANSFER OF PERSONAL DATA
11 YOUR RIGHTS
12 FINAL PROVISIONS

1 GENERAL CONDITIONS

This CCTV policy (hereinafter referred to as the “Policy“) establish the fundamental guidelines under which entrepreneur Peter Sova, ID: 02718618, with a registered office at Náměstí Junkových 2870/3, 155 00 Prague 5 – Stodůlky (hereinafter referred to as the “Administrator“), acting as the operator of the private studio INHALEUM (hereinafter referred to as the “Studio”), processes personal data of individuals captured by the CCTV system and how such personal data is handled and protected.

This Policy also informs you about your rights concerning the processing of personal data and how you can exercise them. Therefore we recommend that you carefully review this Policy.

For inquiries regarding the processing of personal data, you can contact the designated data protection officer at info@inhaleum.cz.

The Administrator bears responsibility for ensuring that your personal data is processed in accordance with this Policy and the relevant legal regulations.

2 WHAT CONSTITUTES PERSONAL DATA

Personal data (hereinafter referred to as “Personal data“) encompasses any information relating to an identified or identifiable natural person (hereinafter referred to as the “Data subject“); an identifiable natural person is a natural person who can be directly or indirectly identified, in particular by reference to a specific identifier, such as a name, time of studio visit, location data, network identifier, or one or more special elements of the physical, physiological, genetic, mental, economic, cultural, or social identity of this natural person.

3 WHOSE PERSONAL DATA WE PROCESS

In connection with the operation of the CCTV system, the Administrator processes personal data:

customers, i.e., individuals entering the areas of the Studio monitored by the CCTV system;
potential customers, i.e., individuals considering entry into the areas of the Studio monitored by the CCTV system;
the operator of the studio and employees;
any individuals moving in the vicinity of the installed cameras for any reason.

4 SOURCES OF PERSONAL DATA

The Administrator processes Personal data obtained in connection with the operation of CCTV system, which means information that can be ascertained about the Data subject from camera recordings.

5 WHAT PERSONAL DATA WE PROCESS

The Administrator processes the following Personal data using the CCTV system: appearance, gender, approximate age, movement, presence, actions, and behavior of the Data subject at the recorded location at a specific time.

6 REASON AND PURPOSE OF PERSONAL DATA PROCESSING

Given the self-service nature of the Studio, Personal data obtained through the CCTV recording system is processed for the legitimate interests of the Administrator for the following purposes:

protection of the life, health, and property of Data Subjects;
protection of the Administrator’s property from damage, destruction, loss, theft, or misuse (i.e., prevention of vandalism and other undesirable acts and events);
gathering evidence for potential legal and other proceedings.

7 CCTV SYSTEM

The Administrator uses two cameras to monitor both the external and internal areas of the Studio. The CCTV system operates continuously, with all cameras recording continuous, color footage.

The CCTV system in the Studio is designed to respect the dignity and freedom of movement of individuals within the Studio. Cameras do not capture areas where there could be an undue intrusion into the private and personal lives of data subjects (e.g., restroom facilities and the salt room).

The Studio layout, including the exact locations of specific cameras, can be found here. Data subjects are informed about the camera system through informational pictograms that alert to the presence of cameras.

8 DURATION OF PERSONAL DATA PROCESSING

Personal data contained in camera recordings are stored electronically on recording equipment for a period of 72 hours. This duration is necessary for us to investigate any potential incidents and to secure additional information if needed for the purpose of providing records to, for example, law enforcement or an insurance company, when it is necessary to protect our legitimate interests and in compliance with the conditions for disclosure as per established practice. After this period, these recordings are automatically erased by overwriting and cannot be recovered.

Certain parts of the recordings (including personal data contained within them) are selectively retained for an extended period for the purpose of determining, executing, or defending legal claims or for other legitimate interests.

9 PROTECTION OF PERSONAL DATA

The Administrator always handles personal data in a manner that respects the dignity of the Data subject and does not infringe upon their right to privacy and personal life protection. To achieve this, the Administrator has implemented and maintains appropriate technical and organizational measures for internal control and information security processes to safeguard your personal data against accidental loss, destruction, alteration, unauthorized disclosure, or access. These measures may include, among others, implementing suitable measures to ensure the accountability of relevant employees with access to your data, employee training, regular backups, data recovery procedures, incident management, software protection for devices where personal data is stored, and more.

The Administrator may share CCTV system recordings with certain third parties (referred to as “recipients of personal data”) only in the event of an incident for which Personal data is collected (e.g. damage to the Administrator’s property, unauthorized entry into the Administrator’s premises, etc.). For this purpose, the Administrator may disclose the Personal data captured by the CCTV system to third parties responsible for its security or authorized to protect its legal interests, as well as with certain public authorities. These individuals are thus in the position of Personal data processors or other data controllers.

The Administrator may share personal data, in particular, with:

external legal representatives for the protection of the Administrator’s legitimate interests;
law enforcement authorities, courts, or administrative authorities for the purposes of criminal or administrative proceedings.

The Administrator has entered into a Data Processing Agreement with personal data processors as mentioned above (except in cases where such an agreement is not mandatory, for example, when providing personal data to administrative authorities), which guarantees at least the same level of protection as this Policy.

11 YOUR RIGHTS

The data subject has the following rights::

ACCESS TO PERSONAL DATA

You have the right to request information about whether the Administrator processes your Personal data and to what extent. You also have the right to request the Administrator to provide you with access to the Personal data you have provided and other Personal data related to your person. Given the nature of the processing, the Administrator can provide you with this information only if you provide information that enables the Administrator to identify you in the camera recordings. Otherwise, the Administrator will not be able to provide you with this information. Additionally, the Administrator reserves the right to reject your access request as clearly unfounded or disproportionate and may request a reasonable fee considering the costs associated with providing the requested information.

A copy of your data from the CCTV system will be provided by the Administrator only in cases where the rights and freedoms of third parties are not adversely affected, and we are able to identify the part of the CCTV recording containing your Personal data based on the information you provide. The rights of third parties will be adversely affected, particularly in cases where the requested portion of the CCTV recording also contains the Personal data of these third parties.

LIMITATION OF PROCESSING

If you request the Administrator to limit the processing of your Personal data, for example, when you dispute the accuracy, lawfulness, or the necessity for the Administrator to process your Personal data, the Administrator will restrict the processing of your Personal data to the necessary minimum (storage) and may only process them for the purpose of determining, executing, or defending legal claims, or for the protection of the rights of another natural or legal person, or other limited reasons prescribed by applicable laws. If the restriction is lifted and the Administrator continues processing your Personal data, you will be promptly informed of this.

The Administrator notes that the applicability of the right to limit processing is limited in connection with camera recordings, especially due to their short-term processing.

RIGHT TO OBJECT AND RIGHT TO ERASURE

You have the right to object at any time to the processing of Personal data processed based on the legitimate interests of the Administrator. In such a case, if the Administrator does not demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if the Administrator does not prove that these data are necessary for the establishment, exercise, or defense of the legal claims of the Administrator, these data will no longer be processed, and will be promptly erased.

COMPLAINT TO THE OFFICE FOR PERSONAL DATA PROTECTION

You have the right to file a request or complaint concerning the processing of your Personal data by the Administrator to the Office for the Protection of Personal Data, located at Plk. Sochora 727/27, 170 00 Prague 7 – Holešovice (for more information, visit https://www.uoou.cz/).

To exercise any of these rights, you can send your requests and inquiries to info@inhaleum.cz. The Administrator will promptly acknowledge receipt of each application as per the points mentioned above and provide the necessary information or details about the measures taken, typically within one month. This period may be extended by an additional two months if necessary, taking into account the complexity and the number of requests.

12 FINAL PROVISIONS

The Administrator acknowledges that changes to this Policy may occur due to technological advancements, amendments to relevant laws, or the introduction of new products and applications by the Administrator. Therefore, the Administrator reserves the right to modify the content of this Policy at any time and without prior notice. All modifications take effect immediately upon the publication of the updated CCTV policy on the Administrator’s website.

If you have any inquiries regarding our CCTV Policy, please do not hesitate to contact us at info@inhaleum.cz.

This Privacy Policy is in effect as of March 1, 2024.