CCTV and Access Control

Please be informed that your personal data will be processed by EDP, S.A., SUCURSAL EN ESPAÑA (hereinafter, the “Data Controller”), Tax Identification Number (NIF) W0104919F, with registered office at Centro Empresarial Parque de Adequa, Avenida de Burgos 89, Building 1, Modules A-B, Madrid, Spain.

Video surveillance

Access control to facilities

As a general rule, personal data will be collected directly from the data subjects. For facility access control purposes, personal data may be collected directly from the data subject prior to entering the premises. In the case of visitors, personal data may also be collected at the building reception or, where the individual accesses the premises by vehicle, through electronic vehicle identification systems. In the case of employees of Partner Companies, personal data may be collected either directly from the data subject or through their employer (the Partner Company), which will provide such data to EDP

Personal data will be processed by the Data Controller for CCTV and facility access control purposes in order to ensure the safety and security of individuals, assets and facilities, as well as to monitor and control access to, and activities carried out within, premises owned by the Data Controller. These measures are implemented to prevent security incidents, protect the organisation’s assets and ensure the proper operation of its facilities.

The lawful basis applicable to each processing activity is as follows:

• CCTV: Public interest, pursuant to Article 6.1.e GDPR, as the processing is aimed at ensuring the safety and security of facilities and individuals present within them.
• Facility Access Control: Legitimate interests of the Data Controller, pursuant to Article 6.1.f GDPR, consisting of ensuring access control to facilities and the protection of individuals, assets and premises, where such processing is necessary for operational security and the proper management of access.

Additionally, for employees of Partner Companies, the lawful bases applicable to processing activities are as follows:

• Management of the services relationship and access control: Performance of a contract, pursuant to Article 6.1.b GDPR, where processing is necessary to ensure the proper management, performance, monitoring and control of the agreed services relationship, as well as to allow external personnel access to EDP’s high-security facilities.
• Coordination of occupational risk prevention activities: Compliance with a legal obligation, pursuant to Article 6.1.c GDPR, arising from applicable legislation governing the coordination of business activities.

Personal data will not be disclosed to third parties except in the following circumstances:

• Professional service providers engaged by the Data Controller, acting as data processors and processing personal data solely for authorised purposes and in compliance with applicable data protection legislation.
• Law enforcement authorities, courts or tribunals where necessary to report conduct that may constitute an unlawful act or to respond to official requests.
• Data subjects and/or affected parties who demonstrate sufficient legal grounds to request access to personal data.
• Competent authorities and public bodies where disclosure is required by law.
• In the case of employees of Partner Companies, third parties involved in the management of the contracted activities, including the employing company, where necessary to ensure the proper management, performance, monitoring and control of the agreed services relationship and to comply with legal obligations relating to the coordination of business activities.

• CCTV: Personal data will be retained for a maximum period of one month from the date of collection, unless longer retention is required for the investigation of a suspected infringement or unlawful act, or to comply with any legal obligations arising therefrom.
• Facility Access Control: Personal data will be retained for one month following the date of the visit, unless processing is required to comply with a legal obligation or for the establishment, exercise or defence of legal claims. In such cases, data may be retained for the applicable statutory limitation periods and will subsequently be deleted.

Information relating to access control for security purposes, evidence of contractual compliance and occupational risk prevention activities involving employees of Partner Companies will be retained for 5 years.

As a data subject, you may contact the Data Controller at any time and free of charge, providing proof of identity, in order to exercise the following rights:

• Right of Access: You have the right to obtain confirmation as to whether the Data Controller is processing your personal data and, where that is the case, to access those data and receive information regarding the purposes of the processing, the categories of personal data concerned, the recipients of the data and the envisaged retention period, among other information.
• Right to Rectification: You may request, without undue delay, the correction of inaccurate personal data concerning you and the completion of incomplete personal data.
• Right to Object: You have the right to object to the processing of your personal data in certain circumstances and on grounds relating to your particular situation, particularly where the processing is based on the legitimate interests of the Data Controller. In such cases, the Data Controller will cease processing the data unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the data subject, or where processing is necessary for the establishment, exercise or defence of legal claims.
• Right to Data Portability: You have the right to receive the personal data you have provided to the Data Controller in a structured, commonly used and machine-readable format and to transmit those data to another controller where legally applicable.
• Right to Restriction of Processing: In certain circumstances, such as where you contest the accuracy of your personal data, you may request the restriction of processing while verification is carried out. In such cases, the data may only be processed for the establishment, exercise or defence of legal claims.
• Right to Erasure: You have the right to request the deletion of your personal data where the applicable legal requirements are met, including where the data are no longer necessary for the purposes for which they were collected.

EDP, S.A., SUCURSAL EN ESPAÑA provides the following channels for exercising your rights:

• By post: Privacy and Data Protection, Plaza del Fresno, 2, 33007 Oviedo (Asturias), Spain.
• Online form: Data Subject Rights Request Form.

In any event, if you have any questions regarding the exercise of your rights or, more generally, the processing of your personal data, you may contact our Data Protection Officer (DPO) through the designated contact form.

Furthermore, if you believe that any of your data protection rights have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD).