Video Surveillance Policy

Information on the processing of personal data through a video-surveillance system

1. Controller

KENTAO IKE Street L.ALIMOU 76, Postal Code 16452, ARGYROUPOLI, Tel. 2108946154.

2. Purpose of processing and legal basis

We use a surveillance system for the purpose of protectng individuals and property. The processing
is necessary for the purposes of the legitmate interests pursued by us as the data controller (Artcle
6(1)(f) GDPR).

3. Assessment of legitmate interests

Our legitmate interest consists in the need to protect our premises and the assets located therein
from unlawful acts, such as theft. The same applies to ensuring the safety of life, physical integrity,
health and property of our staff and of third partes lawfully present within the monitored area. We
collect only image data and restrict recording to areas we have assessed as having an increased
likelihood of unlawful acts (e.g. theft), such as our cash register, the entrance and exit of the
premises, or the production area where valuable machinery is located. We avoid monitoring spaces
where the private life of individuals whose images are captured could be excessively restricted,
including their right to the protection of personal data.

4. Recipients

The recorded material is accessible only to our authorised personnel with a legitmate interest and
responsible for the security of the premises – on a strict need-to-know basis. This material is not
disclosed to third parties except in the following cases:
a) to the competent judicial, prosecutorial and police authorities when it contains information
necessary for investigating a criminal offence affectng persons or property of the controller;
b) to the competent judicial, prosecutorial and police authorities when they lawfully request data in
the exercise of their duties; and
c) to the victim of a criminal offence, when the data may serve as evidence of the
offence.

5. Retention period

We retain the data for 15 days, after which it is automatically deleted. If an incident is detected
within this period, we isolate the relevant video segment and retain it for up to one (1) additional
month for the purpose of investigating the incident and initiating legal proceedings to protect our
legitmate interests. If the incident concerns a third party, we will retain the video for up to three (3)
additional months.

6. Rights of data subjects

Data subjects have the following rights:
• Right of access: you have the right to know whether we process your image and, if so, to
obtain a copy of it.
• Right to restriction: you have the right to request that we restrict processing, for example by
preventing deletion of data you consider necessary for establishing, exercising, or defending
legal claims.
• Right to object: you have the right to object to the processing.
• Right to erasure: you have the right to request the erasure of your data.
You may exercise your rights by sending an email to INFO@KENTAO.GR or by sending a leter to our
postal address, or by submittng your request in person at the company’s premises. To review a
request relating to your image, you must specify when you were approximately within camera range
and provide us with a photograph of yourself to assist in locating your data and masking the data of
other recorded individuals. Alternatively, you may visit our premises so that we can show you the
images in which you appear.
Please note that exercising the right to object or the right to erasure does not automatically result in
the immediate deletion of data or modification of processing. In all cases, we will respond to you in
detail as soon as possible and within the deadlines established by the GDPR.

7. Right to lodge a complaint

If you believe that the processing of your personal data infringes Regulation (EU) 2016/679, you
have the right to lodge a complaint with a supervisory authority.
The competent supervisory authority in Greece is the Hellenic Data Protection Authority,
1–3, Kifisias Ave., 115 23 Athens, htps://www.dpa.gr/
Tel. +30 210 6475600.