Skip to main content

Notice on the processing of personal data through the video-surveillance system

  1. Data controller

The Stavros S. Niarchos Foundation for Charity (also known as the Stavros Niarchos Foundation or SNF) is incorporated in Bermuda and has offices in New York, Monaco, and Athens. Data Controller is the Greek SNF office, located in Athens, at 86A Vasilissis Sofias Ave., PO Box 115 28, tel. +30 2108778300 (“Data Controller”). SNF owns the property located in Athens, at 2 Lampsakou Street, PO Box 115 28, spaces of which it has leased to its related non-profit journalistic organization iMEdD (incubator for Media Education and Development) (hereinafter “iMEdD”).

  1. Purpose and legal basis for the processing

We use the video-surveillance system in order to protect persons and property. The processing is necessary for the purposes of legitimate interests pursued by us as data controller [article 6 para. 1(f) of the General Data Protection Regulation 679/2016/ΕU (hereinafter the “GDPR”)].

  1. Legitimate interests

Our legitimate interest consists in the need to protect our premises and assets from illegal acts, such as theft. The same applies to the safety of life, physical integrity, health, as well as the property of iMEdD’s staff and third parties who are legally present in the supervised area. We solely collect image data and limit surveillance to places where we have assessed that there is an increased likelihood of committing illegal acts, e.g., theft, such as in the entrance and in the garage, without focusing on places where the privacy of the persons whose image is captured may be disproportionally restricted, including their right to personal data respect.

  1. Recipients

The recorded material is accessible only by our competent/authorized personnel who is in charge of building security. This material is not transmitted to third parties, except for the following cases: a) to the competent judicial, prosecutorial and police authorities when it includes information necessary for the investigation of a criminal act, which concerns persons or property of the data controller, b) to the competent judicial, prosecutorial and police authorities, when they lawfully request data within the scope of their competences, and c) to the victim or the perpetrator of a criminal act, when it comes to data that may constitute evidence of the act.

  1. Retention period

The recorded material is retained for a period of fifteen (15) days and then the data is automatically deleted from the system. In the event of a security-related incident, the relevant recorded material is extracted from the system and retained for up to thirty (30) more days in order to investigate the incident and initiate legal proceedings to defend our legitimate interests, and if the incident involves a criminal act and prosecutions are brought, we will retain the video for up to three (3) more months.

  1. Rights of data subjects

The data subjects have the following rights:

  • Right of access: you have the right to know whether we process your image and, if so, to receive a copy of it.
  • Right to restrict processing: you have the right to request that we restrict processing, such as not to delete data that you consider necessary to establish, exercise or support legal claims.
  • Right to object: you have the right to object to the processing of your data.
  • Right to erasure: you have the right to request the erasure of your data.

You can exercise your rights by sending an e-mail to [email protected] or a letter to our postal address (86A Vasilissis Sofias Avenue, PO Box 115 28) or by submitting the request to us in person. In order for us to consider a request relating to your image, you will need to identify approximately when you were in range of the cameras and provide us with an image of you to help us identify your own data and hide the data of third parties depicted. Alternatively, we give you the option to come to our premises to show you the images in which you appear. We also point out that the exercise of the right to object or erasure does not imply the immediate deletion of data or the modification of processing. In any case, we will answer you in detail as soon as possible, within the deadlines set by the GDPR. 

  1. Right to file a complaint

If you believe that the processing of your data violates GDPR, you have the right to file a complaint with a supervisory authority. The competent supervisory authority for Greece is the Hellenic Data Protection Authority, registered in Athens, at 1-3, Kifisias Avenue, PO Box 115 23, https://www.dpa.gr/, tel. +30 2106475600.

  1. Future changes to the current notice

SNF intends to periodically review this notice to reflect changes in its policies and practices. If we amend this notice, the “Date of Last Update” below will be updated accordingly.

Date of Last Update: 13/11/2023