Policy on the video surveillance system

Global Shared Services S.r.l., with registered office in Milan, 20123, Viale Meravigli 14, with tax code and VAT No. 11073780154 (GSS), in its capacity as data controller, wishes to inform you of the features of the video surveillance system installed at its headquarters and of the processing of the related video footage.

Please read this policy carefully.

If you have any queries regarding the features of the video surveillance system, the staff on duty at the concierge office are available to provide you with any clarification; you can also contact us via dpo.italy@it.ey.com or go to the Legal Department at Via Meravigli no. 14 (20123) Milan.

*****

Data Controller

The data controller is Global Shared Services S.r.l., with registered office in Milan, 20123, at Viale Meravigli 14, with tax code and VAT No. 11073780154.

In certain circumstances, Global Shared Services S.r.l. may act as data processor, in the name and on behalf of the other legal entities of the EY network working in the property. For further information on this aspect, please contact the contact details indicated at the end of this policy.

Data gathered and processed

The video surveillance system cameras are located along the external perimeter of the GSS headquarters: they operate 24 hours a day and can, therefore, film anyone who accesses perimeter areas, areas used for parking or loading/unloading goods, reception, access , exits, emergency exits and, specifically, GSS employees and visitors (including transporters and suppliers and related staff) transiting within the range of the cameras.

The system is installed to detect only the images that are essential for security and the cameras are oriented towards the areas deemed most exposed to the risk of theft and damage (limiting the angle of the filming and avoiding, as far as possible, detailed images). Existing systems and equipment do not include places reserved exclusively for staff.

Cameras are not installed inside the premises, in places reserved exclusively for workers or not intended for work (e.g., bathrooms, changing rooms, showers, lockers and recreational areas): staff are therefore not filmed in the performance of their work activities and video recordings are not and cannot be used for performance check purposes.

The cameras, which are all visible, are indicated by special signs, drawn up according to the indications of the Data Protection Authority and are positioned in such a way as to limit the viewing angle to the area to be protected, avoiding, as far as possible, the filming of surrounding places and details that are not relevant (streets, buildings, shops, institutions, etc.).

The installation of the cameras within the company perimeter was the subject of a company trade union or, if doesn’t signed, prior authorization by the National and/or Regional Labour Directorate for the office involved.

Purpose of the processing and related legal basis

Company security

The video surveillance system was installed for the sole purpose of guaranteeing company security, to prevent vandalism and theft against the company and data subjects who are inside and outside of the company premises, as a deterrent for the carrying out of acts of damage that could occur against the company and data subjects who are inside and outside of the company premises, to facilitate the right of defence in court by GSS, as well as to increase occupational safety (to protect workers and people who frequent the company premises).

The related video recordings, which may contain personal data such as the recognisable image of those who access the GSS premises and the number plates of vehicles entering the accessible areas, as well as staff passing, even accidentally, within the range of action of the cameras, are processed for the same purpose and, therefore, are viewed only if necessary (e.g., following unauthorised access, or theft, to identify the offender) and can, in this context, be reported to police bodies and public authorities to prosecute the perpetrators of offences and guarantee the protection, including judicial protection, of rights. These parties shall process the data as independent data controllers.

This processing has its legal basis in the legitimate interest of GSS in security and is (i), on the one hand, consistent with the position of the data subjects, as it is reasonable to believe that all those who access the GSS premises have a similar interest in the security of the premises and, (ii) on the other hand, overriding the interest of visitors not to be identifiable, taking into account the mere possibility of identification and the organisational and security measures taken by the company to protect data subjects.

The processing described in this way is necessary: if you object, you will not be permitted to access the premises of GSS.

The images collected will not be used for even indirect checks on the staff who may filmed, nor for checks on the obligation of diligence by workers nor for taking disciplinary measures.

Data processing method

Filming will be handled using tools, both manual and automated, which ensure data protection from the design stage and, by default, adequate to guarantee its security and confidentiality and with logic strictly related to said purposes, minimising the risk of destruction, loss, including accidental loss, unauthorised access, processing that is not permitted or does not comply with the purposes of the collection, by parties to whom GSS has given adequate operating instructions with specific reference to the security measures taken, assigning authentication credentials that permit, according to the tasks assigned to each, only the operations for which they are responsible and consistently limiting the possibility of viewing the recorded images, not only in synchrony with the filming, but also in deferred time and to carry out cancellation or duplication operations thereupon.

GSS has entrusted the recording handling activity Battistolli Servizi Integrati Srl, with registered office in Vicenza, at Via Via Basilio della Scola, 88, acting as data processor under a specific agreement.

The complete list of data processors can be consulted by contacting the contact details indicated at the end of this information.

Data retention period

The recordings will be kept for a maximum of 72 hours and will be used only if necessary, in order to pursue the legitimate interest of the data controller in the protection of company security.

Upon expiry of this period, the recordings will be automatically erased, by over-recording, making the erased data non-reusable. The records may be kept for a longer period of time, only in the event that it is necessary to allow investigations by the police and public authorities, as well as for judicial protection purposes.

Your rights

You can exercise the rights recognised pursuant to the legislation on the protection of personal data in force at any time and, specifically, the rights referred to in Articles 15 to 22 of the 2016/679 European Regulation: the right to ask the data controller for confirmation that the processing of data concerning you is in progress, to access your data and to erase said data or to limit data processing; the right to object to the processing; the right to data portability; the right to appeal to the Judicial Authority, or to lodge a complaint with the Data Protection Authority.

These rights can be exercised by writing to dpo.italy@it.ey.com or by contacting the Legal Department at Via Meravigli no. 14 (20123) Milan.

For information or clarifications regarding your rights, you can contact us via the same contact details.

Data Protection Officer

GSS has appointed its own Data Protection Officer (DPO), who can be contacted at the following address: Via Meravigli, 14, 20123, Milan, certified email address: dpo.italy@it.ey.com.