Monitoring Policy

REGULATIONS FOR THE USE OF THE VIDEO SURVEILLANCE SYSTEM AT UNISYSTEM Sp. z o.o.

1. General Provisions:

These regulations define the principles of proper management of the video surveillance system at UNISYSTEM Sp. z o.o., ul. Nowy Świat 36, 80-299 Gdańsk.

2. Definitions:

• Personal Data Controller (PDC) – UNISYSTEM Sp. z o.o. (also referred to as the Company), represented by the President of the Management Board. The Personal Data Controller, by definition, is an authority, organizational unit, entity, or person that decides on the purposes and means of processing and is responsible for the protection of the processed personal data.
• Surveillance System Administrator – a person entrusted with the maintenance and repair of the video surveillance system, which includes cameras and a digital video recorder.
• Personal Data – any information relating to an identified or identifiable natural person. In the case of surveillance, this is the image and manner of behavior.
• Authorized Person – A person with a personal authorization or an entity with a data processing agreement on behalf of the controller in the scope of video surveillance.
• Monitored Area – The area covered by the range of the image recording devices in the surveillance system.
• Video Surveillance System Design – a document containing a plan for the placement of image-recording cameras in the surveillance system.
• Video Surveillance System Management Manual – a document defining the rules of management, including the security, access, and sharing of recordings from the video surveillance system with authorized entities.

3. Purpose of Surveillance:

We conduct video surveillance at UNISYSTEM Sp. z o.o. in order to: a) ensure the safety, health, and life of our employees, associates, clients, contractors, and other persons present on the premises monitored by the Personal Data Controller, b) secure movable and immovable property on the premises monitored by the Personal Data Controller, including detecting instances of law violations, preventing theft, violence, devastation, and acts of vandalism. c) supervise the security of employees, associates, clients, contractors, and other persons present on the premises of the UNISYSTEM Sp. z o.o. complex.

4. Form of Surveillance:

We use video surveillance in the form of cameras that enable the recording of the image of persons present on the premises of UNISYSTEM Sp. z o.o. The cameras of the company’s surveillance system are located inside and outside the building. Both the external area and the rooms where the cameras are installed are clearly marked with pictograms and informational signs. Pictograms are placed at all entrances to the monitored area. The monitored area also includes parts of the company complex leased and administered by RIVERDI Sp. z o.o. The scope of cooperation regarding the administration of the surveillance system and the mutual responsibility of the companies has been defined in a relevant agreement between UNISYSTEM Sp. z o.o. and RIVERDI Sp. z o.o.

5. Scope of Processed Personal Data: The scope of information processed in connection with the image recorded by the surveillance device on the company’s complex buildings includes: a) the image of natural persons, b) the behavior of persons whose image was recorded by the image-recording device, c) the time and place of the event covered by video surveillance. d) the registration number of a vehicle entering the complex and the area adjacent to the buildings covered by video surveillance.

6. Monitored Area and Excluded Areas:

The area covered by video surveillance:

• Maneuvering area, parking zones, and communication routes around the buildings of the company complex.
• Staircases, corridors, and internal communication routes.
• Production, loading, unloading, and warehouse rooms.
• Packing zones.
• Workstations requiring special supervision. Areas excluded from surveillance:
• Cloakrooms and changing rooms.
• Rooms intended for employee recreation and rest.
• Hygienic and sanitary facilities.

7. Retention Period and Sharing:

At UNISYSTEM Sp. z o.o., the following conditions for storage and sharing are established: a. Recordings from video surveillance are processed solely for the purposes for which they were collected and are stored for a period not exceeding three months, in accordance with Art. 114 of the Act of 23 April 1964 – Civil Code (Journal of Laws of 1964, No. 16, item 93), i.e., 90 days. b. This period may be extended by periods resulting from legal obligations or to protect the rights of the Personal Data Controller or third parties, including for the purpose of pursuing or defending against claims. After the collection and processing period has expired, the collected data is permanently destroyed. c. Recordings may be shared only with entities authorized to obtain personal data on the basis of legal provisions (based on a written request) and with authorized employees.

8. Data Security in Surveillance:

To ensure the security, confidentiality, and integrity of data recorded in the surveillance system, the following are provided: a. Implementation of appropriate technical solutions. b. Securing the devices and the room where data is stored against access by unauthorized persons. c. Application of appropriate physical security measures.

9. Rights of Persons Whose Image Has Been Recorded:

Persons whose data is contained in materials obtained from surveillance have the right to: a) request access to the data – within the limits of Art. 15 of the GDPR, b) request rectification of data – within the limits of Art. 16 of the GDPR, c) request erasure of data – within the limits of Art. 17 of the GDPR, d) request restriction of processing activities – within the limits of Art. 18 of the GDPR, e) object to the processing of data – within the limits of Art. 21 of the GDPR, f) data portability, including obtaining a copy of it – within the limits of Art. 20 of the GDPR.

The data subject also has the right to lodge a complaint regarding the processing of their image to the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw. All these rights are discussed in detail in Articles 15 to 20 of the GDPR, the text of which is available at:

http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L:2016:119:TOC

We do not plan to transfer personal data recorded by the video surveillance system to a third country or an international organization. The recorded data is not subject to profiling, and it is reviewed only in the event of a violation or suspected violation of the law or internal regulations at UNISYSTEM Sp. z o.o., or in connection with a submitted complaint.

10. Legal Basis:

a) Art. 222 § 7 and 8 of the Act of 26 June 1974 – Labour Code (i.e., Journal of Laws of 2023, item 1465, as amended). b) Art. 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union, L 119/1 of 4 May 2016) – the legitimate interest of the Personal Data Controller. c) Art. 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union, L 119/1 of 4 May 2016) – processing is necessary for compliance with a legal obligation to which the Personal Data Controller is subject.