Please carefully read this extended privacy notice regarding the video surveillance system active at the Stores and Offices of Harmont & Blaine S.p.A., which contains important information on the processing of personal data of individuals entering the monitored area. The processing of personal data carried out through the use of video surveillance systems is subject to the general provisions established for the protection of personal data under the Personal Data Protection Code (Legislative Decree June 30, 2003, no. 196, the “Code”) and the General Data Protection Regulation 2016/679 (the “Regulation”). These provisions ensure that the processing of personal data respects fundamental rights and freedoms, with particular regard to confidentiality, personal identity, and the right to data protection.

1. THE DATA CONTROLLER

HARMONT & BLAINE S.p.A., located in Caivano (NA), postal code 80023, at S.S. 87 Km. 16,460 Industrial Zone, tax code 05123510637 and VAT number 01392681217, represented by the legal representative pro tempore, is the data controller of the personal data of the data subjects (“Controller”).
For any question regarding this extended privacy notice for video surveillance, to obtain the complete list of appointed Data Processors, and to submit requests related to the exercise of rights connected to the processing of personal data, you can contact the Controller by writing to the following email address: privacy@harmontblaine.com or by sending a written request to the Controller’s registered office address. The Controller has appointed a Data Protection Officer (“DPO”) who can be contacted by writing to the following email address: dpo@harmontblaine.com

2. PERSONAL DATA COLLECTED

Video Recorded Images
The Controller processes the images of individuals who, while passing through the video-surveilled areas at the Points of Sale and the Controller’s Headquarters, are captured by surveillance cameras placed in the internal areas and at the entrances to the point of sale/headquarters and related premises.

3. PURPOSE OF PROCESSING, LEGAL BASIS, AND DATA RETENTION PERIOD

The recorded images are processed exclusively for the protection of company assets and physical integrity, to verify the security of the points of sale, and for the prevention and detection of any crimes within the structures owned by the Controller. Additionally, the recorded images may be communicated, upon specific request in the cases and manners provided by law, to the judicial or public security authorities.
The legal basis for such processing is identified in the legitimate interest of the Controller in protecting people and company assets from possible assaults, thefts, damages, acts of vandalism, fire prevention, and workplace safety, as well as compliance with legal and regulatory obligations in case of specific requests from judicial or public security authorities. The recorded images are automatically deleted after 72 hours from the recording. A longer retention period may occur if it is necessary to comply with a specific investigative request from the judicial or public security authorities, or if retention is necessary for the exercise of the Controller’s rights. In this latter case, the images will be retained for no longer than the period necessary to protect the Controller’s rights.

4. COMMUNICATION OF PERSONAL DATA

The recorded images will be processed by authorized personnel of the Controller.
They may also be processed by third parties, specifically appointed as Data Processors pursuant to Article 28 of the Regulation, such as entities providing maintenance services for surveillance equipment, security firms, companies managing networks and IT systems, and companies specifically handling the management of the surveillance system.
These entities will process only the personal data necessary to perform their respective services and will not be authorized to process them for other purposes.
The recorded images may also be communicated to additional entities, such as law enforcement agencies, administrative or judicial authorities, for the fulfillment of legal, regulatory, or community obligations.
The data will not be subject to dissemination.

5. METHODS OF PROCESSING

The personal data collected through the video surveillance system are processed using predominantly IT and telematic tools, adopting the necessary security measures to minimize the risks of destruction or loss, even accidental, of the data, unauthorized access, or processing that is not permitted or not in accordance with the purposes of collection indicated in this privacy notice.
In particular, the images are visible in live mode only by authorized personnel of the Controller. The cameras are installed and positioned in accordance with the specific trade union agreements (available at the Controller).

6. TRANSFER TO THIRD COUNTRIES OR INTERNATIONAL ORGANIZATIONS

The Controller will not transfer your personal data outside the European Economic Area

7. RIGHTS OF DATA SUBJECT

To exercise the rights listed below, the Data Subject may send a request by contacting the Controller, either by emailing privacy@harmontblaine.com or by sending a written request to the Controller’s address. When contacting the Controller, the Data Subject should ensure to include their name, surname, email address or postal address, and/or phone number(s), as well as any necessary documents to verify the Data Subject’s identity, to facilitate proper handling of their request.
In this case, the right to update or integrate, as well as the right to rectification under Article 16 of the Regulation, cannot be exercised due to the intrinsic nature of the data processed (real-time images concerning an objective fact). Furthermore, the right to data portability under Article 20 of the Regulation cannot be exercised, as the processing is carried out in the legitimate interest of the Controller. Specifically, the following rights are recognized to the Data Subjects:

• Right of Access: Including the right to obtain a copy of the personal data being processed and information about the processing.

• Right to Erasure : The right to obtain from the Controller the deletion of personal data concerning them when the reasons indicated in Article 17 of the Regulation apply.

• Right to Restriction : The right to obtain from the Controller the restriction of processing when the conditions indicated in Article 18 of the Regulation apply.

• Right to Object : The right to object to the processing of personal data in the cases provided for in Article 21 of the Regulation (for further details, refer to the following paragraph).

7.1 Right to Object
Pursuant to Article 21, paragraph 1 of the Regulation, the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them under Article 6, paragraph 1, letters e) or f) of the Regulation, including profiling based on those provisions. The relevant processing activities are: processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority; processing necessary for the purposes of the legitimate interests pursued by the Controller or by a third party. The Controller shall no longer process the personal data unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.

7.2 Additional Rights
The data subject has the right to lodge a complaint with a supervisory authority (in Italy, the Data Protection Authority).

8. UPDATES TO THIS PRIVACY NOTICE - COMUNICAZIONI

The Controller reserves the right to modify, add, or delete parts of this extended video surveillance privacy notice at any time, by posting the revised version on a notice board or in the areas under video surveillance, or on its website, updating the “Last Update” date. It is the responsibility of the Data Subject to review the Privacy Notice from time to time to be aware of any changes made.

Last Update: 07/11/2024