Extended information on video surveillance processing

Data Controller and Manager for the protection of personal data

The Data Controller is the company: Riva del Garda Fierecongressi S.p.a., Parco Lido n. 1 - Riva del Garda (TN), Italy, e-mail: info@rivafc.it - tel: 39 0464 570100.
The Manager for the protection of personal data can be contacted at: rdp@rivafc.it

Purpose for processing

The presence of video cameras is always indicated by signs posted in the access gates of the aforementioned real estate complexes and in the vicinity of the filming areas. The video surveillance system is designed to respond to the needs of asset protection and preventing vandalism or behaviour to the detriment of company assets and people present. The processing is justified by the pursuit of a legitimate interest of the data controller.

Method of data collection

The Data Controller undertakes not to film that which is not strictly functional to the purposes described above. The afore-mentioned video surveillance system consists of video cameras that are active 24 hours a day, positioned to monitor certain areas considered particularly sensitive. The floor plan is on file. Images captured will never be disseminated (with the exception of their appearance in real time on certain monitors placed in protected areas). The same images will be recorded and stored for a period of 72 hours on a video recorder equipped with adequate security measures to minimise the risks of destruction, loss, unauthorised access, unauthorised processing or non-compliance with the purpose of collection.  None of the video cameras associate the images captured with other personal data,
(biometric data, for example), and nor is so-called intelligent software used that might permit facial recognition of the person filmed by links to related images (for example facial morphology) with other specific personal data or by means of a pre-established sample for the same surveillance. The data is processed in compliance with the technical and
organisational security measures provided for by the EU Regulation through appropriate procedures to guarantee their confidentiality.
All data provided is processed according to the principles of correctness, lawfulness and transparency both in paper and electronic form and is protected by technical and organisational measures to ensure suitable levels of security pursuant to articles 25 and 32 of the GDPR.

Duration of processing and period of conservation

The recorded images are kept for a maximum of 72 hours with the exception of any alternative instructions issued by the public safety authority. At the end of the established period, the video recording system automatically deletes them by over-recording, in such a way as to make the deleted data unusable.

Nature of the 
provision of data

Image-detection can take place without the consent of the interested party, in accordance with the conditions of the Provision on video surveillance of 2010 (point 6.2.2) which implements the institution of a balancing of interests.

Communication of data

The data is neither subject to communication nor dissemination except in the case of requests received from the judicial authorities or law enforcement agencies. The data may be known by the owner, by the data processors and by specially trained data processors. In addition to the afore-mentioned subjects, the data provided may be processed by third parties, appointed as data processors to the extent that this is necessary for the performance of the activity they carry out on behalf of the Entity (plant maintenance) and within the limits of the authorisation profiles identified for them, the list of which is available at the offices. The data communicated will not be transferred to foreign countries or international organisations outside the EU.

Rights of the interested party

With regard to the data provided, the interested party or his/her representative may exercise, without particular formalities, the rights provided for in Articles 15 et seq. of EU Regulation 16/679 by contacting the Data Controller or Data Protection Officer. In particular, you may request access, rectification, cancellation, limitation, or exercise the right to obtain portability as well as lodge a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR (Guarantor for the Protection of Personal Data).