CCTV Privacy Notice
1. Controller and contact details
The controller of personal data collected through video surveillance is ETNIKA Sp. z o.o., with its registered office at ul. Złota 59, 00-120 Warsaw, Poland, Tax Identification Number (NIP) 7011114082 (“ETNIKA”, the “Controller”).
For matters relating to CCTV, data processing or the exercise of your rights, you may contact the Controller by post at the above address, marked “GDPR/CCTV”, or through the current contact channel indicated on ETNIKA's website. If the Controller has appointed a Data Protection Officer, correspondence may be sent to the Controller's address marked “Data Protection Officer”; the DPO's current contact details are published on the website.
2. Scope of surveillance and categories of data
This notice applies to customers, visitors, suppliers, contractors, employees and other persons within camera range at marked ETNIKA locations. CCTV may cover only necessary and clearly marked areas, such as entrances and exits, sales floors, checkout areas, circulation routes, warehouses, delivery areas or car parks — and only where the particular area is actually covered by cameras. Information displayed before entry into camera range identifies the relevant location or area as monitored.
The data processed may include an individual's image, appearance, movement, presence at a particular place and time, the course of a recorded event and — where visible in the frame — markings on objects or vehicle registration numbers. CCTV does not record audio. ETNIKA does not use recordings for facial recognition, biometric identification, emotion analysis or profiling.
Cameras do not cover sanitary facilities, changing rooms or other spaces where an individual has a reasonable expectation of heightened privacy. Camera fields of view are limited so that areas not needed for the purposes described below are not recorded.
3. Purposes and legal basis
Recordings are processed to protect customers, employees and other persons, safeguard property, prevent theft, damage and other incidents, clarify their circumstances, and establish, pursue or defend legal claims. The legal basis is Article 6(1)(f) GDPR — the Controller's legitimate interests in protecting persons and property and preserving evidence.
CCTV is used only where the Controller has assessed it as necessary and proportionate to the risk and where the purpose cannot reasonably be achieved by less intrusive means. Recordings are not used for purposes incompatible with those set out above, including marketing or continuous monitoring of employee performance.
Where camera coverage includes workplaces or employees, the Controller additionally applies the conditions laid down in Article 22² of the Polish Labour Code, including requirements concerning purpose, scope, signage and advance notice to employees.
4. Collection of data and voluntary provision
Data is collected directly from the individual by observation and automatic image recording when the individual enters the marked range of a camera. Providing data is not a statutory or contractual requirement. Entering a monitored area will, however, result in the recording of the individual's image if they enter a camera's field of view.
5. Retention period
As a rule, recordings are retained for no longer than 30 days from the date of recording and are then automatically overwritten or permanently deleted. A shorter period may apply at a particular location where it is sufficient for the purpose of surveillance.
If a recording constitutes evidence in proceedings, or the Controller becomes aware that it may constitute evidence, the relevant extract may be secured and retained until the proceedings are finally concluded or the applicable limitation period expires. Once the need ends, the material is deleted without undue delay. For employee monitoring, retention also remains within the limits laid down in Article 22² of the Polish Labour Code.
6. Recipients
Recordings may be accessed only by authorised persons and only to the extent necessary for their duties. Recipients may include providers of security, CCTV operation, maintenance, hosting or IT support services to ETNIKA — acting as processors under appropriate agreements — as well as insurers, legal advisers and parties pursuing or defending claims where an appropriate legal basis exists.
Recordings may be disclosed to the Police, public prosecutors, courts or other competent authorities where required by law or a legally valid request. Recordings are not made publicly available.
7. Transfers outside the EEA
The Controller does not intend to transfer recordings outside the European Economic Area on a regular basis. If a technical service used by the Controller were to involve such a transfer, it would take place only in accordance with Chapter V GDPR, using an appropriate transfer mechanism and the required safeguards; information about the transfer would be made available to data subjects.
8. Rights of recorded individuals
Subject to the conditions in the GDPR, you have the right to request access to your data and obtain a copy of the recording, request erasure or restriction of processing, and object — on grounds relating to your particular situation — to processing based on Article 6(1)(f) GDPR. Following an objection, the Controller will stop processing unless it demonstrates compelling legitimate grounds which override your rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.
To help locate a recording before it is overwritten, a request should, where possible, state the location, approximate date and time, and a description of the person or event. Exercising the right to a copy must not adversely affect the rights and freedoms of others; the Controller may therefore mask images of other persons, provide a secure extract or, where appropriate, arrange protected viewing. The right to rectification has limited application to footage constituting a record of an event, and the right to data portability does not apply to processing based on legitimate interests.
You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, through the channels indicated at uodo.gov.pl.
9. Automated decisions and security
Recordings are not used to make decisions about individuals based solely on automated processing that produce legal effects or similarly significantly affect them. The Controller applies technical and organisational measures appropriate to the risk, including permission restrictions, access control and logging of operations performed on recordings.
10. Layered information and updates
Before entering camera range, individuals are shown clear first-layer information identifying the CCTV operation and the Controller and directing them to this full notice. This notice may be updated if the purposes, scope, technology, providers or applicable law change. Version and legal status: .