Camera surveillance and access control

1. Controller and contact information in register matters

Nor-Maali Oy (Business ID 3257285-5)
Vanhatie 20, 15240 Lahti
tietosuoja@nor-maali.fi

2. What is the purpose and basis for processing personal data?

The processing of personal data is based on a legitimate interest of Nor-Maali Oy. The purpose of camera surveillance and access control is:

• protect property, prevent vandalism and crimes
• assist with the investigation of the already committed crimes and situations in which the property and safety are endangered
• ensuring safety of the premises and the people moving within the area
• ensuring the proper functioning and safety of the production processes and to prevent situations endangering the production process and to assist with the investigation of the already occurred situations.

Additionally, the records of the camera surveillance may be used for the following purposes:

• verifying the ground for the termination of employment
• investigating or verifying harassment or molesting in accordance with the Act on Equality between Women and Men or harassment or inappropriate behavior in accordance with the Occupational Safety and Health Act, if the Company has a reasonable ground for suspecting that the employee is guilty of harassment, molesting or inappropriate behavior
• investigating an occupational accident or other situation, which has caused danger or risk, in accordance with the Occupational Safety and Health Act.

3. What data we process and where do we collect the data?

The register includes the footage recorded by the cameras located in the camera surveillance area on Nor-Maali Oy premises located at Vanhatie 20 (Lahti). In addition to the footage, the date and time is recorded to the register.

The access control system forms a register based on the use of an access card, to which accepted and dismissed access events (stamp data) including dates and times, are stored. In addition, the register includes the following information of the persons to whom the access card has been granted:

• name and if necessary the name of the company
• number of the access control key and the information of the access rights.

The source of the information stored to the register is primarily you in connection with the recording camera surveillance and access control. Other sources of information shall be used within the limits of the legislation.

4. To whom we disclose or transfer data, and do we transfer data outside the UE or EEA?

Personal data is not regularly disclosed to third parties or transferred outside of the EU or EEA. Data may be disclosed to the authorities for the investigation of crimes if needed.

We use an external service provider to implement access control. We make data processing agreements with service providers acting as processors and ensure that our collaboration partners process personal data only to the extent that is necessary for the provision of the service in question.

5. How do we protect the data and how long we store data?

The register is kept in a locked place and on password-protected devices. Only pre-designated persons have access to the register to the extent required by their working duties. By concluding the data processing agreements with our subcontractors, we ensure the protection of personal data in outsourcing situations.

The personal data processed as a part of the register shall be stored for as long as it is necessary for enforcing the purpose of the camera surveillance and access control. The access control data may be processed retrospectively for approx. 2 months. Depending on the storage capacity, the camera footage may be processed retrospectively for approx. 5 months.

6. Your rights as a data subject

The requests concerning data subject rights must be submitted using the contact details mentioned in section

Aa a data subject, you have the following rights:

Right to access, correct or delete your personal data

• You have the right to inspect the personal data stored in the register concerning yourself and the right to demand rectification or erasure of the data.

Right to object and restrict the processing

• You have the right to object or to demand restriction of the processing.

Right to lodge a complaint with the supervisory authority

• You have the right to lodge a complaint with the supervisory authority concerned, especially in the EU Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of personal data relating to you infringes applicable data protection regulation.