Data privacy notice video surveillance

a) Introduction
With the following data protection information, METRO Campus Services GmbH, Metro-Straße 12, 40235 Düsseldorf, Germany (hereinafter referred to as "METRO", "we" or "us") informs you about the processing of personal data in connection with video surveillance at the Düsseldorf campus (hereinafter referred to as "video surveillance"). Personal data is any information relating to an identified or identifiable natural person (such as first and last name, address, telephone number or e-mail address). In the following, we would like to inform you in particular about which personal data is processed in connection with video surveillance, for what purpose this processing is carried out and what rights you have in relation to this processing in accordance with the General Data Protection Regulation ("GDPR").

b) Controller / data protection officer
METRO is the controller (Art. 4 No. 7 GDPR) for the processing of personal data. If you have any questions or other concerns regarding the processing of your personal data, you can contact our data protection officer at any time using the following contact details

• METRO Campus Services GmbH, Data Protection Officer, Metro-Straße 12, 40235 Düsseldorf
• E-mail: datenschutz@metro-services.de

a) Categories of personal data that we process:

• Video recordings

b) Purposes and legal bases of data processing
Exercise of domiciliary rights, investigation of criminal offenses and enforcement of legal claims pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR

c) Legitimate interests that are pursued
Protection of customers, employees and property and preservation of evidence

d) Storage duration
The video recordings are stored for a maximum of 72 hours.

e) Recipients of personal data
Data will only be transmitted to law enforcement authorities to investigate a criminal offense or to preserve evidence.

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information specified in Art. 15 GDPR.

The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her and, where applicable, the completion of incomplete personal data (Art. 16 GDPR).

The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where one of the grounds listed in Art. 17 GDPR applies, e.g. if the data is no longer required for the purposes pursued (right to erasure).

The data subject has the right to obtain from the controller restriction of processing where one of the conditions listed in Art. 18 GDPR applies, e.g. if the data subject has objected to processing, for the duration of the verification by the controller.

The data subject has the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her. The controller will then no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims (Art. 21 GDPR).

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to him or her infringes the GDPR (Art. 77 GDPR). The data subject may exercise this right before a supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement. In North Rhine-Westphalia, the competent supervisory authority is

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestr. 2, 440213 Düsseldorf, e-mail: poststelle@ldi.nrw.de