Privacy notice according to article 13 of GDPR on video surveillance systems installed on the premises and the immediate surroundings of SŽ-Potniški promet, d. o. o.

Data controller: SŽ-Potniški promet, d. o. o., Kolodvorska 11, SI-1000 Ljubljana

Video surveillance by: SŽ-ŽIP, d. o. o., T +386 31 779 340, E [email protected]

Responsible person for informing data subjects about personal data processing:

Head of Security at SŽ-ŽIP, d. o. o., Ilija Cvetković, T +386 1 29 15 012

[email protected] or E [email protected].

Contact information of the Data Protection Officer (DPO):

By postal mail to SŽ, d. o. o., Kolodvorska 11, SI-1506 Ljubljana, marked »For Data Protection Officer« or by e-mail to [email protected]

Purpose of personal data processing:

SŽ-Potniški promet, d. o. o., manages the collection of video recordings made through video surveillance systems which monitor access to the premises of SŽ-Potniški promet, d. o. o. Monitoring of access to the premises serves to ensure the safety of people and property.

Video surveillance is also carried out on the work premises of SŽ-Potniški promet, d. o. o. where this is necessary to protect trade secrets, people and property, and this purpose could not reasonably be fulfilled by other means which are less intrusive.

Video surveillance systems are also installed on-board public transport vehicles to ensure the safety of people and property.

Legal grounds for the processing of personal data:

Legitimate interest according to Article 6(1) of the General Data Protection Regulation (GDPR) in conjunction with the following articles of Personal Data Protection Act (ZVOP-2): Article 77 (Monitoring of access to premises), Article 78 (Video surveillance in work premises) and Article 79 (Video surveillance on-board public transport vehicles).

Justification of legitimate interests:

Following an assessment of legal interests, the data controller made the conclusion that video surveillance is vital to protecting its property and the passengers, employees and other people on its premises, and that these purposes cannot reasonably be fulfilled by less intrusive means. Interests or the fundamental rights and freedoms of data subjects do not override the legitimate interests of the data controller.

Data recipients or categories of data recipients, if any: 

data processor SŽ-ŽIP, d. o. o.,

relevant national authorities (the Police, a court of law etc.),

other recipients who have a basis in law, a data subject’s consent or in a contractual relationship for obtaining personal data.

Information on transfer of personal data to a third country or an international organisation and on the existence of automated decision-making:

Recordings made by the video surveillance system are not transferred to third countries nor used for automated decision-making based on profiling.

Retention period for personal data:

Recordings made through the video surveillance system according to Article 77 of ZVOP-2 (Monitoring of access to premises) and Article 78 of ZVOP-2 (Video surveillance in work premises) are stored for 90 days, following which the recordings are automatically deleted.

Recordings made by video surveillance cameras in public transport vehicles (Article 79) are kept for 7 days, following which the data is deleted or destroyed.

Should a video recording be necessary to pursue the legitimate interests of the data controller, the recording is removed from the collection of recordings and stored separately for as long as necessary to pursue, exercise or defend said interests.

Information on the existence of rights of a data subject:

As a data subject, you may exercise the following rights: the right of access to data, the right to erasure of data, the right to restriction of processing, and the right to object, taking into account the data’s respective nature.

You may request to access your personal data by stating (as accurately as possible) the time when you were on the premises under video surveillance. Access to the recording will be granted only if the requesting data subject can be clearly identified on the recording and if the faces of other identifiable data subjects on the recording can be blurred using appropriate technical tools.

When so requested, the data controller will delete personal data if one of the conditions stated in Article 17(1) of the General Data Protection Regulation is met, provided that no exemptions under Article 17(3) of the General Data Protection Regulation apply.

The right to restriction of processing can be exercised if the conditions under Article 18(1) of the General Data Protection Regulation have been satisfied. The right to object to processing can be exercised if the conditions under Article 21(1) of the General Data Protection Regulation have been satisfied.

Information on the right to lodge a complaint with a supervisory authority:

If the data controller refuses to comply with your request to exercise a right, you may seek redress by submitting an objection/a complaint to the Information Commissioner’s Office by postal mail to Dunajska cesta 22, SI-1000 Ljubljana.

Is the provision of personal data is a statutory or contractual requirement:

No.

Is the data subject obliged to provide the personal data and what can be the consequences of failure to provide such data:

No, but video surveillance cannot be avoided on certain premises.

SŽ-Potniški promet, d. o. o.

Ljubljana, 26 July 2023

Privacy notice according to article 13 of GDPR on video surveillance systems installed on the premises and the immediate surroundings of SŽ-Potniški promet, d. o. o.