Video Surveillance Policy

Notice pursuant to Article 13 of EU Regulation 2016/679

This notice is provided in accordance with Article 13 of EU Regulation 2016/679 (commonly referred to as the GDPR) and Article 3.1 of the Provision on video surveillance by the Italian Data Protection Authority – April 8, 2010, in order to inform you about the video surveillance systems, their use, and your rights.

A. Data Controller and Data Protection Officer

The company Continental Mare S.r.l. (hereinafter, the “Controller”), headquartered in Naples (ZIP 80133), via M. Cervantes De Savaedra 55, Tax Code and VAT no. 03376520635 (phone: +39 081.992577; fax +39 081.992505; email: contimare@leohotels.it, PEC: continentalmaresrl@pec.it), informs you that it is the data controller pursuant to Article 4, no. 7, of EU Regulation 2016/679. The data you provide will be processed lawfully, fairly and transparently, in accordance with Article 5 of the regulation and, in general, the rights and freedoms of the data subject. Additional information may be provided later, including orally.

The company has appointed a Data Protection Officer, who can be contacted at the following

email address: palmieri@aptconsulting.it.

B. Data subject to processing

Article 4, paragraph 1, of EU Regulation 2016/679 defines “personal data” as any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

In the specific case of video surveillance, the data subject to processing is summarized as follows:

• images of people and objects within the range of the surveillance cameras installed on the Controller’s premises.

C. Purpose of processing

The personal data you provide will be processed exclusively for the following purposes:

1. to ensure the safety and security of the Controller’s employees, customers, and suppliers;
2. to protect the Controller’s property by preventing and addressing any unlawful acts.

D. Legal basis for processing

The legal basis for the video surveillance activity is the legitimate interest of the Controller (Art. 6, Para. 1, Letter f of EU Regulation 2016/679) in carrying out the processing for the purposes outlined in Paragraph C.

E. Nature of data provision

The provision of data is mandatory in relation to the purposes in Paragraph C.) and is connected to the reasons why employees, customers, and suppliers access the Controller’s premises.

If the data is not provided, access to the premises will not be granted.

F. Data disclosure to third parties and/or dissemination

The viewing and management of images recorded by the video surveillance system are reserved to the Controller and/or employees expressly authorized in writing.

Data may also be disclosed to external parties if required to comply with legal obligations and/or orders from judicial or public security authorities.

G. Intended data transfer abroad

Data will not be transferred to third countries (outside the European Union).

H. Data retention period

Recorded video footage is typically stored for a maximum of 24 hours from the time of recording, except in special cases such as holidays, office closures, or when required by judicial or police authorities for investigative purposes. After this period, the footage will be automatically deleted.

I. Data processing methods

Your personal data will be processed and stored exclusively for the purposes in Paragraph C.) using paper, automated, and electronic means, stored in appropriate databases and handled with tools designed to ensure data integrity, security, and confidentiality.

The Controller adopts all appropriate technical and organizational measures to ensure processing is carried out in compliance with EU Regulation 2016/679. Access to personal data is granted only to authorized personnel.

J. Data subject rights

You may exercise the rights provided by EU Regulation 2016/679 at any time, including in particular:

a. the right to access your personal data;

b. the right to rectification or deletion of the data, or to restrict the processing of data concerning you;

c. the right to object to processing;

d. the right to data portability;

e. the right to withdraw consent, where applicable (withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal);

f. the right to lodge a complaint with the supervisory authority (Italian Data Protection Authority).

Given the nature of the data processed and the retention period, it may not always be practically possible to exercise the right to update, supplement or rectify data under Article 16 of the GDPR. The right to data portability under Article 20 of the GDPR cannot be exercised because the images acquired by the video surveillance system – except as indicated in Paragraph F.), paragraph 2 above – cannot be transferred to others.

You may exercise your rights by sending a communication to:

• Continental Mare S.r.l., via M. Cervantes De Savaedra 55 – Naples (ZIP 80133), or by calling +39 081.992577, or by emailing: contimare@leohotels.it; or via PEC: continentalmaresrl@pec.it.