Privacy Policy for video surveillance

1.	Introduction	This Privacy Policy aims at informing the data subjects about the processing of their personal data (“Date”) by the video surveillance system of IPI S.r.l., installed at the following two plants (“Plants”): a) IPI headquarter, located in Italy, San Sisto (06132 - PG), Via Giuseppe Piermarini n.19, and b) IPI operating unit, located in Italy, Pierantonio (06019 – PG), Via dell'Innovazione Tecnologica n. 1.
2.	Data controller and applicable law	The data controller is IPI S.r.l. (“IPI”), with registered office in Italy, San Sisto (06132 - PG), Via Giuseppe Piermarini n.19, email info@ipi-srl.com. The Data are processed in compliance with the EU Regulation 2016/679 (“GDPR”), the Italian Law on the data protection, as well as the European Data Protection Board Guidelines 3/2019 on processing of personal data through video devices adopted on 29th January 2020 and the Video Surveillance Decision dated 8 April 2010, approved by the Italian Data Protection Authority and article 4 of the Italian Law n.300/1970.
3.	Person in charge, data processor and recipient of the processing	The images collected and/or registered by the video surveillance system are accessible only to (i) the personnel specifically authorized by IPI who acts under the authority of the controller, (ii) the provider of the maintenance services of the video surveillance system, and (iii) Public Authorities (in particular, Judicial Authorities and Police) that, in the cases allowed by the applicable law, receive the Data as recipient of the processing.
4.	Data subjects and categories of data	The surveillance system of the Plants, that includes outbuildings and external accesses, detects and processes the images of the subjects that pass through the range of the cameras, such as, by way of example, simple passers-by, visitors, suppliers / customers and staff of IPI.
5.	Purpose and legal basis of the processing	The data processing is based on the legitimate interest of IPI for the following purposes (i) defense and protection of company assets and (ii) occupational safety. The use of the video surveillance system – in any case limited to the external areas of the Plants - has been the subject of a specific agreement stipulated by IPI with the Unitary Union Representatives.
6.	Data retention period	The images are retained for a period of 7 days after their detection and are self-erased by overwriting new images, without prejudice to specific needs for further conservation (i) in relation to festivities or closed of offices / establishment, in any case for periods of less than seven days, without prejudice to documented and exceptional cases of closed of the establishment for longer periods, (ii) for the acquisition of evidence, on the basis of requests by Public Authorities.
7.	Rights of the data subject	The data subjects can aim IPI in order to exercise a right foreseen by the applicable law and the GDPR (articles 15 and following), if applicable to the data processing.
8.	Right to object	In the same manner as described above, the data subjects may object, completely or in part, to the processing of personal data concerning them, if the relevant legal basis is represented by the legitimate interests of IPI, pursuant to and for the purposes of the provisions of Article 21 of the GDPR.
9.	Complaint	Each data subject who believes that the processing of data concerning him is put in place in violation of the GDPR, in accordance with the provisions of Article 77 of the GDPR, may lodge a complaint with a Supervisory Authority of the Country where the data subject usually lives or works or a Supervisory Authority where the alleged data breach has occurred.