1. Controller

L-Fashion Group Oy
Business ID: 0149158-5
PL 55, 15501 LAHTI, Finland
Tel. +358 (0)3 822 111 (switchboard)

2. Contact information for matters related to the register

If the matter pertains to the processing of personal information or the use of the rights based on GDPR ((EU) 2016/679), you may contact the Data Protection Officer of the Controller. The Data Protection Officer may be contacted via e-mail dataprotection@luhta.fi.

3. Register name

Video surveillance register.

4. Purpose and legitimate grounds of video surveillance

The primary purpose of video surveillance is to prevent, stop, detect and fight crime. The purpose of video surveillance is also to help clarify crimes and accidents that have already happened. In such cases, video surveillance is used, if necessary, for the identification of persons who have been in the monitored area and for composing, presenting, defending and implementing possible legal claims.

The purpose of video surveillance is to add to the safety of the Controller’s employees and other persons operating in the area. Video surveillance is used in particular to support the protection of human lives and the right to the integrity of the human person. Video surveillance is used to protect the Controller’s own property, property that is in the Controller’s possession and other property located in the monitored area.

The processing of the video surveillance data is based on the GDPR article 6, point 1, subsection f (legitimate interest). In addition, processing of the video surveillance data is based on the Act on the Protection of Privacy in Working Life 759/2004, articles 16 and 17, and the Occupational Safety and Health Act 738/2002, article 27.

As an employer, the Controller also has the right to use the video surveillance data to prove the reason for terminating an employment relationship, to investigate and prove harassment as stipulated in the Act on Equality between Women and Men (609/1986) or harassment as stipulated in the Non-discrimination Act (1325/2014), article 14, or harassment and inappropriate behaviour as stipulated in the Occupational Safety and Health Act, or to clarify occupational accidents or other dangerous or threatening situations as stipulated in the Occupational Safety and Health Act.

5. Implementation of video surveillance

Video surveillance is implemented in the areas marked “Tallentava kameravalvonta” (recording video surveillance). The areas are located on the properties and facilities controlled by the Controller.

6. Persons being recorded

The cameras are used to record the persons occupying the monitored areas and information on these persons may be saved in the register. In addition to images, the date and time of events are saved in the register.

7. Information on the recipients of the personal data

Video surveillance data are processed by employees of the Controller or employees of their partners, whose completion of work tasks requires the processing of the data. The processer of the personal data is bound by duty of confidentiality and personal data are processed confidentially. The Controller’s partners can be, for example, security companies, producers of safety technology services, producers of property maintenance services or insurance companies.

The video surveillance data can also be shared with officials, such as police officials or other partners of the Controller, for investigating crimes and accidents and for establishment, exercise or defence of legal claims or in other cases, where the Controller is legally obligated to do so. Additionally, data may be disclosed outside of the Controller, if there is another legal basis for the disclosure, such as if it is necessary in order to protect the company from legal action.

Data may be shared between the different offices of the Controller.

8. Transferring data outside the EU or the European Economic Area

Video surveillance data are not transferred outside the EU or the European Economic Area.

9. Video surveillance data retention period

The video surveillance data are deleted or overwritten as soon as their retention is no longer necessary for completing the objectives stipulated in point 4. Video surveillance data can be retained, depending on the place it has been saved, for 30 to 365 days, after which the data are deleted or overwritten. Video surveillance data can however be kept longer, if the investigation of a crime, accident or matters related to an employment relationship as stipulated in point 4 or the presentation, clarification or defence of a legal claim requires that the data be kept. The video surveillance data are, however, deleted at the latest when the final judgement has been delivered on the matter related to the video surveillance data or an agreement has been reached in the matter related to the video surveillance data.

10. Rights of the data subjects

Data subjects have the right to access the video surveillance data on them. Data subjects can request a copy of their video surveillance data from the Controller, after they have indicated their identity beyond doubt to the Controller. The reliable identification of a person may require a personal visit to the Controller’s facility. In order to protect the data privacy of other persons in the video surveillance data, the right of the data subject’s access to their information may be evaluated case-by-case. Even if the right to access is granted, a copy can be delivered to the person requesting it only by delivering images from the video surveillance data in such a way that other persons cannot be identified.

The data subject also has the right to request the rectification of incorrect or incomplete personal data. The data subject also has the right to request the erasure of their personal data from the register. The data will be erased, if there no longer is a purpose for keeping it as stipulated in section 4 or another legal basis. The data subject also has the right to object to the processing of their personal data on grounds relating to their particular situation. In addition, the data subject may have the right to restrict the processing of their personal data.

11. Acquiring the information in the register

The register consists of analogue or digital recordings transmitted by the cameras the Controller has placed in necessary and legal locations and no data is acquired from other sources.

12. Information about automated decision-making, including profiling, and using the information for other purposes

No automated decision-making, such as profiling, is performed based on the video surveillance data. The video surveillance data is not used for purposes other than stated in this document.

13. Right of lodging a complaint with a supervisory authority

If the person considers the processing of their personal data by the Controller to violate the provisions of the EU’s General Data Protection Regulation, the person may lodge a complaint with a supervisory authority in their permanent place of residence or place of work or where the customer considers the violation of the provisions to have happened. In Finland the authority in question is the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

Street address: Lintulahdenkuja 4
00530 Helsinki, Finland

Postal address: PL 800
00531 Helsinki, Finland

Phone (switchboard): + 358 29 56 66700
Fax: + 358 9 56 66735
E-mail: tietosuoja@om.fi