CCTV Monitoring

Information on the personal data processing through video surveillance system

    1. Data Controller:

    McArthurGlen UK Limited, Nations House, 3rd Floor, 103 Wigmore Street, London, W1U 1QS, United Kingdom.

    1. Data Protection Officer (DPO):

    Data Protection People Limited


    Postal Address: Data Protection Officer, McArthurGlen UK Limited, Nations House, 3rd Floor, 103 Wigmore Street, London, W1U 1QS, United Kingdom

    1. Processing purpose and legal basis:

    We use the surveillance system for the purpose of protecting persons, property and goods, as well as to protect our legitimate interests. The personal data processing is necessary for the purposes of legal interests that we seek as data controllers (art. 6 par. 1. (f) General Data Protection Regulation – the “GDPR”).

    1. Legal interests’ analysis:

    Our legal interest consists in the need to protect the property and the goods located in it from illegal acts, such as theft or destruction. The same applies to the safety of life, physical integrity, health as well as the property of our staff and any third parties legally located in the area under surveillance. Moreover, we might use the collected data for the protection of other legitimate interests – such as in the case of an accident. We only collect image data and limit it to areas where we have assessed that there is an increased likelihood of the above (illegal acts or protection of out legitimate interests) and at the entrances, without focusing on areas where the privacy of the persons, of whom the image is captured, may be severely restricted, including their right to respect for personal data.

    1. Recipients of the personal data:

    The collected material is accessible only by the competent / authorized personnel in charge of the security. This material shall not be transferred to third parties, except in the following cases: a) to the competent judicial, prosecutorial and police authorities when necessary information are included, necessary for the investigation of a criminal offense involving persons or property of the data controller; b) to the competent judicial, prosecutorial and police authorities when requesting data, lawfully, for the performance of their duties; c) to the victim or perpetrator of an illegal act, in the case of data which may constitute evidence of the act; and d) to affiliate companies, to the owner of the property, to third-party partners (e.g. security company) and service providers, when it is deemed absolutely necessary, and always under the condition of respecting the confidentiality and protection of your data.  

    The data might also be transferred to third countries (i.e. any countries out outside of the European Economic Area) – in such a case always under the conditions and in accordance with the provisions of the GDPR.

    1. Data retention period:

    The data is stored for fifteen (15) days, after that period it is automatically deleted. In case that an incident takes place during that period, we shall isolate part of the video and keep it for another (1) month, in order to investigate the incident and initiate legal proceedings to defend our legal interests, while if the incident concerns a third-party the video will be retained for up to three (3) more months. If legal proceedings are commenced, the data shall be retained as long as necessary.

    1. Data subject rights:

    The data subjects have the following rights:

    • Right of access: you have the right to know if we are processing your image and, if applicable, to receive a copy.
    • Right to restriction of processing: you have the right to request the restriction of processing, for example to not delete personal data that you deem necessary to establish, exercise or support legal claims.
    • Right to object: you have the right to object to the processing.
    • Right to erasure: you have the right to request the deletion of your data.


    You can exercise your rights by sending an e-mail to the address or a letter to our postal address. Whether you exercise your rights on your behalf or on behalf of someone else, you may be required to provide us with proof of identity of the data subject and, if applicable, proof of the right to act on behalf of the data subject, as well as provide us with copies of them. In order to investigate a request related to your image, you should provide to us information regarding when you were within range of the cameras and provide us with a picture of yourself, so as to make it is easier for us to locate your data and hide the data of third parties. Alternatively, we provide you the opportunity to visit our facilities in order to show you the images in which you appear. We also note that exercising the right of objection or erasure does not imply the immediate deletion of data or the modification of the processing. In any case, we will provide you with an answer in detail as soon as possible, within the deadlines set by the GDPR.

    1. Right to file a complaint

    In case you consider that the processing of your personal data violates Regulation (EU) 2016/679, you have the right to file a complaint to a supervisory authority.

    The competent supervisory authority in Greece is the Data Protection Authority, Kifissias 1-3, 115 23, Athens,, tel. 2106475600.


For more information, please see our privacy policy, which is available on our website.