Space NK Ltd (“Space NK” or “we”) use CCTV cameras to view and record individuals on and around our premises in order to maintain a safe environment for employees, contractors, and customers. However, we recognise that the images of individuals recorded by CCTV cameras are personal data which must be processed in accordance with data protection legislation. As a data controller of such imagery, we have registered our use of CCTV with the Information Commissioner's Office (ICO) and seek to comply with its best practice suggestions. The use of the CCTV System will comply with the General Data Protection Regulation (“GDPR”), and other applicable legislation.
2. The purpose of this policy is to:
(a) Set out why and how will use CCTV on our premises (including in our stores), and how we will process data recorded by CCTV cameras;
(b) ensure that the legal rights of employees, contractors and customers and other third parties, relating to their personal data, are recognised and respected; and
(c) explain how to make a subject access request or complaint in respect of personal data created by CCTV.
3. This policy applies to all customers, potential customers, employees, suppliers, contractors and anyone visiting our premises. It is the responsible of all Space NK employees to comply with this policy. Non-compliance may lead to a disciplinary action.
4. The Chief Technology Officer has overall responsibility for the effective operation of this policy. Space NK will review the ongoing use of existing CCTV cameras in the workplace at least every 12 months to ensure that their use remains necessary and appropriate, and that any surveillance system is continuing to address the needs that justified its introduction.
5. We currently use CCTV as outlined below. We believe that such use is necessary for legitimate business purposes, including:
(a) to prevent crime and protect buildings and assets from damage, disruption, vandalism and other crime;
(b) for the personal safety of employees, contractors, customers and other members of the public and to act as a deterrent against crime;
(c) to support law enforcement bodies in the prevention, detection and prosecution of crime;
(d) to assist in day-to-day management, including ensuring the health and safety of customers, employees, contractors and others;
(e) to assist in the effective resolution of disputes which arise in the course of disciplinary or grievance proceedings.
This list is not exhaustive and other purposes may be or become relevant.
Camera locations are chosen to minimise viewing of spaces not relevant to the legitimate purpose of the monitoring. As far as practically possible, CCTV cameras will not focus on private homes, gardens or other areas of private property. CCTV cameras are installed in a way they will only capture images of employees, contractors and customers entering Space NK premises strictly for the purposes set out in paragraph 5.
6. Appropriate signage will be in place within all Space NK premises where CCTV is operating, to inform individuals of their presence. Signage will be clearly visible and readable, state the purpose for using the system and provide contact details for the party responsible for operating the system. In order to ensure that the rights of individuals recorded by the CCTV system are protected, we will ensure that data gathered from CCTV cameras is stored in a way that maintains its integrity and security. This may include encrypting the data, where it is possible to do so.
7. Given the large amount of data generated by CCTV systems, we may store video footage using a cloud computing system. We will take all reasonable steps to ensure that any cloud service provider maintains the security of our information, in accordance with industry standards. We may engage data processors to process data on our behalf. We will ensure reasonable contractual safeguards are in place to protect the security and integrity of the data.
8. Data recorded by the CCTV system will be stored digitally using a cloud computing system and always in accordance with the Space NK Data Retention Policy. Data from CCTV cameras will not be retained indefinitely but will be permanently deleted once there is no reason to retain the recorded information. Exactly how long images will be retained for will vary
according to the purpose for which they are being recorded. Space NK will retain routine CCTV recorded images for up to 30 days except where there is an open investigation in which case CCTV recorded images will be retained up to 7 years from the date of the investigation closing.
9. At the end of their useful life, all images stored in whatever format will be erased permanently and securely. Any physical matter such as tapes or discs will be disposed of as confidential waste. Any still photographs and hard copy prints will be disposed of as confidential waste.
10. We may share data with other group companies and other associated companies or organisations, for example shared services partners where we consider that this is reasonably necessary for any of the legitimate purposes set out above in paragraph 5.
11. No images from our CCTV cameras will be disclosed to any other third party, without express permission being given by the Chief Technology Officer. Data will not normally be released unless satisfactory evidence that it is required for legal proceedings or under a court order has been produced. In other appropriate circumstances, we may allow law enforcement agencies to view or remove CCTV footage where this is required in the detection or prosecution of crime. We will maintain a record of all disclosures of CCTV footage.
12. Data subjects may make a request for disclosure of their personal information and this may include CCTV images (data subject access request). A data subject access request is subject to the statutory conditions from time to time in place and should be made in writing.
13. In order for us to locate relevant footage, any requests for copies of recorded CCTV images must include the date and time of the recording, the location where the footage was captured and, if necessary, information identifying the individual. We reserve the right to obscure images of third parties when disclosing CCTV data as part of a subject access request, where we consider it necessary to do so. 14. If you wish to exercise any of your rights, you may contact us via email at firstname.lastname@example.org or by post to: Chief Technology Officer, Space NK Limited, 5th Floor, Shropshire House, 11 – 30 Capper Street, London WC1E 6JA. We recognise that, in rare circumstances, individuals may have a legal right to object to processing and in certain circumstances to prevent automated decision making (see Articles 21 and 22 of the UK General Data Protection Regulation). For further information regarding this, please contact Chief Technology Officer.
Policy updated: January 2023