Privacy policy: Recorded camera surveillance
Privacy policy: Recorded camera surveillance
Burger-In Oy (hereinafter "Hesburger") processes the personal data of customers (hereinafter "Customer") using a camera surveillance system. Recorded images are considered personal data if a private person can be identified or is identifiable in an image. Hesburger is committed to processing all personal data carefully and in full compliance with valid data protection legislation.
Why do we process personal data?
We process your personal data (i.e. recorded camera surveillance images) in an effort to protect our property, to monitor our production and service process, to prevent crime, and to investigate any crimes committed or suspected to have been committed and accidents occurring on or in close proximity to our premises. We also process personal data in an effort to safeguard our employees in the performance of their work as well as increase the level of occupational safety.
Processing personal data is based on a legitimate interest. The processing of personal data is permitted when it is necessary to realise the legitimate interests of the controller or a third party. Hesburger considers the processing of personal data for the processing purposes specified above to be absolutely necessary to the protection of Hesburger property and safeguarding the personal safety of its employees, and these same interests cannot be effectively protected by means of other, less stringent measures.
What data do we process and where does this data come from?
The register consists of video recordings made on a time and place-bound camera surveillance system. These recordings comprise the entirety of the data contained in the register. The camera surveillance system is used in Hesburger chain restaurants and other company production and operational premises, in El Nam, H Burger Lab and Parilla restaurants, at Hesepesu car washes, Hesehotelli, Clewer Oy operational premises, Hes-Pro Finland Oy and Finnsoy Oy operational premises as well as the grounds and immediate surroundings of the above-mentioned premises.
The personal data groups subject to processing are the customers and employees of the aforementioned companies. In addition to the above-mentioned groups, personal data groups subject to processing also include other property users.
Data subjects are informed of recorded camera surveillance by "Recorded camera surveillance" signs and/or labels posted at operational premises.
Who is permitted to process personal data?
Personal data may be processed by Hesburger employees whose job description includes the maintenance and development of the camera surveillance system. Personal data may also be processed by Hesburger employees whose job description includes dealing with criminal matters or damages.
Personal data is transferred within the Hesburger chain to Salmela-Yhtiöt Oy for technical or administrative purposes as well as to Gurulogic Microsystems Oy for the technical maintenance of the camera surveillance system. In addition to the above, personal data is also transferred to outside IT service providers for the technical maintenance of the service.
Personal data is transferred to the police and other government agencies which are legally entitled to process camera recordings. Personal data is also transferred to government agencies in situations where processing is necessary for filing a lawsuit or for responding to or deciding such a lawsuit. Personal data is also transferred to insurance companies for the purpose of processing and resolving insurance claims.
Personal data is not transferred outside of the EU or EEA.
Principles for securing the register
Hesburger employs technical and organisational measures to prevent the unauthorised use, transfer, deletion or other processing of personal data that may jeopardise data protection. The register is retained in electronic form. The register is used and data is altered and processed only with an application encypted with multi-factor authentication. The register may only be used by appointed and restricted personnel, whose task is to maintain and administer the system. Register data is protected against outside access. Use of the register is monitored.
How long do we store personal data?
Hesburger stores camera recordings for one (1) month after the moment of recording. When one month has passed, the recordings are automatically destroyed. Recordings may be stored for a longer period of time, if they are required for investigating a crime or damage case. Even in such cases, the recordings will be destroyed when they are no longer needed.
We have decided on one month as the storage time period because many criminal matters and damage cases do not immediately come to our attention. We want to ensure that we can use our camera surveillance system in accordance with our stated purposes.
Customer rights
The customer may exercise the rights mentioned below by contacting Hesburger by mail or email. Hesburger reserves the right to request additional information from the customer in order to verify their identity and carry out the request for information.
Right of access
The customer has the right to inspect their own data in the register.
Right to request correction of incorrect or incomplete data
The customer has the right to request that incorrect or incomplete data be corrected.
Right to erasure
The customer has the right to request that their personal data be deleted from the Bonus Club register ("Right to be forgotten"). At the customer's request, Hesburger shall make every effort to delete the data without undue delay, except in cases where there are legal reasons for denying the deletion of data.
Right to restrict and oppose processing
The customer has the right to restrict and oppose the processing of their personal data. When the customer has submitted a request, Hesburger may no longer process the customer's personal data, unless there is a legal reason for processing.
Right to transfer data from one system to another
The customer has the right to receive their personal data in a structured and commonly used form, in which the customer is able to transfer the data to the controller of another personal data register.
Right to file a complaint
If the customer feels that their privacy has been violated, they may file a complaint with the applicable authority in the EU member state where they reside. Detailed information on National Data Protection Authorities can be found here: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080
Who is the controller of your personal data and where can you contact them?
Burger-In Oy
Business ID: 2031967-6
Linnankatu 34
20100 Turku
privacy@hesburger.fi
UPDATE VERSION 01.10.2022