Pursuant to Article 13 of the GDPR, we provide you with the following information on the processing of personal data collected through the video surveillance systems of our stores and warehouses.

a) Identity and contact details of the Data Controller

The independent data controllers are, each in relation to their respective stores and warehouses, the following companies:

• LAGARDÈRE TRAVEL RETAIL ITALIA S.R.L. (Tax ID and VAT No 04269090272);
• LS TRAVEL RETAIL ROMA S.R.L. (Tax ID and VAT No 11867061001);
• AIREST RETAIL S.R.L. (Tax ID and VAT No 04044640276);

all with registered office at 7 Via Fratelli Bandiera, 30020 Gaggio di Marcon (VE), Italy, link to the contact form .

b) Data Protection Officer (“DPO”)

The Data Protection Officer designated by each Data Controller pursuant to Article 37 of the GDPR may be contacted by clicking on this link .

c) Purpose and legal basis for processing personal data

The recording of images takes place for the following purposes:

1. safety and security of assets and premises of the Data Controllers;
2. safety and security of employees, contractors, customers, suppliers and visitors in general.

The processing of your personal data, for the purposes and according to the procedures described in this notice, may occur without the need for your consent, pursuant to Article 6(1)(f) of the GDPR and in compliance with the Decision of the Italian Data Protection Authority dated 8 April 2010 on video surveillance, the Guidelines 3/2019 on processing of personal data through video devices of the European Data Protection Board and subsequent amendments and supplements thereof.

d)  Recipients of your personal data

Within the scope of afore-mentioned purposes, the images will not be disseminated or communicated to third parties. Only in case of offences (e.g. theft, robbery, property damage and/or personal injury) images can be stored and communicated to the judicial or law enforcement authorities.

The images may also be accessed, limited to the respective scope of responsibility (i) by data processors expressly authorised to use video surveillance systems and (ii) by data processors of the companies that provide security and video surveillance services.

Where necessary, the Data Controllers have appointed the recipients of personal data as external data processors pursuant to Article 28 of the GDPR. The names of all the external data processors may be requested to the above-mentioned contacts.

e)  Transfers outside the EU

For the above-mentioned purposes, your personal data will not be transferred to countries not belonging to the European Union.

f)  Methods of processing personal data

The processing of personal data will take place using IT or electronic communication systems, in compliance with current legislation, in order to guarantee security and confidentiality.

g) Personal data storage period

Within the scope of the afore-mentioned purposes, the images will not be disclosed to third parties and will be stored on electronic media for a predetermined timeframe, after which they will be deleted.

The storage period, which can be of 24 or 72 hours, depending on the store or warehouse, is indicated in the video surveillance warning signs.

Only in case of public holidays/closure of the offices, the storage of images may be extended no later than the working day after the public holiday/closure. In any case, the foregoing is without prejudice to storage for a longer period of time for the purpose of adhering to a specific investigation request by the judicial or law enforcement authorities.

At the end of the storage period, the deletion of the footage will be automatic, by over-recording, in such a way as to prevent the re-use of the erased data.

h)  Rights pursuant to Articles 15 to 22 of the GDPR

By means of a communication to be sent by clicking on this link , you will be able to exercise the rights referred to in Articles 15 to 22 of the GDPR, including, in short, the following:

• to obtain confirmation as to whether or not personal data concerning you are being processed;
• to obtain access to your personal data and to the information indicated in Article 15 of the GDPR;
• to obtain the rectification of inaccurate personal data concerning you without undue delay or the amendment of incomplete personal data;
• to obtain the erasure of personal data concerning you without undue delay;
• to obtain a restriction of processing of personal data concerning you;
• to be informed of any rectification or erasure of personal data or restriction of processing carried out in relation to personal data concerning you;
• to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit those data to another controller;
• to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you for the pursuit of the legitimate interests of the Data Controller pursuant to Article 6(1)(f) of the GDPR.

You may find the complete list of your rights at www.garanteprivacy.it.

i)   Complaint to the Data Protection Authority

We remind you that, if you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement.

The Data Controllers

LAGARDÈRE TRAVEL RETAIL ITALIA S.R.L.

LS TRAVEL RETAIL ROMA S.R.L.

AIREST RETAIL S.R.L.