1. The legitimate purpose and the legal basis of video surveillance


The use of the video surveillance system is necessary to maintain an optimal social climate and to increase the security, security and access control within the CCAT  (hereinafter referred to as CCAT). The legal basis for the processing of personal data is represented by art. 6 paragraph 1 letter f) of Regulation (EU) 2016/679 – processing is necessary for the purposes of the legitimate interests pursued by the operator or by a third party.


Legal framework:

  1. a) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General regulation on data protection)
  2. b) Instructions of the European Personal Data Protection Authority regarding video surveillance,
  3. c) Law no. 190/2018 on measures to implement Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing of Directive 95/46 / EC (General Data Protection Regulation)


  1. Purpose and scope of video surveillance policy

CCAT operates a video surveillance system to prevent, deter, manage and investigate security and security incidents, as well as for the protection of persons, property (from fires, thefts, burglaries, attacks or any other threat). The video surveillance system supports the achievement of common goals related to security and access, by monitoring specific areas and events. The system is part of the measures to support the security policies of CCAT. The data controller for the video surveillance processing operation is CCAT.

This policy establishes the mechanisms for using the video surveillance system, as well as the measures adopted by CCAT to protect the personal data and privacy of the persons in the CCAT premises and in its immediate vicinity.

The elements of this surveillance policy are applicable in all spaces owned by CCAT.


  1. Ensure the operation of the video surveillance system in accordance with the legal provisions regarding privacy and data protection


3.1. Review of the current system

The procedures of the CCAT company are reviewed periodically, to ensure compliance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of data. of these data and repealing Directive 95/46 / EC (General Data Protection Regulation)


3.2. Compliance

CCAT processes the images in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of these data and repealing the Directive 95/46 / EC (General Data Protection Regulation).


3.3. CCTV system

The CCAT’s Closed-circuit television (CCTV) system can be subjected to periodic risk analysis for each surveillance camera. Based on the analyzes and with the objective of minimizing the monitoring of areas that are not relevant for the purposes envisaged, the location of the rooms and viewing angles can be modified, replaced or confirmed.


3.4. Transparency

The video surveillance policy is available and published on the CCAT website (


3.5. Policy review

The system operator reviews the proportionality of the use of the video surveillance system on the protection of personal data every year. During these periodic reviews, you will appreciate whether:

  • there is still a need for a video surveillance system;
  • the system continues to serve its stated purpose;
  • there are still no suitable alternatives.

The periodic reviews will also cover other issues identified during the system’s operation, especially if CCAT’s video surveillance policy continues to comply with the laws and instructions in force and if it is complied with in practice.


3.6. Technological solutions that respect the privacy

At the orders of new equipment for the system and, as far as possible, CCAT will use the optimal technological solutions, which will meet the standards and the level of the latest available technologies.


  1. The areas under supervision


The location of the surveillance cameras and their viewing angles is based on a risk analysis, ensuring the orientation of the rooms exclusively to the most important areas inside the building.

In order to monitor the entry and exit point of the CCAT premises, a surveillance room is provided.

Areas that are likely to provide a higher degree of discretion, such as offices and leisure facilities, are not monitored. Spaces likely to provide maximum discretion, such as toilets or other similar locations, are never monitored.

There is no video monitoring performed outside the perimeter of the CCAT enclosure.


  1. Categories of personal data collected and the purpose of collecting them


5.1. Technical characteristics of the system

The CCAT video surveillance system is a conventional system. The surveillance camera operates 24 hours / day, 7 days / week. The image quality allows the identification of the persons in the coverage area of the surveillance camera. It records digital images by recording, captured images, as well as time, date and place. We do not use state-of-the-art technology or intelligent video surveillance, we do not interconnect our system with other systems and do not use audio recordings or „CCTV with sound”.


5.2. Purpose of video surveillance

CCAT uses the surveillance system to guarantee security, security and access control. The surveillance system helps control access to the building and ensures the security and safety of buildings, staff and visitors, as well as the goods and documents present or kept in the premises.

The video surveillance system helps prevent, discourage, manage and, if necessary, investigate security and security incidents, potential threats or unauthorized physical access, including unauthorized access to buildings.


5.3. Purpose limitation

The system is not used for purposes other than those mentioned above. For example, it is not used to monitor the presence of employees. The system is also not used as an investigative tool for purposes other than those described above, except in the case of a physical security incident or crime. The records may be transmitted to the investigative bodies in the context of an official disciplinary or criminal investigation.


5.4. Webcams

CCAT does not use webcams for security and security purposes.


5.5. Special categories of data


The CCAT video surveillance system does not aim to collect special categories of data, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or data on health or sexual orientation. However, the system can process special personal health data in the situation where the employees or visitors of the company are visually impaired or persons with physical disabilities (for example, those in strollers or using the access ramp for them). .


The CCTV system monitors the minimum area required to ensure the safety and security of the building. Given the high level of exposure of the CCAT building from a security perspective (the perimeter is easily accessible), the entrance to the CCAT headquarters is provided with a surveillance camera. The purpose of using this camera is not to record or process special categories of data, nor to target an individual, but to be able to prevent, evaluate and investigate security incidents.


The operators of the monitoring systems benefit from regular training on data protection and fundamental rights.


  1. The right of access to information and their beneficiaries


6.1. Internal and external security and maintenance personnel


CCAT manages its video surveillance operations internally.


The video images are accessible exclusively to the employees of CCAT with competencies determined in this regard, based on the principle of need to know.


CCAT will not disclose to anyone the video images, with the exception of the police bodies, the prosecutor’s offices and the courts, at their express request.


The maintenance of the video surveillance system is performed under the supervision of an official with security attributions of the company CCAT.


6.2. The right of access to personal data


CCAT, regarding the video surveillance, establishes and documents who has access to the video surveillance records and / or the technical architecture of the video surveillance system, for what purpose and for what the respective access rights consist. In this regard, CCAT establishes who is entitled:


  • to view the images in real time;
  • to view the recorded images;
  • to copy;
  • download;
  • delete;
  • edit images.

The access rights are established by the decision of the governing bodies of CCAT.


6.3. Training of personnel on data protection


All personnel with access rights, including external security agents and maintenance technicians, receive training on data protection.


6.4. Commitments regarding confidentiality


Personnel with access rights, including external personnel performing CCTV or system maintenance, sign confidentiality commitments to ensure that they do not transmit, display or disclose to anyone in any way the content of video surveillance footage, except authorized recipients.


6.5. Transfers, communications and registries


Information collected as a result of processing of personal data, including CCTV images, may be communicated to judicial or law enforcement agencies to investigate or prosecute criminal acts. These transfers can only be made on request. There are no regular or routine transfers.


  1. Protecting personal data


To protect the security of the video surveillance system as a whole, including personal data, a number of technical and organizational measures are put in place.


All possible technical and physical measures shall be taken to ensure system security and data protection, including:


  • staff (external and internal) sign non-disclosure and confidentiality agreements;
  • users are granted access rights only to those resources that are strictly necessary to carry out their activity (based on the need to know);
  • drawing up an updated list of all the functions / positions that have permanent access to the system and describes their access rights.


  1. Data retention


The period of retention of the images captured by the video surveillance system is 24 hours.


If an image is required to be kept for further investigation or to provide evidence in the event of a security incident, it may be kept for the duration of the investigation and, if necessary, may be archived with the investigation for a period of up to at one year.


  1. Providing information to the public


We provide the public (to the one who enters the company) with information on video surveillance effectively and in detail. To this end, we follow a multilayered approach, which consists of a combination of the following 3 methods:


  • on-site announcements to alert the public (visitors, staff, etc.) about the fact that monitoring is taking place and the provision of essential processing information;
  • the availability of this video surveillance policy at the company headquarters;
  • the availability of this video surveillance policy on the web site of CCAT (, for people who want more details about our company practices regarding video surveillance.


  1. The rights of access, rectification and deletion of personal data


The public has the right to have access to the personal data we hold about them and to correct and complete them. Any request for access, rectification and / or deletion of personal data should be directed to:



Headquarters: Bucharest Sectorul 1, Str. DIONISIE LUPU Nr. 70-72, CORP B, CAM.2


Responsible for the Protection of Personal Data:


We will respond to requests in detail within 30 calendar days. If this is not possible, the applicant shall be informed of the subsequent steps and the reason for the postponement within 30 days. Even in the most complex cases, access or a reasoned final answer will be granted if the request is rejected, within a maximum of 3 months. All measures will be taken to respond earlier, especially if the applicant states that the request is urgent.

If specifically requested, a viewing of the images may be established or the applicant may obtain a copy of the recorded images. In the case of such a request, applicants must declare their identity beyond any suspicion (eg, they must have IDs upon viewing) and, whenever possible, also designate the date, the time, place and circumstances under which the camera was shot. It must also provide a recent self-photograph, which will allow security personnel to identify them in the analyzed images.