Information Notice on Video Surveillance

The purpose of this information notice is to provide information about the way in which video surveillance footage is processed by Banque et Caisse d’Epargne de l’Etat, Luxembourg (hereinafter 
“Spuerkeess”), which has its registered office at 1, Place de Metz, L-1930 Luxembourg, with regard to the persons concerned (customers, visitors, employees, external service providers, suppliers, etc.) at Spuerkeess’ interior and exterior premises. 

All processing of your data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“GDPR”), which came into force on 25 May 2018.

Contact details of the data controller:

Banque et Caisse d’Epargne de l’Etat, Luxembourg (“Spuerkeess”)
1, Place de Metz,
L-1930 Luxembourg
Tel.: (+352) 4015-1

Website: www.spuerkeess.lu

Our premises are under video surveillance to ensure the safety of people and property. Its purpose is to:

• Secure access to Spuerkeess premises;
• Ensure the safety of Spuerkeess personnel, customers, visitors, service provider personnel and suppliers;
• Detect and identify potentially suspicious or dangerous behaviour likely to cause accidents or incidents;
• Determine the origin of an incident;
• Protect Spuerkeess’ property (buildings, facilities, equipment, money, etc.);
• Be able to eliminate any doubt in the event of an alarm, fire or break-in;
• Organise and supervise the rapid evacuation of people in the event of an incident;
• Be able to alert law enforcement or emergency services in a timely manner in the event of an aggression, or other offenses or accidents and facilitate their intervention.

The processing of footage captured by video surveillance is based on Spuerkeess’ legitimate interest in the safety of people and property, in accordance with article 6, (1) (f) of the GDPR. 

In addition to the aforementioned legitimate interests, video surveillance is also necessary for the safety and health needs of Spuerkeess staff in accordance with article L.261-1 of the Luxembourg Labour Code.

The categories of personal data processed are as follows:

• Video surveillance footage of people visiting Spuerkeess’ premises, sites and facilities;
• Place, date and time of the recordings.

The footage is intended exclusively for:

• Authorised personnel of Spuerkeess (e.g. services in charge of the protection of property and persons, legal services);
• Subcontractors in accordance with the regulations and solely for the purposes of their services in terms of safety and maintenance;
• The judicial or police authorities, if necessary.

Video surveillance data remains in Luxembourg in the European Union and is not transferred to third countries.

The video surveillance footage is stored for a maximum period of 30 days. At the end of this period, it is automatically deleted, except in the event of an incident related to the safety of property and/or persons, an offence or legal proceedings in progress, in which case the footage may be extracted and kept for the time necessary to resolve the incident or dispute.

The retention period can be justified due to Spuerkeess’ banking activity (e.g. presence of cash, securities and other documents or valuables). This brings with it a significant risk of harm to persons and property, as well as the need to have sufficient time to be able to trace and investigate in a professional manner criminal activities, incidents or claims (e.g. fraudulent or criminal use of means of payment, theft or misappropriation of funds, location survey for burglary or other criminal operations, assault or armed robbery, damage).

Spuerkeess puts in place appropriate technical and organisational measures to ensure the security and confidentiality of data collected by video surveillance. 

When Spuerkeess carries out video surveillance, the persons concerned are informed of this surveillance via information signs and pictograms in the places subject to surveillance, in addition to this video surveillance information notice which is available on our website (www.spuerkeess.lu).

Regarding Spuerkeess staff, specific video surveillance provisions may apply to certain monitored premises in exceptional cases due to the risks inherent in the professional activities carried out. The employees concerned are informed by means of specific information communicated via internal channels (intranet).

In accordance with the GDPR, you have the following rights in relation to your personal data:

• the right to access your personal data and, where applicable, to obtain a copy of such data;
• the right to request the rectification or updating of your personal data, if you believe it is incomplete or incorrect;
• the right to have your personal data erased, unless there is a legitimate reason to keep it;
• the right to object, at any time, to the processing of your personal data, together with an ability to opt out, unless a legitimate reason takes precedence over your interests and rights and freedoms;
• the right to request restrictions on the processing of your personal data;
• the right to the portability of certain personal data, i.e. the right to receive it in a structured, commonly used, readable format so that it may be sent to another data controller.

To follow up on your exercising these rights, Spuerkeess may ask you to specify, before any data is provided, the data/processing operations/period and/or precise location to which your request relates.

In the interests of confidentiality and data protection, Spuerkeess must be sure of your identity before it can respond to your request. Any request not submitted via S-net must therefore be accompanied by a copy of an identity document.

Spuerkeess reserves the right to reject the request if it is unable to definitively identify you or if it deems the request to be excessive or unfounded. You will be notified of the reasons for its rejection within one month of receipt of the request. Spuerkeess may also require the payment of reasonable fees in the event that a request is unfounded or excessive, especially if it is repetitive in nature.

To exercise these rights, you may contact the data protection officer at the address given in point 10 below. 

If you are not satisfied with how we deal with your request, you have a right to lodge a complaint with the Commission Nationale pour la Protection des Données (CNPD), 15, Boulevard du Jazz, L-4370 Belvaux, via post or at the following website: https://cnpd.public.lu.

For any questions relating to this information notice or the exercise of your rights concerning your personal data, you may contact the Data Protection Officer, by S-Net message, email or post at the following address:

Banque et Caisse d’Epargne de l’Etat, Luxembourg
Data Protection Officer
1 Place de Metz
L-2954 Luxembourg

dpo@spuerkeess.lu

This information notice may be updated regularly to best protect your personal data and to reflect legislative and regulatory changes.

The most recent version is available on the Spuerkeess website (www.spuerkeess.lu).