1. Introduction

This Privacy Notice concerns the processing of personal data carried out through the video surveillance system, closed-circuit television (CCTV), which operates on the premises of the company “GH SINGLE MEMBER SA and concerns the hotel Olivia Blue Sea Resort, hereinafter referred to as the “Company”.

This Information Notice is addressed to any natural person who may enter or be within the range of the video surveillance system, including, indicatively, guests, visitors, employees, associates, suppliers and other third parties.

The Company respects privacy and the protection of personal data and is committed to processing such data in accordance with the General Data Protection Regulation (EU) 2016/679, Law 4624/2019, Directive 1/2011 of the Hellenic Data Protection Authority on the use of video surveillance systems, as well as Guidelines 3/2019 of the European Data Protection Board on the processing of personal data through video devices.

This Information Notice explains why the video surveillance system operates, what data is collected, for which purposes it is used, for how long it is retained, who may have access to it and what your rights are.

2. Data Controller

The Data Controller for the processing of personal data through the video surveillance system is:

GH SINGLE MEMBER SA

Olivia Blue Sea Resort

Adandou, Rhodes, Greece 85103
Tel.: +30 22410 51900
Email: info@blueseaolivia.gr
Website: https://www.bluesearesorts.gr

As Data Controller, the Company determines the purposes and means of the operation of the video surveillance system and is responsible for ensuring that the relevant processing complies with personal data protection legislation.

3. Data Protection Officer

The Company has appointed a Data Protection Officer, whom you may contact for any matter concerning the processing of your data through the video surveillance system.

Contact email: dpo@bluesearesorts.gr

4. Data Collected

Through the video surveillance system, only image data is collected, namely visual footage from the areas covered by the cameras.

The system:

• does not record sound;
• is not used for biometric identification or facial recognition;
• is not used for automated decision-making;
• is not used for the systematic monitoring of employees’ performance, conduct or efficiency.

5. Purpose of Processing

The video surveillance system operates exclusively for security purposes and for the protection of persons and property.

More specifically, the processing is carried out for:

• the protection of the life, physical integrity and safety of guests, visitors, employees, associates and other persons lawfully present on the premises;
• the protection of the Company’s premises, infrastructure, equipment and property;
• the prevention, deterrence and investigation of security incidents, such as theft, damage, unauthorised access, vandalism, threats against persons or property, fire or any other serious incident;
• access control at selected points of the premises, where this is necessary for security reasons.

The video surveillance system is not used for the general monitoring of persons or for purposes other than those mentioned above.

6. Legal Basis of Processing

The legal basis for the processing is the legitimate interest of the Company, pursuant to Article 6(1)(f) of the General Data Protection Regulation.

The Company’s legitimate interest consists in the need to protect:

• the natural persons present on the premises;
• the premises and infrastructure;
• the Company’s property;
• the property of guests, visitors, employees and third parties;
• the security of the premises and business operations.

The Company has assessed that the use of the video surveillance system is necessary and appropriate for the above purposes, provided that suitable restrictions and privacy protection measures are applied.

7. Restriction and Proportionality of Processing

The operation of the video surveillance system is limited to areas for which a real and documented security need has been assessed.

The Company takes measures to ensure that:

• cameras are placed only at points where video surveillance is necessary for security purposes;
• the capture of images from areas where individuals have an increased expectation of privacy is avoided, to the extent possible;
• areas where video surveillance would be disproportionate are not covered, such as guest rooms, sanitary facilities, changing rooms or other similar private areas;
• clear information is provided through appropriate signage before entering an area under video surveillance;
• access to recorded footage is limited only to authorised persons.

8. Specific Reference to Employees

The operation of the video surveillance system does not aim to monitor employees, assess their performance or control their conduct at work.

Access to recorded footage or the use of footage concerning an employee may take place only where it is connected to a specific security incident or to the need to protect persons or property, and always in accordance with the principle of proportionality and personal data protection legislation.

9. Recipients of the Data

The recorded footage is accessible only to specifically authorised personnel of the Company, to the extent necessary for the performance of their duties and for the security purposes described in this Information Notice.

The footage is not transmitted to third parties, unless this is necessary or legally required. Indicatively, it may be transmitted:

1. a) to competent judicial, prosecutorial or police authorities, where it contains evidence necessary for the investigation of criminal offences or incidents concerning persons or property;
2. b) to competent public authorities, where the data is lawfully requested in the context of the exercise of their duties;
3. c) to a person with a legitimate interest, such as a victim or a person involved in an incident, where the relevant footage may constitute evidence and provided that the rights and freedoms of third parties are protected;
4. d) to technicians or service providers responsible for the maintenance of the system, where this is strictly necessary for technical reasons and provided that they are bound by appropriate contractual obligations of confidentiality and data protection.

10. Retention Period

The recorded footage is retained for a period of fifteen (15) days and is then automatically deleted.

If, during the above period, a specific security incident is identified or reported, the relevant part of the footage may be isolated and retained for a longer period, exclusively for the purpose of investigating the incident and protecting the lawful rights and interests of the Company or third parties.

In such case:

• if the incident concerns the Company, the relevant footage may be retained for up to one (1) additional month;
• if the incident concerns a third party, the relevant footage may be retained for up to three (3) additional months;
• if judicial, administrative or other lawful proceedings have been initiated, the footage may be retained for as long as required for the establishment, exercise or defence of legal claims or for compliance with a legal obligation.

After the expiry of the necessary retention period, the footage is securely deleted.

11. Security Measures

The Company implements appropriate technical and organisational measures for the protection of the data collected through the video surveillance system.

These measures include, indicatively:

• restricted access only to authorised persons;
• use of personal access accounts, where applicable;
• confidentiality obligations for persons who have access to the footage;
• protection of the equipment and areas where the footage is stored;
• limitation of the retention period;
• secure deletion procedures;
• control and restriction of the export or copying of footage;
• cooperation with technical support providers only under terms of confidentiality and data protection.

12. Rights of Data Subjects

In accordance with personal data protection legislation, you have the following rights:

Right of Access

You have the right to be informed whether we process an image concerning you and, where this is the case, to obtain access to the relevant footage or a copy thereof, provided that this is technically feasible and does not adversely affect the rights and freedoms of third parties.

Right to Restriction of Processing

You have the right to request the restriction of processing, for example the non-deletion of specific footage, where you consider that it is necessary for the establishment, exercise or defence of legal claims.

Right to Object

You have the right to object to the processing of your data where such processing is based on the Company’s legitimate interest.

Right to Erasure

You have the right to request the deletion of data concerning you, provided that the legal requirements are met.

The exercise of the above rights does not always entail the immediate deletion of the footage or the satisfaction of the request, particularly where further retention or processing is necessary for security reasons, for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.

13. How to Exercise Your Rights

You may exercise your rights by contacting the Company:

• by email at: dpo@bluesearesorts.gr;
• by letter to the Company’s postal address;
• or by submitting your request in person at the Company’s premises.

In order for us to examine a request concerning your image, you should specify, to the extent possible, the time and place where you were within the range of the cameras. You may also be asked to provide additional information, such as a recent image of yourself or other details, exclusively for the purpose of identification and locating the relevant footage.

The Company will respond to your request within the time limits provided by the General Data Protection Regulation.

14. Right to Lodge a Complaint

If you consider that the processing of personal data concerning you infringes data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

The competent supervisory authority in Greece is:

Hellenic Data Protection Authority
Kifisias 1-3, 115 23 Athens
Tel.: +30 210 6475600
Website: https://www.dpa.gr/

15. Questions or Complaints

For any question, concern or complaint regarding the operation of the video surveillance system or the processing of your data, you may contact the Company or the Data Protection Officer using the contact details set out above.

16. Amendments to this Information Notice

The Company may amend this Information Notice where this is required due to changes in legislation, in the operation of the video surveillance system, in technical and organisational measures or in the Company’s internal procedures.

Each newer version of this Information Notice replaces the previous one and enters into force from the time of its publication or availability.

Date of last update: 12.06.2026