Data Protection Information Notice on Video Surveillance

Introduction

The purpose of this information notice is to inform you in a transparent manner about the way in which CFL multimodal, CFL cargo and their subsidiaries process your personal data for the implementation of video surveillance on our premises or sites with regard to visitors and persons present (i.e. our customers, suppliers, agents, legal representatives of a customer or the staff and representatives of the companies of each entity).

1. Who is the data controller?

The data controller differs depending on the infrastructure and the sites under video surveillance. The data controllers are CFL multimodal, CFL logistics, CFL terminals, CFL site services established and having their registered office in at 100, Z.A.E Wolser E, L- 3437 Dudelange.

We are responsible for how we collect, use, share, store and protect your personal data.

2. What categories of personal data are processed and for what purposes?

The CFL multimodal group offers a range of freight services in transport and logistics such as combined rail transport, road transport, warehousing and prioritizes efforts to ensure the highest possible level of security for all its customers.
In order to carry out these tasks, we process some of your personal data such as your image from video surveillance in order to:

• secure access to premises and sites;
• ensure the safety of staff, customers and visitors;
• detect and identify potentially suspicious or dangerous behaviour which could lead to incidents or accidents;
• pinpoint the origin of an incident;
• protect property (buildings, facilities, equipment, goods, cash, etc.)
• organize and supervise the rapid evacuation of people in the event of incidents;
• alert the emergency services, fire brigade or law enforcement agencies in good time and facilitate their intervention;
• prevent, through the effect of dissuasion, damage to property such as theft, burglary or vandalism, gather evidence relating to the offences committed, and find and identify the perpetrators.

In any event, we ensure that the data are collected for specific purposes and that they are processed in an adequate and relevant manner and only for what is necessary for the purpose in question.

3. How we collect, process and use your data.

We collect and use the personal data we obtain from all the cameras installed in our buildings and on our sites. For each of the afore described purposes, your data are collected and processed:

• in accordance with the applicable regulations on the protection of personal data including the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the Guidelines thereto and national laws implementing the GDPR where applicable,
• on the basis of our recognized legitimate interest or as necessary for the performance of a public interest task entrusted to us.

4. How long do we keep your data?

The images from video recordings are kept depending on the location for a period of 9 days up to a maximum of 30 days, except in the event of incidents, offences or legal proceedings.

5. Who has access to your data?

The data collected are processed by:

• duly authorized site managers;
• personnel authorized to consult and extract images.

We take all appropriate technical and organizational measures to protect the security thereof and primarily their confidentiality, integrity and availability.
These data are or may be shared with some of our internal departments in strict compliance with the assignments entrusted to them;

• the personnel delegation;
• the Legal and/or Insurance departments;
• the Quality, Safety, Environment Department;
• the members of Management.

External service providers may have access to certain personal data for maintenance work carried out at the request of the competent departments of the CFL multimodal group. Personal data are not transferred on this occasion.
We contractually impose on service providers guarantees of security and confidentiality of your personal data by means of appropriate technical and organizational measures in accordance with the regulations.

6. Are your data transferred?

Your personal data may be transmitted by the CFL multimodal group to the judicial authorities and the police and to insurers for the purpose of establishing an offence and, if necessary, taking the necessary action.

7. What are your rights with regard to your personal data?

In accordance with the regulations, you have the right to:

• access the recordings,
• lodge a complaint with the competent authority for the protection of personal data in your country and/or in the Grand Duchy of Luxembourg (Commission Nationale Pour la Protection des Données – CNPD [National Data Protection Commission], 15 Boulevard du Jazz, L-4370 Esch-sur-Alzette – www.cnpd.public.lu).

8. How to contact us and how to exercise your rights.

You can address your questions concerning the processing of your personal data and/or the exercise your aforementioned rights:   

• by post: for the attention of the Data Protection Officer (DPO), 100 Z.A.E. Wolser-E, L-3437 Dudelange, or
• by e-mail: DPO@cfl-mm.lu

In the interests of confidentiality and data protection, we shall ascertain your identity before issuing the requested information.
 

9. How we update this information notice

In order to comply with the regulations in force, the CFL multimodal group undertakes to update this information notice as and when necessary.

The latest version is the one posted on the CFL multimodal group website (www.cfl-mm.lu).