CCTV Privacy Notice – Elekta UK – Cornerstone
1. Introduction
This Privacy Notice explains how Elekta uses Closed-Circuit Television ("CCTV") at and around its premises identified in section 7 of this Privacy Notice.
It applies to individuals who may be captured by CCTV footage, including employees and visitors to Elekta premises, contractors, suppliers, agency staff, members of the public in the vicinity of Elekta buildings, and children who may be incidentally captured.
There is a separate Privacy Notice for Elekta employees.
Elekta is committed to protecting personal data and complying with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
2. Data Controller
The data controller is:
Elekta Limited
Cornerstone, London Road
Crawley, West Sussex RH10 9BL
United Kingdom
For questions about this notice or how personal data is processed, please contact:
Elekta Data Privacy Team
Email: privacy@elekta.com
3. Purpose of CCTV Monitoring
Elekta operates CCTV for the purposes of ensuring the safety and security of people on or near its premises, protecting buildings, equipment and other property, monitoring and controlling access to sites, and preventing, detecting and investigating crime.
CCTV is not used for marketing purposes and is not used for routine monitoring of individuals.
4. Personal Data Collected
CCTV may capture video footage and still images of individuals, images of vehicles and vehicle registration numbers, and associated date, time and location data.
CCTV does not record sound and is not used for facial recognition or other biometric identification.
5. Children’s Data
CCTV may incidentally capture images of children, for example where children accompany visitors or pass around Elekta premises or enter them unlawfully.
Elekta does not deliberately target children with CCTV and processes such data only for the purposes set out in this notice.
6. Legal Basis for Processing
Elekta processes personal data captured by CCTV on the basis of its legitimate interests under Article 6(1)(f) UK GDPR.
These interests include maintaining a safe and secure environment, protecting people and property, and preventing and investigating criminal activity.
Where relevant, processing may also be necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
7. Operation of CCTV
CCTV cameras are installed around the Cornerstone campus in 25 separate locations, capturing entrances and walkways of the Cornerstone Building (London Road, Crawley, West Sussex, RH10 9BL) only.
No camera captures footage of employee workspaces.
Appropriate signage is displayed at the site.
Cameras are not installed in areas where individuals would reasonably expect privacy, such as toilets or changing facilities.
Access to live feeds and recordings is restricted to authorised personnel including Elekta’s outsourced provider(s) for Facilities and Security services.
8. Access to CCTV Footage
Access to CCTV footage is limited to authorised Elekta personnel with a legitimate need, such as security, facilities, health and safety, HR or Legal teams (including Elekta’s outsourced provider(s) for Facilities and Security services).
Footage may be shared with law enforcement authorities, insurers or professional advisers where lawful and necessary.
Third-party suppliers supporting CCTV systems act as data processors and are required to process personal data only in accordance with Elekta’s instructions and applicable data protection law.
The current sub-processors are:
(i) CBRE Limited, 61 Southwark Street, London, SE1 0HL
(ii) Pafi Limited, Robin Hill Farm, Lower Basildon, Reading, RG8 9NZ
9. Retention
CCTV footage is retained for a period of 30 days and is automatically deleted unless required for investigating an incident, responding to a lawful request, or legal proceedings.
10. International Transfers
CCTV footage is normally stored and accessed within the UK.
Where footage is transferred outside the UK, appropriate safeguards will be applied in accordance with UK GDPR.
11. Your Rights
Individuals have rights under UK GDPR including the right to request access to personal data, to request correction or deletion in certain circumstances, to restrict or object to processing, and to lodge a complaint with the Information Commissioner’s Office.
Requests can be made by contacting privacy@elekta.com.
12. Complaints
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Website: https://www.ico.org.uk
Telephone: 0303 123 1113