Data Protection Information Notice on Video Surveillance

Introduction

The purpose of this information notice is to inform you, in a transparent manner, about how CFL multimodal, CFL cargo and their subsidiaries process your personal data in connection with the implementation of video surveillance systems in their premises and on their sites.

This notice is addressed to visitors and to any person present on the relevant sites, including customers, suppliers, agents, legal representatives of customers, as well as staff members and representatives of companies working for each entity.

Data protection notice - Video surveillance

1. Who is the data controller?

Depending on the infrastructure and sites under video surveillance, the data controller is one of the following companies, established and having its registered office at 100, Z.A.E. Wolser E, L-3437 Dudelange, Luxembourg:

• CFL logistics, for video surveillance systems installed inside and outside the Bettembourg-Dudelange warehouses;
• CFL terminals, for video surveillance systems installed on the Bettembourg-Dudelange intermodal terminal and marshalling yard;
• CFL site services, for video surveillance systems installed at the secure road centre and in the Eurohub Sud logistics park.

We are responsible for the way in which we collect, use, share, store and protect your personal data.
 

2. What categories of personal data are processed and for what purposes?

The CFL multimodal group offers a range of freight transport and logistics services, such as combined rail transport, road transport and warehousing, and gives priority to efforts aimed at guaranteeing all its customers the highest possible level of security.

To carry out these missions, we process some of your personal data, such as your image captured by video surveillance, for the following purposes:

• Securing access to premises and sites;
• ensuring the safety of staff, customers and visitors;
• detecting and identifying potentially suspicious or dangerous behaviour likely to cause accidents or incidents;
• accurately identifying the origin of an incident;
• protecting property, including buildings, facilities, equipment, goods, cash, etc.;
• organising and supervising the rapid evacuation of persons in the event of incidents;
• alerting emergency services, fire services or law enforcement authorities in good time and facilitating their intervention;
• carrying out, where necessary, occasional checks to ensure compliance with the safety rules and instructions applicable on the sites;
• preventing, through deterrence, offences against property such as theft, burglary or vandalism, as well as collecting evidence relating to offences observed and finding and identifying the perpetrators.

In all cases, we ensure that the data are collected for specified purposes and that they are processed in an adequate, relevant manner and only to the extent necessary in relation to the purpose pursued.

3. How we collect, process and use your data?

We collect and use the personal data that we obtain through all cameras installed in our buildings and on our sites. For each purpose described above, the collection and processing of your data are:

• carried out in compliance with the applicable regulations relating to the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, known as the General Data Protection Regulation or “GDPR”, as well as the applicable guidelines and national laws implementing the GDPR, where applicable;
• legally based, depending on the purpose pursued, on our legitimate interest or on the performance of a task carried out in the public interest with which we are entrusted.

4. How long do we keep your data?

The retention period for video surveillance images is defined according to the purposes pursued by each relevant Freight entity and the area under video surveillance. The retention periods currently applied are as follows:

• Eurohub Sud logistics park: 9 days;
• Secure road centre: 9 days;
• Logistics warehouses: 20 days;
• Intermodal terminal: 20 days.

In the event of an event or incident being recorded, the relevant images may be retained for an additional period, limited to the time necessary to analyse the event or incident, compile evidence and, where applicable, manage an internal, judicial or insurance-related procedure.

5. Who has access to your data?

The data collected are processed by:

• duly authorised site managers;
• staff authorised to view and extract images.

We ensure that all appropriate technical and organisational measures are taken to protect the security of your personal data, in particular their confidentiality, integrity and availability.
These data are or may be shared with certain internal departments, strictly in accordance with the duties assigned to those departments:

• the staff delegation;
• the Legal and/or Insurance departments;
• the Quality, Safety and Environment department;
• members of Management.

External service providers may have access to certain personal data in the context of maintenance work carried out at the request of the competent departments of the relevant entities. Personal data are not transferred on this occasion.

We contractually require service providers to provide security and confidentiality guarantees for your personal data through appropriate technical and organisational measures in accordance with the regulations.

6. Are your data transferred?

Your personal data may be transmitted by the relevant entities to judicial authorities, the police and insurers for the purposes of establishing an offence, analysing an incident or event, determining liability and, where applicable, taking the necessary follow-up action.

Your personal data may be transmitted by the relevant entities to judicial authorities, the police and insurers, where necessary, for the purposes of establishing an offence, analysing an incident, determining liability and, where applicable, taking the necessary follow-up action.

7. What are your rights regarding your personal data?

Under the conditions provided for by the regulations, you have the right to:

• access the personal data that we hold about you;
• request, in certain cases, the erasure of your data, in particular where they are no longer necessary in relation to the purposes for which they were collected or processed;
• request the restriction of the processing of your personal data, in particular for the period necessary to examine a request relating to those data;
• object to the processing of your personal data, on grounds relating to your particular situation, where the processing is based on the legitimate interest of the relevant entities or on the performance of a task carried out in the public interest.

8. How can you contact us and exercise your rights?

You may send any questions relating to the processing of your personal data and/or exercise the rights mentioned above:

• by post: for the attention of the Data Protection Officer (DPO), 100, Z.A.E. Wolser-E, L-3437 Dudelange; or
• by email: DPO@cfl-mm.lu

In the interest of confidentiality and data protection, we may verify your identity before providing the requested information. Given the nature of video surveillance processing, we may also ask you to provide additional information necessary to identify the images concerning you, such as the date, approximate time, location concerned or event to which your request relates.

Any complaint relating to the processing of your personal data may be sent to the email or postal address above, or to the supervisory authority of the Grand Duchy of Luxembourg, the Commission Nationale pour la Protection des Données – CNPD, 15, Boulevard du Jazz, L-4370 Esch-sur-Alzette – www.cnpd.public.lu. 

9. How do we update this information notice?

In order to comply as fully as possible with the regulations in force, we undertake to update this information notice whenever necessary.

The latest version in force is published on our website: www.cfl-mm.lu. This notice is available in several languages. In the event of any discrepancy or difficulty of interpretation between the different language versions, the French version shall prevail.