Video Surveillance Privacy Notice

This information notice on the processing of personal data is provided pursuant to Article 13 of the EU Regulation 2016/679 on the “Protection of individuals with regard to the processing of personal data and on the free movement of such data” and ss.mm.ii. (hereinafter, “Regulation” or “GDPR”), in order to inform you that, as part of the video surveillance activities of the buildings and areas owned or used by Fondazione Human Technopole (hereinafter, “HT” or the “Fondazione”), the latter manages a series of personal data relating to your person.

The personal data you provide in the context of video surveillance activities are processed by HT in accordance with the aforementioned Regulation and in the manner set out in the information notice below.

All areas in which video surveillance systems are installed are identified by means of signs with simplified information.

1. Identity and contact details of the Data Controller

The Data Controller of your personal data is Fondazione Human Technopole, with registered office in Viale Rita-Levi Montalcini 1, 20157, Milan (MI), Italy, Tel. +39/02-30247001, e-mail: [email protected]

2. Contact details of the Data Protection Officer

The Data Protection Officer (DPO) of the Fondazione Human Technopole can be reached at the following e-mail address: [email protected]

3. Purpose and legal basis of processing

The processing of your personal data by HT will take place exclusively for the pursuit of the purposes of safety at work and protection of HT’s assets.

The legal basis for the processing is the legitimate interest of the Data Controller under Article 6(1)(f) GDPR.

4. Category of data processed

HT will process the following categories of data relating to your person: images recorded by video cameras placed in buildings and areas owned or used by HT and number plates of vehicles that may pass through or stop in the areas filmed by the cameras.

5. Nature of processing and obligatory nature of providing data

The simplified notice is placed before access to buildings and areas subject to video surveillance.

6. Methods of processing

Your data will be processed by means of analogue and digital devices that allow images to be recorded and displayed by operators, in compliance with data protection regulations. Your data will only be processed by adequately trained and expressly authorised personnel.

The display and storage devices will be protected by security measures appropriate to the risk.

7. Categories of recipients of personal data

For the purposes set out in this notice, the personal data you provide may be disclosed to persons appointed by HT as Data Processors for the performance of the activities necessary in connection with the above-mentioned purposes.

Furthermore, HT’s obligation to disclose the data to the Judicial Authorities whenever a specific request is made in this regard, as well as to other authorities and subjects when necessary for the fulfilment of obligations provided for by law, remains unaffected.

8. Transfer of data outside the European Economic Area

Should your personal data be processed in a country outside the European Economic Area (EEA), HT will ensure that appropriate precautions are taken to ensure that your personal data is adequately protected in accordance with the levels of protection guaranteed by EU law, by applying one of the appropriate safeguards set out in Articles 44-50 of the Regulation.

9. Data retention

The recorded images are kept only for the period of time strictly necessary to fulfil the above-mentioned purposes. In any case, the maximum retention period identified by the Data Controller is 72 hours from the collection of the images, without prejudice to special needs for further retention, such as, for example, following a request by the Authorities or the Judicial Police or in the event of protection of the rights of the Data Controller or of third parties.

At the end of this period, the data collected are automatically deleted from the electronic, computer or magnetic media on which they are stored.

10. Rights of the data subject

Subject to conditions and possible limitations under applicable law, you may exercise your rights under Articles 15 et seq. of the Regulation at any time by contacting the Data Controller at the addresses given in point 1 of this notice.

In particular, as a data subject, you may request:

1. access to your personal data;
2. rectification of your personal data;
3. the deletion of your personal data;
4. the restriction of the processing of your personal data;
5. the portability of your personal data.

11. Complaint to the Control Authority

Pursuant to Article 77 of the Regulation, you have the right to lodge a complaint with the Supervisory Authority (Garante per la Protezione dei Dati Personali) if you consider that the processing concerning you violates the provisions of the Regulation.

Milan, 10/06/2025