Annex 1: Notification to individuals under Article 13 of the General Data Protection Regulation (GDPR) regarding the processing of personal data and Article 76(4) of the ZVOP-2 in records of the processing of personal data gathered using video surveillance and the video surveillance with automatic number plate recognition system

Controller of the personal data filing system: Fraport Slovenija, upravljanje letališč, d.o.o., Zgornji Brnik 130A, 4210 Brnik – Aerodrom, Slovenia, company registration number: 5142768000, Tel: +386 (0)4 20 61 000, email: info@fraport-slovenija.si

Contact details of the personal data protection officer: Tel: +386 (0)4 206 1440: info.gdpr@fraport-slovenija.si

Purpose of personal data processing:

• video surveillance: purpose – protection of people and property, records contain a recording of the individual, information on the location, date and time of the recording and, where necessary, sound;
• vehicle number plate records: purpose – optimisation and automation of the process, fulfilment of the agreement, filing system contains vehicle number plates.

Legal basis for personal data processing:

• Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract under the provision of Article 6(1)(b) of the GDPR.
• Processing is also necessary for the purposes of the legitimate interests pursued by the controller under the provision of Article 6(1)(f) of the GDPR.

Explanation of legitimate interests: video surveillance is carried out in order to protect people and property; number plate data is necessary in order to automate and optimise the work process and ensure that contractual provisions are met.

Users or categories of users of personal data, if they exist: Users are persons authorised by the controller. Personal data shall not be transferred to third parties except in cases of incidents.

Information on the transfer of personal data to third countries or international organisations: Personal data shall not be transferred to third countries or international organisations.

Period for which personal data is stored, or, if this is not possible, the criteria used to determine that period: Personal data shall be processed until the purpose is met, whereby video footage and consultation of the automated number plate processing system shall be erased within six months at the latest, except in cases of emergency (in which cases the storage period shall last until the emergency is resolved).

Information on the existence of an individual’s right of access to personal data, right of rectification or erasure of personal data and right to restriction of processing, or the existence of the right of objection to processing and the right to data portability: An individual may request access to, completion, rectification, blocking/restriction of processing or erasure of their personal data, object to the processing of data concerning them and request the transfer of data.

Information on the right to file a complaint with the supervisory authority: Complaints may be filed with the Information Commissioner at: Dunajska 22, 1000 Ljubljana, email: gp.ip@ip-rs.si Tel: + 386 (0)1 230 9730, website: www.ip-rs.si.

Information on whether providing personal data is a statutory or contractual obligation or whether the individual is obliged to provide personal data, and what the consequences are of not providing it: The provision of personal data is a contractual obligation that the individual is required to meet. If they fail to meet that obligation, a contract is not possible.

Information on the existence of the automated adoption of a decision on the basis of profiling:

The controller does not carry out the automated adoption of decisions, nor does it profile individuals.

Extraordinary further processing of video footage:

In order to react immediately to an event, the controller may carry out live video surveillance and audio intervention operations.

FRAPORT SLOVENIJA d.o.o.