Annex 1: Notification to individuals under Article 13 of the General Data Protection Regulation (GDPR) regarding the processing of personal data and Article 76(4) of the ZVOP-2 in records of the processing of personal data gathered using video surveillance and the video surveillance with intelligent video analytics system

Controller of the personal data filing system: Fraport Slovenija, upravljanje letališč, d.o.o., Zgornji Brnik 130A, 4210 Brnik – Aerodrom, Slovenia, company registration number: 5142768000, Tel: +386 (0)4 20 61 000, email: info@fraport-slovenija.si

Contact details of the personal data protection officer: Tel: +386 (0)4 206 1440: info.gdpr@fraport-slovenija.si

Purpose of personal data processing:

• to protect the controller’s property;
• to ensure the safe flow of air traffic and the safe handling of aircraft, resulting in an increase in air traffic safety and airport operation and the resolution of incidents or accidents.
• to optimise aircraft ground handling processes.

Legal basis for personal data processing:

• Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract under the provision of Article 6(1)(b) of the GDPR.
• Processing is also necessary for the purposes of the legitimate interests pursued by the controller under the provision of Article 6(1)(f) of the GDPR.

Explanation of legitimate interests: video surveillance is carried out in order to protect property; data from intelligent video analytics is necessary in order to optimise aircraft ground handling processes and ensure that aircraft are handled safely and, consequently, that air traffic flows in a safe manner.

Users or categories of users of personal data, if they exist: Users are persons authorised by the controller. Personal data shall not be transferred to third parties except in cases of incidents.

Information on the transfer of personal data to third countries or international organisations: Personal data shall not be transferred to third countries or international organisations.

Period for which personal data is stored, or, if this is not possible, the criteria used to determine that period: Personal data shall be processed until the purpose is met, whereby video footage and consultation of the intelligent video analytics system shall be erased within 30 days at the latest, except in cases of incidents (in which cases, the storage period shall last until the incident is resolved).

Information on the existence of an individual’s right of access to personal data, right of rectification or erasure of personal data and right to restriction of processing, or the existence of the right of objection to processing and the right to data portability: An individual may request access to, completion, rectification, blocking/restriction of processing or erasure of their personal data, object to the processing of data concerning them and request the transfer of data.

Information on the right to file a complaint with the supervisory authority: Complaints may be filed with the Information Commissioner at: Dunajska 22, 1000 Ljubljana, email: gp.ip@ip-rs.si Tel: + 386 (0)1 230 9730, website: www.ip-rs.si.

Information on whether providing personal data is a statutory or contractual obligation or whether the individual is obliged to provide personal data, and what the consequences are of not providing it: The provision of personal data is a contractual obligation that the individual is required to meet. If they fail to meet that obligation, a contract is not possible.

Information on the existence of the automated adoption of a decision on the basis of profiling:

The controller does not carry out the automated adoption of decisions, nor does it profile individuals.

Extraordinary further processing of video footage:

The controller does not engage in the further processing of video footage.

FRAPORT SLOVENIJA d.o.o.