video surveillance

pursuant to art. 13 of (EU) Regulation 2016/679 (GDPR), the § 7 EDPB Guidelines 3/2019 and the General Decision of the Italian Data Protection Authority of 8 April 2010 on video surveillance

**1. Subject **

With this privacy policy statement, which supplements the content of the simplified privacy policy statement referred to in Article 3 below, - in compliance with the provisions of article 13 of the GDPR, the § 7 EDPB (European Data Protection Board) Guidelines 3/2019 on video devices and the General Decision of the Italian Data Protection Authority of 8 April 2010 on video surveillance - we hereby inform you about the processing of your personal data, acquired and processed through the video surveillance systems in operation at C&P srl socio unico outlets, in accordance with all applicable legislation on the protection of personal data.

**2. Data controller and Data protection officer **

The Data Controller is C&P srl socio unico (hereinafter also the “Data Controller”), in the person of its legal representative pro tempore (hereinafter the “Company”), which can be contacted in writing at postal address via Modena 53, postcode 41014, Castelvetro di Modena (MO) or by email at info@wagamama.it.

3. Simplified privacy policy statement pursuant to the § Guidelines 3/2019

Video surveillance zones are indicated with appropriate signage, in accordance with the § 7.1 Guidelines 3/2019, clearly visible in all ambient lighting conditions, where the intended purposes are also stated. These signs are located out of range of the cameras. 4. Categories of data processed Your personal data pocessed by our company through the use of video surveillance systems consists of images that may depict you when you are within the range of the cameras.

**5. Purpose of processing **

The video surveillance systems were installed for the following purpose: • to protect company assets.

6. Legal basis of processing

Video surveillance activities are based on the Company’s legitimate interest, pursuant to Art. 6(1)(f) GDPR, in carrying out the processing for the purposes set out in Section 5 of this policy.

**7. Data processing procedures **

Data processing is carried out through the recording of images. Only authorised persons, with appropriate GDPR training and bound by confidentiality agreements, may use the systems and view the recordings in cases where this is essential for the stated purposes.

8. Categories of subjects to whom the data may be communicated

The images may be communicated to subjects who, if strictly provided for by law, may access the data in accordance with legal provisions, within the limits provided for by said provisions (e.g. police forces and competent authorities in the event that crimes have been committed). In any event, the images will not be disseminated or, with the exception of the case indicated above, communicated to third parties.

For the purposes of the efficiency and maintenance of the systems, C&P srl socio unico outsources specialist companies (duly appointed as Data Processors and whose names may be requested at the outlet of interest) to perform routine maintenance activities and technical services based on the indications of the Data Controller, as supplier of the video-surveillance system and/or of the image recording management software. Maintenance work is carried out in the presence of a C&P srl socio unico employee.

9. Data transfer outside the EU

The images will be processed at the store/head office of C&P srl socio unico and are not transferred outside the European Union.

10. Image retention

Images are retained for a maximum of twenty-four hours after recording at a workstation located in each C&P srl socio unico outlet. This is subject to special requirements whereby the images are retained for longer periods due to festivities or the closure of the store, or situations in which specific requests have been made by investigating judicial or judicial police authorities. The company has carried out a privacy impact assessment pursuant to Article 35 of the GDPR. The system used is programmed to automatically delete the images.

11. Rights of the data subject

The data subject may exercise the rights established by articles 15-22 of the GDPR (e.g. right of access, right to erasure, right to restriction). Requests to exercise the aforementioned rights must be made directly to the C&P srl socio unico outlet by writing to info@wagamama.it .

12. Automated decision-making

Under no circumstances will your data be used to obtain information about your preferences or behaviour, nor will you be subject to any decision based solely on the automated processing of your personal data.

13. Complaints

The data subject has the right to lodge a complaint with the Data Protection Authority (whose contact details can be found at www.garanteprivacy.it) in the event of unlawful processing or the delayed response of the Data Controller to a request inherent to the rights of the data subject. This privacy policy statement is displayed on the premises and published on the website and may be supplemented with further indications, also in consideration of regulatory changes or measures by the European Commission or the Italian Data Protection Authority.