1. Purpose of using cameras
1.1. The office building (Tartu mnt 80, Tallinn) (hereinafter Media House) of Postimees Grupp AS (hereinafter Postimees Group) is equipped with video cameras on the grounds of a legitimate interest under the General Data Protection Regulation. Video recording shall be carried out for the following purposes: safeguarding the security of employees and visitors, protection of property, defense and submission of claims, processing video recordings for journalistic purposes.
1.2. Postimees Group has conducted an assessment of legitimate interest for lawful processing of camera recordings as data.
1.3. Video cameras shall record around the clock and only in case motion is detected, no sound shall be recorded.
1.4. Video camera footage can also be monitored in real-time by a security guard. It is not possible to monitor live video camera footage outside the Media House.
1.5. Persons shall be informed of entry into areas of video surveillance through information labels showing an image of a camera along with the text „VIDEOVALVE“ (VIDEO SURVEILLANCE), an explanation of the grounds for and objectives of data processing, and a reference to the general principles of personal data processing by Postimees Group as the data controller, including a reference to these Guidelines.
2. Processing and transfer of recordings
2.1. Postimees Group shall store and process video camera recordings as their data controller. Access to video recordings shall be provided to persons designated by Postimees Group based on organisational needs and objectives of video recording. The list of designated persons has been submitted to the security company.
2.2. Under this procedure, the video recordings shall be downloaded, recorded, and prepared for transfer by a security guard of the security company acting as a data processor. This operation shall take place if a person designated in clause 2.1 sends a relevant e-mail to a contact person of the security company, who in turn submits the relevant instructions to a security guard.
2.3. To guarantee the possibility of further data processing in the future, the security guard shall upload the recording to a server of Postimees Group following the procedure set out in clause 2.2, which enables the identification of the date, location, and the desired period.
2.4. Video recordings shall be stored on the server for 10 days and on the hard drive of the recording device for up to one month. If no retention requests are received, the recordings on the storage device shall be erased automatically and cannot be recovered or issued thereafter.
2.5. The employees designated by Postimees Group shall have the right to process video recordings for purposes set forth in clause 1.1.
3. Transfer of video recordings to third parties
3.1. Generally, Postimees Group does not transfer video recordings to any third parties. Postimees Group may transfer video recordings:
3.1.1. to an (investigative) body designated by law;
3.1.2. to natural persons in the scope of their personal data, as well as to a legal representative of a natural person in the scope of the personal data of the person they are representing (e.g. personal data on minors to their legal representative).
3.2. Transfer of recordings shall take place upon request. No automatic data transfers shall take place.
3.3. Recordings cannot be issued if the request has been submitted after the automatic erasure of data or in case the operation of video cameras had been stopped at the requested time.
3.4. Loading video footage from a recording device of a video camera shall take place only at the office building of Postimees Group in Tallinn.
4. Procedure for issuing recordings to (investigative) bodies
4.1. To obtain recordings, the body requesting the data shall submit a digitally signed written request to Postimees Group. The request shall be submitted to the e-mail address isikuandmed@postimeesgrupp.ee and the data protection official of Postimees Group shall forward the request to the assistant of the board. The assistant of the board shall, in turn, forward the requests to the security company for fulfillment.
4.2. The signed request shall indicate the name of the requesting body, the full name of the official who submitted the request, and the email address of the body, which makes it possible to verify whether the request was submitted by an official of the relevant body or not. Additionally, the request shall indicate the date and period of the recordings being requested for review.
5. Procedure for issuing recordings to natural persons
5.1. Any person has the right to receive personal data pertaining to themselves, including the recordings of video cameras, from Postimees, the personal data processor.
5.2. To obtain recordings, the person requesting the data shall identify themselves. To this end, Postimees Group requires the submission of a relevant signed written request to the e-mail address isikuandmed@postimeesgrupp.ee.
5.3. The digitally signed request should indicate the name and personal identification code of the person submitting the request, as well as the date and time of the recordings being requested and the grounds for the request.
5.4. If the person does not submit a digitally signed request, then, in order to issue a recording, Postimees requires the person to verify their identity by providing an identity document based on which Postimees Group can unmistakably verify that the person submitting the request is the same as the person for whom the transfer of personal data is being requested (verification that the identity of the person in the photo of the identity document and the person on the video recording is the same).
5.5. When requesting access to the personal data of another person, the requester shall prove their right of representation by submitting documents proving the right of representation with their request, so that Postimees Group can unmistakably verify that the person submitting the request is the same as the person for whom the transfer of personal data is sought.
5.6. Postimees Group has the right to request additional data for identify verification and to refuse the transfer of video recordings until the identity has been verified.
5.7. When issuing a recording to a private person (i.e. not to an (investigative) body), the security guard shall ensure that no other person is identifiable on the recordings. Additionally, a third party identifiable by their unusual clothing, unusual physical characteristics, unusual baggage or any other individual characteristic shall be blurred should such a situation arise.
5.8. Should a person find that an offence has been committed against them, the person shall submit a relevant request to a corresponding competent authority (Police and Border Guard Board), who shall submit a request to obtain the recordings to Postimees Group.
6. General rules for issuing recordings
6.1. In case a request for a release of a recording has been erroneously submitted to another e-mail address of Postimees Group, the recipient shall forward it to the assistant and, for informational purposes, to isikuandmed@postimeesgrupp.ee.
6.2. After receiving a request from the assistant, the security guard shall, if necessary, identify any additional data necessary for finding the video recording (location, departure time, etc.). After identifying the recording requested by the requester, the security guard shall send it to isikuandmed@postimeesgrupp.ee and to the assistant who shall organise the transfer of the recording to the requester. Should the recordings be large and thus impossible to send to the requester by e-mail, access to the recordings shall be provided by other secure means of Postimees Group.
6.3. It is prohibited to send recordings to external addresses of general e-mail service providers (e.g. gmail.com, hotmail.com, mail.ru, yandex.ru, etc.) unless a written request has been submitted by a competent person of the requesting body for issuance to that address.
7. Contact person for matters related to personal data protection:
7.1. Please submit all questions related to the processing of personal data isikuandmed@postimeesgrupp.ee.