POLICY on the processing of personal data when using the closed - circuit television system at JSC Belagroprombank

APPROVED
Order of the Chairman of the Board of
JSC Belagroprombank 05.05.2023 No. 326

POLICY on the processing of personal data when using the closed - circuit television system at JSC Belagroprombank

1. This Policy on the processing of personal data when using the closed - circuit television system at JSC Belagroprombank (hereinafter referred to as the Policy) was developed in accordance with the Law of the Republic of Belarus dated 05/07/2021 No. 99-Z “On the Protection of Personal Data” (hereinafter referred to as Law No. 99-Z), other legislative acts in order to explain to the personal data subjects the purposes of processing their images captured on the camera(s) of the closed – circuit television system of JSC Belagroprombank (hereinafter referred to as the bank) and reflects the rights of the personal data subjects in this regard and the mechanism for their implementation.
 

2. The policy is publicly available and is posted on the bank’s official website on the global computer network Internet: https:// www.belapb.by.
 

3. The functioning of the closed circuit television system (hereinafter referred to as CCTV) in the bank is carried out in order to protect the bank’s property from unlawful attacks in accordance with the Law of the Republic of Belarus dated November 8, 2006 No. 175-Z “On security activities in the Republic of Belarus”, as well as activities in accordance with paragraph twentieth of Article 6 and paragraph 1 of Article 17 of Law No. 99  Z for the protection of processed personal data, information containing secrets protected by law, information constituting state secrets.
 

4. CCTV – a closed-circuit television system designed to receive television images (with or without sound), service information and alarm notifications from bank facilities. CCTV is an element of the bank's overall security system.
 

5. Received TV image:
 

5.1. used in the following purposes:

•    ensuring the safety of the bank's property, including suppression and minimization of material damage to the bank's property;
•    creating conditions to ensure the personal safety of personal data subjects;
•    implementation of legislative norms in the field of administrative and (or) criminal proceedings;
•    to maintain the internal control system in the bank in proper condition, resolve conflict situations, monitor the legality of the actions of bank employees.

5.2. Not used for:

•    unique identification of persons depicted on surveillance video (video archives);
•    sound recording, with the exception of negotiations between cashiers and consultants with clients, cashiers with collectors and when working with valuables, security department specialists with clients at security posts.

6. The operation of CCTV is carried out continuously using cameras without facial recognition function and is not aimed at collecting information about a specific personal data subject. Information about surveillance video is carried out by placing special information signs. There is no surveillance video in premises intended for personal needs of employees. The storage of video recordings is limited in time depending on the purpose of the CCTV object and is automatically deleted after the expiration of the storage period.

7. If information about the possible recording by cameras of a situation that has signs of an administrative offense or a criminal offense is received, then by decision of the head of the authorized division of the bank or the person performing his duties, the storage period for such video recordings may be extended for the period of the relevant activities.

8. Surveillance video (video archives) of the CCTV of bank facilities can be used as evidence in civil, administrative and criminal proceedings to confirm the fact (facts) of the commission of an unlawful act, as well as to establish other circumstances to be proven.

9. Surveillance video (video archives) of the CCTV of bank facilities cannot be used by bank employees for personal or other purposes not related to professional activities, and are not subject to modification, use, distribution and provision, except in cases provided for by legislative acts.

10. The personal data subject has the right:

10.1. to receive information regarding the processing of their personal data in the bank, containing:
•    confirmation of the fact of processing the personal data of the person applying to the bank;
•    his personal data and information about the source of their receipt;
•    legal grounds and purposes of processing personal data;
•    other information provided by law.
When the personal data subject exercises the right specified in this subclause, the personal data subject is not provided with surveillance video (video archives), except in cases provided for by law.

10.2. to obtain information about providing his personal data processed in the bank to third parties. This right can be exercised once a calendar year, and the provision of relevant information is free of charge;

10.3. to appeal actions (inaction) and decisions of the bank that violate his rights when processing personal data to the authorized body for the protection of the rights of personal data subjects in the manner established by the law on appeals of citizens and legal entities.

11. To exercise his rights related to the processing of personal data in the bank, the personal data subject submits an application to the bank in writing (by hand, by post) or in the form of an electronic document.

12. In accordance with paragraph 2 of Article 14 of Law No. 99-Z, the application must contain:
•    surname, first name, patronymic (if any) of the personal data subject, address of place of residence (place of stay);
•    date of birth of the personal data subject;
•    identification number of the personal data subject, in the absence of such a number - the number of the document identifying the personal data subject, in cases where this information was indicated by the personal data subject when giving his consent to the operator or the processing of personal data is carried out without the consent of the personal data subject;
•    statement of the essence of the requirements of the personal data subject;
•    personal signature (for a written application) or electronic digital signature (for an electronic document application) of the personal data subject.

13. The bank does not consider applications from personal data subjects that do not comply with the requirements of paragraph 12 of this Policy, including those sent by other means (e - mail, telephone, fax, etc.).

14. For assistance in exercising the rights related to the processing of personal data in the bank, the personal data subject can also contact the person responsible for internal control over the processing of personal data in the bank, including by sending a message to the email address uzpd@belapb.by.

15. The bank has the right, at its discretion, to unilaterally change this Policy without prior notice to the personal data subjects. Changes are posted on the Internet in accordance with paragraph 2 of this Policy.

16. Issues related to the processing of personal data not addressed in this Policy are regulated by the legislation of the Republic of Belarus.

Cybersecurity Department