Policy regarding video surveillance Boca Autotrade Srl (“company”)

Normative references and legitimacy conditions

Law Nr. 333 from the 8 th of July 2004 regarding the protection of objectives, assets, valuables and personal, with modifications and ulterior additions;

Decision number 301 from 11 April 2012 for the approval of Methodical Norms of Law Nr. 333/2003 regarding the protection of objectives, assets, valuables and personal protection;

Order number 52 from 18 th of April 2002 regarding the minimal Requirements of security regarding the use of data with personal character;

ANSPDCP Decision number 52 from 31 May 2012 regarding the use of data with personal character through the video surveillance means;

Instructions from the European Authority regarding the protection of personal data through video surveillance, published on 17 March 2010, Bruxelles;

The Regulation of Functioning and Organisation of the Company;

Job descriptions.


Domain:

The Policy applies in the activity of surveillance through the use of video means. The use of video system is necessary for the good administration and functioning of the Company, especially regarding control of security and safety.

The Policy regarding the surveillance of video means describes the video system of the company and protection measures taken by it to protect data with personal character, private life and other fundamental rights and legitimate interests of the persons filmed by the cameras.

The current Policy regarding the surveillance through video means can be accessed at the following web address www.autoboca.ro;


The content and scope of the Procedure

This policy establishes:

a) An unitary set of rules that regulates the implementation and use of surveillance video system in the scope of ensuring assets and personal security, guard and protection of assets, estates, values that are used in the activity of renting vehicles, respecting in the same time the obligations of the Company, in the quality of Data Operator, in according to the Law 677/2001 and security measures adopted to protect data with personal character, protection of private life, legitimate interests and guarantee of fundamental rights of the persons targeted.

b) Responsibilities through the administration and exploitation of the system of surveillance through video means, and those regarding the making, notification and approval of documents in direct connection with those activities.

The policy regarding the use of video surveillance is available on the Company Internet page.

The existing video surveillance system was installed as a result of risk assessments and analysis, annexed to the protection and guard plans.

A periodic revision will be undertaken annually by the responsible structures with the assurance of security and will reanalyse: (i) the necessity of maintaining in use the system, (ii) the fulfilment of the declared purpose; (iii) possible alternatives adequate to the system and (iv) the present policy respects the Law number 677/2001.

The Company uses the video surveillance system in the purpose of security and control access. With the help of this system, it is controlled the access in the Company perimeter, it ensures the assets security and personal safety – employees of the Company and visitors, as well as property and information held. The video surveillance system completes the other physical measures of security, such as the control access system, being part of the measures undertaken on the basis of the security policy, designed at Company level and helps in preventing and combating, if need be, the research of unauthorized physical access, including unauthorized access to secured spaces and protected establishments. In addition, the video surveillance system helps in preventing, detection and investigation of equipment theft or assets owned by the Company or for the prevention, detection and investigation of risks and threats to the hired personal that undergoes daily activity in the surveyed location. The video surveillance system it not used in other means than the one notified, it is not used to monitor the employee activity or for clocking. Furthermore, the system can constitute a means of investigation or procurement of information for internal inquires or disciplinary procedures, including those in the situations during which physical security incidents occur or if it is observed a criminal behaviour (in exceptional circumstances the images can be transferred to the research organs during a disciplinary or penal inquiry).

Supervised areas

The video surveillance system through videos means the offices in Suceava, Strada Traian Vuia, nr. 25; Iasi, Str. 14 Decembrie 1989, nr. 4; Bucuresti, Str. Amiral H. Macelariu, Nr 1, Sector 1; Otopeni, strada Sulfinei, Nr. 1; Bacau, Str. Aeroportului nr. 8C; Cluj, Str. Traian Vuia, nr.156; it is supervised through the use of video means.

Access zones and areas dedicated to employees and visitors;

Areas with restricted access;

Building surroundings to protect exterior spaces;

The layout of the cameras was carefully revised in order to ensure the limitation as much as possible of the monitored areas that don’t present interest in the desired scope and annexed to the present procedure.

Ares that present high level of expectations regarding private life are not monitored, such as offices (with the exception of the office in Baneasa, Otopeni, Cluj, Iasi and Bacau where is located the Company cash desk), toilets and similar locations.

In exceptional occasion, in the case of justified security through proper means, can be installed cameras in such places, but only after the realisation of an impact evaluation. In such cases, it will be placed a specific and visible announcement in the respective places.

The Company has the following configuration of the video surveillance system: system of 1 to 4 video cameras, depending on the size of the office, connected to an external device, external drive.

Data with Personal Character collected through video surveillance

Special Data

The video surveillance system of the Company does not have as purpose (for example through zooming or selective orientation) or image processing (for example: indexing or profile creation) which enfolds “special data category”.

The Company does not intend to use the surveillance system and in ad hoc way, respectively with temporary character, of circumstance.

Description and technical specifications of the system

In conventional way the video surveillance system is a static system. It has as a function the recording of images and it is equipped with motion sensors. The system can detect any movement through the cameras installed in the supervised area, with a date, time and location. All cameras are functional 24 hours, 7 days a week. When it is necessary, the quality of the images permits the recognition of those that walk by through the area of action of the cameras. For a better safety of the data processing action that can be obtained during a video surveillance, the cameras are fixed (without a zoom function), so that the user can’t modify the perimeter or scope of the surveillance. Specially instructed operators must respect the confidentiality settings and access rights. There is no interconnection with other systems and sound does not register.

The benefits of the surveillance system

A better control in the surveyed perimeter, of comings and goings;

Restricting access to foreign persons;

The elimination of loses due to unforeseen events;

Respecting the norms and legislation for objectives with risks.


Protection of private life and information security

In order to protect the security of the video system and to heighten the protection level of life, there were introduced the following technical and organisational measures:

Limiting the time of storage of the material filmed, in conformity with the security requirements;

Storage mediums (the servers where the images recorded are stored) are in secure areas, protected by physical means of security

All users with access rights have signed confidentiality declarations, that oblige them to respect the legal terms of the field; the access right is awarded to users on the basis of knowing, just for resources that are strictly necessary for the accomplishment of work related activities;

All staff personal (both external and internal) sign confidentiality agreements.

Only the system administrator, appointed in this sense by the operator, has the right to offer, modify or cancel the access rights of users, according to the general procedure of access to database. This permanently holds an up-to-date list of all persons that have the right to access the surveillance system, while specifying the type of access.

Access to personal data and unveiling them

Access to the stored images and/or to the technical architecture of the video surveillance system is limited to a reduced number of people and it is determined through specified attributions in the job description (to what scope and type of access). In a specific manner, the Company imposes limits to the persons with the right:

to see the filmed material in real time: images that run in real time are accessible only to responsible designated to undergo surveillance activity;

to see the recordings of the filmed material: viewing recording images will be done only in justified cases, such as the cases stimulated by law and security incidents, by persons specially designated to do so;

to copy, download, delete or modify any filmed material.

Instructing

All personal with access rights benefits from a special training in the field of data protection. This procedure will be integrated in the training and guidance programme, for all users with access rights and attributions in the handling of the video surveillance system.

The head of the service will ensure that all personal under his command, involved in the management of the video surveillance system, is trained and informed about all functional, operational and administrative aspects of this activity.

Measures of maintaining confidentiality

After training, every participant signs a confidentiality agreement.

The unveiling of data with personal character

Any activity of unveiling personal data to third parties will be documented and subjected to a rigorous analysis considering on one side the need of communication, and on the other hand the compatibility between the cope in which communication and scope of the collected data were processed (for security and access control). Any situation of unveiling will be recorded by the system administrator in a Register of cases of disclosure.

The Company has the obligation of offering judiciary organs, at their written request, video recordings during which penal actions are undergone. The video surveillance system is not used to verify the presence at work or evaluating performance at work. In exceptional cases, but with the utter respect of the guarantees described above, can be given access to Disciplinary Commission, during a disciplinary inquiry, with the condition that all information will help the investigation of a crime or a disciplinary deviation that might prejudice rights and liberties of a person.

Any breach of security regarding video cameras is indicated in the investigation register, and the Company will be informed with this eventuality as soon as possible.

Storage duration

The storage duration of the data obtained through the use of the surveillance system is proportional with the scope of the data processing, and as a result (i) images (surprised by the video system) are stored for a period that does not go over 30 days, after which they are erased through an automated procedure in the order the images were recorded, (ii) images (surprised by the video system) are stored for a longer period than 30 days, after which they are deleted through an automated procedure in the order the images were recorded. In the event of security incident, the duration of the material filmed can exceed the normal limits, in accordance with the time necessary for the additional investigation of the security incident. Keeping the data is rigorously documented and the necessity to keep it revised periodically.

The Rights of the targeted person

The Company guarantees that ensures full compliance with the rights of the targeted persons, in accordance with the law. All persons involved in the video surveillance activity and responsible with the administration of the filmed images, will respect the Access Procedure to data with personal character.

Informing the persons in question

Primary information of the targeted persons is done in a clear and permanent manner, through the use of an adequate sign, with sufficient visibility and located in the supervised area, so that it signals the existence of video cameras, but also to communicate essential information regarding the process of data with personal character.

The persons in question are warned of the existence of the video surveillance system through the Internal Regulations of the Company that has the scope of the processing and identifies the Company as operator of data collected through video surveillance.

Exercising access, intervention and opposition rights

During the period of the stored data with personal character, the persons in question have the right to access the data with personal character owned by the Company, to ask for intervention (deletion, actualisation, rectification or anonymity) or to oppose data processing, in accordance with the law.

Any request to access, rectify, block and/or delete data with personal character as a result of video camera usage must be addressed to the Company.

The response to the access, intervention or opposition request is issued in 15 days (calendar time). If this deadline is not respected, then the person in question will be informed of the reason for the delay and also communicate the procedure that will follow for the resolve of the request.

If the targeted person asks, it can be offered the right to view the recorded images that concern him/her or granted a copy of the images. The supplied images will be clear, as possible, with the condition to not harm the rights of third parties (the targeted person will be able to see only his or her image, the images of other persons that appear in the recording will be edited as to limit to zero the chances of recognition or identification of third parties). In the event of such a request, the targeted person is obliged to identify beyond suspicion (to present identification act when he or she participates to the viewing), to mention the date, time, place and surrounding when the cameras recorded him or her. Furthermore the person in question must present a recent photo so that the designated users to identify easier in the recorded image. The person will only be able to see his/her own image, the images of other persons will be edited accordingly so that it won’t be possible to identify/recognize them.

There is also the possibility of denying the right to access in situations when exceptions from the law apply. The necessity to restrict access is imposed in the case where there is the obligation to protect the rights and liberties of a third persons, for example if in the images appear people and if there is no way to obtain their consent or there is no way to extract, through image editing the irrelevant personal data.


Processing data with personal character which permit directly or indirectly the geographical localisation of physical persons

The Society processes data with personal character regarding the geographical localisation of physical persons that request its services.

The Society applies during its activity, the supervision of cars through the use of satellite positioning system (GPS). Using the system through localisation is necessary for a good administration and functioning of the society, especially regarding control of the automobile location as to prevent theft situations of the cars.

The cars rented are monitored through a satellite positioning system, commonly known as GPS.

The GPS is used in the car as a special device with the same name, connected to satellite which gives the company the possibility to verify the car’s location.

The information obtained by the Society collected through the use of the GPS are stored on the server administrated by the suppliers of services with whom the Society collaborates.

The data obtained through GPS monitoring is stored for a period of maximum 2 years. After the 2 years period, the data in question are automatically erased from any device where it was stored.