Last Updated: March 2024
Version 1.0
What is the purpose of this document?
As we are committed to the safety of our staff and visitors we use a closed-circuit television
system (“CCTV”) and video and audio recording at our sites. The purpose of this document is to set
out how the CCTV system, and video and audio recording will be managed and used, and to inform
individuals whose personal data may be captured, about how and why that personal data may be
processed by Creature Comforts.
Who collects the information?
Creature Comforts Pets Limited (“Company”, “we”, “us”, or “our”), are the data
controllers of personal information collected about you. This means that we are responsible for
deciding how we hold and use personal information about you and that we are required to notify you
of the information contained in this Notice. It is important that you read this Notice so that you
are aware of how and why we are using your personal information and how we will treat it.
Compliance
We are aware that images of recognisable individuals, such as staff and site visitors, captured by
the CCTV system, or video and audio recording constitute ‘personal data’, use of which is governed
by data protection law. We will ensure that the use of the CCTV system and video and audio recording
and the personal data that they capture complies with the law.
This document has been drafted in accordance with the Information Commissioner’s Office (ICO) CCTV
Code of Practice and the Home Office Surveillance Camera Code of Practice. Copies of these codes can
be found at www.ico.org.uk and
https://www.gov.uk/government/publications/surveillance-camera-code-of-practice
respectively.
Purpose of the CCTV, video and audio recording system
The purpose of the CCTV system is:
- To increase the personal safety of our staff and visitors to our sites;
- To support our health and safety measures;
- To assist in identifying, apprehending and prosecuting any offenders on Creature Comforts sites;
- To protect the Creature Comforts’s buildings and assets and those of its staff from intrusion,
theft, vandalism, damage or disruption.
The purpose of the video and audio recording system is:
- To increase the personal safety of our staff and visitors to our sites;
- To support our health and safety measures;
- To support staff training.
The legal basis for the Company’s use of any personal data which is captured by the CCTV system, or
video and audio recordings is that the processing is necessary for the legitimate interests set out
above (provided that those interests are not overridden by individuals’ rights and interests). We
may also need to use this personal data in order to establish, exercise or defend against legal
claims.
Operation
CCTV cameras are located at strategic points on our sites, primarily access points, such as door
entrances to the sites, in waiting areas and in consultation rooms.
Signs are displayed prominently around the sites to inform staff and visitors that CCTV cameras are
in operation and who to contact for further information.
The cameras are in operation 24 hours a day, 7 days a week.
Creature Comforts manages all the footage from the CCTV cameras. We also use a third party provider
who will regularly check and confirm the efficiency of the system, including that the equipment is
properly recording, that the cameras are functional, that the time and date are correct and that
that footage is being deleted or retained in accordance with this document.
The CCTV system is regularly maintained in accordance with the manufacturer’s instructions.
Technical protective measures
We have put in place appropriate security measures to help prevent your personal data from being
accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we
limit access to your personal data to those employees, agents, contractors and other third parties
who have a business need to know. They will only process your personal data on our instructions and
they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you
and any applicable regulator of a breach where we are legally required to do so.
Access and disclosure
Access to recorded CCTV footage and any video and audio recordings is restricted to a limited number
of staff as authorised by our Data Protection Officer from time to time (“Authorised Persons”) and
all requests for disclosure of CCTV footage must be submitted to one of these Authorised Persons.
CCTV footage and video and audio recordings may only be accessed or disclosed to the extent
necessary in order to deal with an incident which falls within the purpose identified above or in
order to respond to a request made by an individual under the law. CCTV footage and any video and
audio recordings will not be accessed or used for any other purpose.
External disclosure of CCTV footage will usually not be permitted other than to law enforcement
agencies or to regulators, or in order to comply with a court order.
Training
All staff who may be involved in the management or operation of the CCTV system will be trained in
how to comply with this document and to ensure that the system is used in accordance with the law.
Disclosure of your information
We may share your personal information with the third parties set out below for the purposes
described above:
- Service providers (generally based in UK) such as those who provide IT and system administration
services
- Other companies in our Group of companies who provide security, IT and system administration
services and undertake management reporting and statistical analysis to improve our product and
service offering
- If we are under a duty to disclose or share your personal information in order to comply with any
legal obligation, or in order to enforce or apply our contract with you
- In the event that we sell or buy any business or assets, in which case we may (where relevant)
disclose your personal information to the prospective seller or buyer
- If we, or substantially all of our assets, are acquired by a third party, in which case personal
information held by us will be one of the transferred assets
- to protect the rights, property or safety of us, our customers and others. This includes
exchanging information with other organisations such as fraud and theft prevention agencies for
the purposes of reducing credit risk, fraud and energy theft.
We require all service providers that we share your personal information with to respect the privacy
and security of your personal information and to treat it in accordance with the law.
We do not allow our third-party service providers to use your personal information for their own
purposes and only permit them to process your personal information for specified purposes and in
accordance with our instructions.
Most of the personal information we collect about you is based in the United Kingdom or in some
cases, a service provider or their sub-processor may be based in the European Union (EU) and so,
they are required to comply with European data protection law. On occasion, we may appoint a
third-party service provider whose operation or a server or sub-processor may be based outside of
the EU.
Information retention
The images captured by the CCTV System will not be stored for any longer than is required in order
to achieve the purposes identified above. CCTV footage will automatically be deleted on a 30-day
rolling basis, unless specific images are required in order to deal with an incident or in order to
respond to a request by an individual made under the law.
Your rights
Data protection laws provide you with the following rights where we are processing your personal
information to:
- Request access to your personal information (commonly known as a “data subject access request”).
This enables you to receive a copy of the personal information we hold about you and to check that
we are lawfully processing it;
- Request correction of the personal information that we hold about you. This enables you to have
any incomplete or inaccurate information we hold about you corrected;
- Request erasure of your personal information. This Enables you to ask us to delete or remove
personal information where there is no good reason for us continuing to process it. You also have
the right to ask us to delete or remove your personal information where you have exercised your
right to object to processing (see below);
- Request the restriction of processing of your personal information. This enables you to ask us to
suspend the processing of personal information about you, for example if you want us to establish
its accuracy or the reason for processing it; and
- Request a copy of your personal information which you have provided to us, in a structured,
commonly used and machine-readable format and the right to transfer it, or to require us to
transfer it directly, to another controller.
- The right to object. However, due to physical and environmental restrictions, if you do not want
to be captured or recorded, please do not visit our premises. We are unable to disable our CCTV,
or video and audio recording system on an individual basis, so if you do not want to be captured
or recorded, we cannot provide services to you.
You will not have to pay a fee to access your personal information (or to exercise any of the other
rights above). However, we may charge a reasonable fee if your request for access is clearly
unfounded or excessive. Alternatively, we may refuse to comply with the request in such
circumstances.
We may need to request specific information from you to help us confirm your identity and ensure
your right to access the information (or to exercise any of your other rights). This is another
appropriate security measure to ensure that personal information is not disclosed to any person who
has no right to receive it.
Changes to this privacy notice
We reserve the right to update this Notice at any time, and we will provide you with a new Notice
when we make any material updates.
Contacting us
If you wish to make an individual request, or you have any queries, please contact us by email, or
post (details below):
- Email address: [email protected]
- Postal address: Creature Comforts, 13th Floor Capital House, 25 Chapel Street London, NW1 5DH
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO),
the UK supervisory authority for data protection issues (www.ico.org.uk), or the
equivalent regulatory authority in your country. However, we would like to deal with your concerns
before you approach the ICO (or other regulator) so please contact us in the first instance.
