CCTV Notice

Purpose for processing

CCTV data is processed by GTT, acting as Controller, in line with Article 6(1)(f) of the GDPR. This processing is carried out to serve GTT’s legitimate interests, which include protecting property and assets, maintaining confidentiality, security, and operational integrity, ensuring the safety of individuals and the GTT’s reputation, and preserving evidence when and if required for the prevention, detection, or investigation of physical intrusion or crime. 

What data will be collected?

As part of the CCTV monitoring activities, GTT may collect and process the following types of personal data:

• Visual images of individuals, including employees, contractors and visitors, as they move within the range of the CCTV cameras. 
• Behavioural data, such as movement patterns, interactions, or activities occurring within monitored areas. 
• Date and time stamps associated with the recorded footage. 
• Location data, indicating the specific area under surveillance. 

No audio recording is captured.

How will the data be collected?

The CCTV is configured, positioned and angled to capture exclusively and only entrances, exit and access points. This prevents accidental capture of parts of other areas through the side view of the camera, which are outside the scope of this Notice and the CCTV monitoring.

The monitoring is continuous and only data necessary for the purpose of surveillance under the purpose for processing is collected.

Who has access to the collected data?

Surveillance footage is accessible only to designated GTT representatives within the IT team, who maintain constant access for system administration purposes. In the event of a security incident, access may be granted to the relevant internal departments (Legal, Security, or HR), strictly subject to senior management approval and limited to personnel with a direct responsibility for addressing the incident, on a need‑to‑know basis. The data made available in such cases consists of short three‑second snippets, which are retained solely for the period specified in this Notice. 

Data subject rights

As a data subject, you have rights under the GDPR in relation to the personal data that may be collected and processed through CCTV monitoring. These rights include:

• The right to be informed about the processing of your personal data. 
• The right of access to your personal data 
• The right to request rectification or erasure of inaccurate or unlawfully held data. 
• The right to restrict or object to certain types of processing 
• The right to data portability, so the data is transmitted to another controller in a structured, commonly used, and machine-readable format. 

If you seek further information about how your personal data is processed in the workplace, please consult GTT Employee Privacy Notice, which provides additional context and guidance specific to employee data processing.

Data retention

The CCTV monitored areas are recorded for 24/7 in 10 days’ snippets. Should motion be detected, the footage is stored for up to 1 month. CCTV footage is retained only for as long as necessary and in line with the retention period specified herein. Please note that access to footage may be limited where disclosure would adversely affect the rights and freedoms of other individuals, or where exemptions apply under applicable law.

disclosure would adversely affect the rights and freedoms of other individuals, or where exemptions apply under applicable law.

Contact information

In case of questions, concerns or requests please contact GTT’s Data Protection Team at [email protected].