LITHUANIAN AND GERMAN UAB TUVLITA
VIDEO SURVEILLANCE, PHOTOGRAPHY, USE OF CAMERAS
AND RULES FOR THE PROCESSING OF VIDEO DATA

Current version 2024-03-01

GENERAL PROVISIONS

1. The Rules of the Lithuanian and German UAB Tuvlita Video Surveillance, Photography, Use of Cameras and Processing of Video Data (hereinafter referred to as the "Rules") regulate and cover the surveillance, photography, recording of video data, processing of recordings (viewing, storage, transfer, sharing, use), use of personal video recorders, access rights and authorization to process personal data of UAB Tuvlita (hereinafter referred to as the "Company"), the procedure for the exercise of the rights of data subjects and the rules for the processing of requests, ensuring compliance with and implementation of the Law on Legal Protection of Personal Data of the Republic of Lithuania, the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as "GDPR"), as well as the requirements of other laws and legal acts regulating the processing and protection of personal data.

2. These Rules have been prepared in accordance with the Law on Personal Data Protection of the Republic of Lithuania (hereinafter referred to as the "LPPD"), the GDPR and its implementing legal acts, the Order of the Director of the State Data Protection Inspectorate No.1T-71(1.12) of 12 November 2008 "On the Approval of the General Requirements for the Organisational and Technical Measures for the Security of Personal Data", and other laws and legal acts regulating personal data processing and protection.

3. The provisions of these Rules shall apply to the Company's employees and customers.

CONNECTIONS

4. For the purposes of these Rules:

4.1.The Data Controller - UAB "Tuvlita", company registration number 110584095, Lentvario g. 7A, Vilnius, e-mail : info@tuvlita.lt, phone +3706 33 93 000.

4.2.The Data Processor - UAB "Tuvlita", company registration number 110584095, Lentvario g. 7A, Vilnius, e-mail : info@tuvlita.lt, phone +3706 33 93 000.

4.3 The data manager of the Technical Inspection Information System is UAB "Tuvlita" and Lithuanian Association of Technical Inspection Companies "Transeksta", Senasis Ukmergės kel. 16, Užubalių k., Vilnius r., e-mail : transeksta@vta.lt, tel. +3705 268 52 80.

4.4 Data Subject - a natural person whose personal data is processed for the purposes set out in the Rules.

4.5 "Personal Data" means any information relating to a Data Subject who is known or identifiable, directly or indirectly.

4.6 Access to video and photographic equipment - physical access or access by electronic means that enables a person to modify, remove or update the components or software of technical video equipment, to set the operating parameters of the video equipment, and to access personal data collected during video surveillance.

4.7 "Video surveillance" means the processing of video data relating to a natural person by means of automated video surveillance tools (video cameras), regardless of whether the data are stored in a medium.

4.8 "Video surveillance system" means servers and/or video data recorders, CCTV cameras and data storage media that store video data.

4.9 Video data recorders and photographers are digital devices in an enterprise's asset register for capturing, recording, storing, viewing and copying video data.

4.10. 'Personal video recorder' means a mobile device capable of recording video and sound (hereinafter 'video recorder').

4.11. 'Video recorder user' means a staff member who records video using a video recorder.

4.12. Other terms used in the Terms and Conditions shall be understood as defined in the ADTAA, GDPR and other legal acts of the Republic of Lithuania.

PURPOSE AND SCOPE OF CCTV CAMERAS

5. The purpose of CCTV cameras is a preventive security measure to ensure the protection of the property and property rights of the company, its employees and customers, public order, a safe environment, to ensure the quality of the services provided by the company, as well as to control the quality of work within the company and prevent corruption. Video surveillance is also carried out for the purpose of controlling vehicles delivered to the Technical Inspection Centre, and for the purpose of providing victims with access to video recordings of incidents in accordance with the established procedures, in order to facilitate the correct interpretation of disputed situations or the handling of cases.

6. Video surveillance by cameras shall be carried out at all the company's technical inspection stations (Annex 1 to the Rules).

7. CCTV cameras capture:

7.1 The areas of all inspection stations: entrance and exit areas, parking areas and all other public areas of the premises;

7.2. the premises of all technical inspection stations: document issuing premises (video surveillance may be combined with audio recording), vehicle inspection lines and all other public areas of the premises of the undertaking (corridors, entrance, exit areas (video surveillance may be combined with audio recording)).

7.3 The buildings, indoor and outdoor areas of the technical inspection stations are monitored by cameras 24 hours a day. During the working hours of the inspection station, video data shall be continuously recorded, after working hours, video recording shall be carried out only when movement of an object is detected in the premises or area.

8. CCTV data shall be recorded on a Network Attached Storage (NAS) device and stored on digital media for at least 30 calendar days. Due to the limited capacity of the hard disk, the video recorder shall automatically delete the oldest video recordings and record the most recent video stream in the free space available. The staff responsible for the maintenance of the CCTV system, as specified in these Rules, shall ensure the continuity of the recording of the video data and shall ensure that the system is free from faults.

THE PURPOSE AND SCOPE OF PHOTOGRAPHY WITH VIDEO CAMERAS AND PHOTOGRAPHIC EQUIPMENT

9. As part of the company's policy to prevent corruption and to ensure that disputes over the quality of the company's services are resolved objectively, the company uses video cameras and photographic equipment to take photographs.

10. CCTV photography shall be carried out at all the company's technical inspection stations (Annex 1 to the Rules).

11. CCTV photographs are taken during the opening hours of the test station, continuously, every 1 minute. The photographs shall be recorded on a NAS storage device and stored on digital media for 3 years.

12. Photography with a photographic device is carried out during the compulsory technical inspection and/or technical examination of the vehicle. During the compulsory roadworthiness test, photography with a device may be used for the purpose of internal quality control, for the prevention of corruption, or for the purpose of capturing situations in which a dispute arises between the operator of the vehicle and a member of staff of the test station.

13. When taking photos with the camera, the photos are uploaded directly from the camera to the data servers of the Technical Inspection Information System (NAS) and stored for 10 years.

LIVE VIDEO SURVEILLANCE

14. For the smooth operation of the service station and for the performance of the employees' job functions, the computers used at each service station, in the service premises, shall provide the service station employees, or groups of them, as indicated in the Scheme of Employees with Access to CCTV/photographs, with the ability to monitor a live view of their service station's territory and/or premises.

15. A list of all the cameras at the inspection stations, with the personnel or groups of personnel with access rights, is indicated in the Access to CCTV/Photos scheme.

16. As part of the company's policy to prevent corruption and to ensure quality control of work within the company, the company's manager and the manager of the Vilnius Technical Inspection Centre have access to the live video data from all the cameras at the technical inspection stations.

17. All employees of the company referred to in these rules who have the right of access to live video data shall comply with the requirements set out in the legislation governing the protection of personal data.

USE OF VIDEO RECORDERS

18. The video recorders shall be available to all employees of the Vilnius Technical Inspection Centre at all the company's technical inspection stations specified in Annex 1 to the Rules.

19. VCRs shall be issued to users by a responsible employee - the head of the inspection station, shift supervisor or other employee designated as responsible for the VCR.

20. The video recorder shall be issued to the staff in charge of the technical inspection station via the work equipment accounting module in the company's document management system. The company's IT specialist shall be responsible for issuing the video recorders and assigning the recorder to the employee in the document management system.

21. Video recorders are used for:

21.1. in situations where there is a threat to the safety of the Company's employees and/or customers, to life or health, or to the property of the Company's employees and/or customers;

21.2. a client or other person commits a flagrant breach of the law or engages in potentially similar unlawful activity on the Company's premises;

21.3. in conflict situations with the Company's clients or other persons, when they refuse to comply with the lawful instructions or requests of the Company's employees;

21.4. to prevent possible cases of corruption;

21.5. at the direction of the supervisor, to monitor the quality of the work performed by the staff member in order to check the quality of the work performed by the staff member;

21.6. at the instruction of the head of the Vilnius Technical Inspection Centre and/or the head of the technical inspection station, during the quality control inspection of the compulsory technical inspection of vehicles performed by the Lithuanian Transport Safety Administration.

22. The use of a video recorder is prohibited:

22.1. temporarily or permanently transfer the video recorder or its data to third parties (including law enforcement authorities, etc.);

22.2. delete or copy data from the internal memory of the video recorder;

22.3. use video recorders in areas where a person expects complete privacy, i.e. toilets, showers, etc.

23. The user of a video recorder shall, immediately after switching on the video recorder, verbally inform the person that a video recorder is being used to record video and sound, unless this is not possible due to objective circumstances.

24. The user of a video recorder shall immediately inform his or her line manager if the video recorder captures a person potentially committing an offence.

25. Every working day (at the end of the shift), the user of the video recorder shall return the video recorder to the person in charge of the technical inspection station. The information captured by the video recorder shall be transferred automatically and/or manually to a dedicated storage location on the server which is not accessible to the public. At the end of the working day (end of shift), the responsible employee shall check (if the video recorder has been used) whether the data has been transferred from the video recorder and, if the data has not been transferred, shall report the failure to the company's IT specialist.

26. Video recorders shall be used to record the surroundings, the condition of the parts of the vehicle being inspected, their damage, non-compliance with requirements and other circumstances relevant to the results of the inspection and the inspector's conclusion.

27. The data of video recorders shall be stored on the storage devices for 30 (thirty) calendar days. After this period, the data shall be deleted automatically or manually from the servers of the video storage equipment. The company's IT specialist shall be responsible for controlling the deletion of data.

28. If the data of the video recorder is to be retained from the video storage devices for a period longer than 30 calendar days, the person concerned shall inform the IT Officer in writing of the retention, specifying which data of the video recorder are requested to be retained (date, time, inspection station), for which period and for what reasons. In this case, the IT Officer shall fill in the Video Surveillance and/or Photography Data Transmission and Recording Log (Annex 3 to the Rules), indicating the period of retention requested. The image data shall be destroyed as soon as the reasons for postponing their destruction no longer exist.

29. Where image data from video storage devices are necessary for an investigation, they may be deleted only on the instructions of the person who, with the right to do so, has requested their retention or after the expiry of a specified period.

30. In the event of an inspection of the Company in connection with circumstances related to the performance of the Company's employee's work duties, or in the event of a complaint from a customer or other person regarding the actions of the Company's employees, the video recording shall be kept until the investigation is completed.

31. The following persons shall have the right to inspect the video data recorded by the video recorder:

31.1. the Head of the Company, the Head of the Vilnius Technical Inspection Centre, the Head of the TAS and/or an employee authorised by these persons, as well as employees responsible for the maintenance of the video surveillance system and other employees for whom the viewing of the video data is necessary for the performance of their job duties;

31.2. the person/employee whose image data is processed;

31.3. law enforcement and other authorities in accordance with the procedures established by law.

MANAGEMENT OF CCTV FOOTAGE AND PHOTOGRAPHY DATA

32. All data recorded by the video recorder, video surveillance cameras and photography shall be processed by the head of the company's information systems maintenance department and the information technology specialist (hereinafter referred to as the employees responsible for the maintenance of the video surveillance system), who are responsible for the organisation of the video surveillance, the processing of the video data, their transfer to third parties and the protection of the data on video surveillance, recording and photography, in accordance with the conditions set out in these Rules, except in the case of a technical failure of the system or in case of preventive maintenance work. The following staff members who have access to video data shall have signed an undertaking to protect the confidentiality of personal data and shall undertake to comply with the requirements laid down in the legislation governing the protection of personal data.

33. Staff responsible for maintaining the CCTV system must:

33.1. ensure that data captured by video surveillance, photographic images and/or video recorder are not used for purposes other than those defined in these Rules;

33.2. ensure that data is accessible only from the internal computer network;

33.3. ensure that CCTV cameras are installed and/or photographs are taken in such a way that, having regard to the stated purpose of the CCTV surveillance and/or photography as set out in these Rules, the CCTV surveillance and/or photographs are not carried out over a larger part of the area or premises than is necessary and no more video data is collected than is necessary.

33.4. comply with the basic principles of image data processing and the confidentiality and security requirements set out in the ADTAA, GDPR, these Rules and other legal acts;

33.5. ensure that the video surveillance system and the equipment used for video surveillance and recording are in good working order, and that technical malfunctions of the system and equipment are dealt with expeditiously, using all available technical resources;

33.6. take organisational and technical measures for the security of personal data in order to prevent accidental or unlawful destruction, loss, alteration, disclosure or any other unlawful processing of image data;

33.7. store video data contained in video data recorders and/or media;

33.8. not to disclose, transmit or allow access to image data by any means to persons not entitled to do so;

33.9. to ensure that information boards (video surveillance signs) with the following information are posted in the approaches to the company's building, premises and territories where video surveillance is carried out: "For the purpose of protection of persons and property, the territory and premises are monitored by video cameras", including contact information of UAB Tuvlita, company registration number: 110584095, Lentvario g. 7A, Vilnius, tel. +3706 33 93000, email : dap@tuvlita.lt ;

33.10. ensure that information boards are posted and visible before entering the CCTV area;

33.11. record the transmission of video surveillance and/or photography data in the Video Surveillance and/or Photography Data Transmission Log.

33.12. to ensure that the area covered by the CCTV cameras does not include the living room and/or the private area or entrance belonging to the living room and/or the private area or entrance belonging to the living room, as well as premises where the data subject has a reasonable expectation of absolute privacy and where such surveillance would be degrading to human dignity.

34. If the employees responsible for the maintenance of the CCTV system or other employees of the company notice that the CCTV and/or photographic data being processed have been made available to (or threatened to be made available to) persons who do not have the right to process such data, they shall:

34.1. immediately take all feasible measures to terminate unauthorised access to the personal data processed;

34.2. immediately inform the staff member responsible for maintaining the CCTV system;

34.3. immediately inform the employee responsible for the protection of personal data of the incident, who must record the incident in accordance with the company's procedures.

35. Access rights to recorded video surveillance and photographic data shall be terminated upon the termination of the mandate of the staff member processing the video data, the termination of the employment relationship, or any change in the staff member's functions for which access to the video data is not required.

PROVISION OF IMAGE DATA AND RECIPIENTS OF DATA

36. In the cases and according to the procedure established by law, the company shall provide the video surveillance and/or photography data processed by it to law enforcement authorities and other persons to whom the provision of such data is obliged by law or other legal acts or to whom the company, in accordance with the procedure established by law or by contractual obligations, provides such data in the performance of its functions (Association of Technical Inspection Companies "Transeksta", Lithuanian Transport Safety Administration, State Enterprise Regitra, insurance companies), as well as according to the requests of the data recipients, in the presence of at least one of the conditions for the legitimate processing of personal data referred to in Article 6 of Regulation (EU) 2016/679. The request must specify the purpose of the use of the image data, the legal basis for the provision and receipt of the image data and the scope of the image data requested.

37. The decision on the provision of image data shall be taken by the head of the company or a responsible person authorised by him.

38. All employees have the right to access their image data and, in exercising this right, must comply with the requirements laid down in the legislation on the protection of personal data.

ORGANISATIONAL AND TECHNICAL MEASURES FOR THE SECURITY OF PERSONAL DATA

39. The following organisational and technical measures for the security of personal data shall be implemented to ensure the security of image data:

39.1. access to live video surveillance shall be limited to those staff members who require live video surveillance data for the performance of their job functions;

39.2. only the staff responsible for the maintenance of the CCTV system as specified in these Rules shall have the right to process the recorded CCTV and photographic data;

39.3. the security, management and control of access to image data (passwords);

39.4. the protection of personal data against unauthorised access to the local area network by means of electronic communications;

39.5. ensuring the security of the premises where the video data is stored and the proper protection of the data storage devices (data storage devices shall be stored in locked rooms/lockers, access to the relevant premises by unauthorised persons shall be restricted, etc.);

39.6. protection of computer equipment against malicious software (anti-virus software, updates, etc.).

39.7. the fact that video surveillance is being carried out shall be indicated in all cases, irrespective of the fact that video surveillance is not being carried out at the time in some designated areas (e.g. the CCTV camera is not working all the time, is not working at a fixed interval, etc.).

RIGHTS AND OBLIGATIONS OF THE DATA SUBJECT

40. The data subject shall have the following rights: to receive information about the processing of the data; to have access to the data; to have the data erased ("right to be forgotten") if the video/photographic data are stored for longer than the retention period set out in these Rules; to restrict the processing of the data; to object to the processing of the data.

41. An image (if stored) or a copy of an image captured by CCTV cameras or a photographic device may only be released upon written request of the data subject or in accordance with the procedure laid down by law.

42. A request from a data subject who wishes to receive a photographic or video image (copy) of himself or herself and of third parties shall specify the purpose of the use of the personal data, the legal basis for the provision and receipt of the personal data, and the scope of the personal data requested.

43. In order to safeguard the rights of third parties, the company reserves the right to withhold image data which includes not only the data subject but also third parties.

44. Upon receipt of an enquiry from a person concerning the processing of image data relating to him or her, the undertaking shall respond, no later than 30 calendar days after receipt of the person's enquiry, as to whether image data relating to him or her are processed, stored and, if stored, the procedure for the provision of such data.

45. Upon a data subject's request for access to his or her video data, the requested video data may be made available to the data subject by making the video available for viewing on the premises of the undertaking and/or by providing a copy of the video on an external storage medium or a photograph, if the video data are stored.

46. At the request of law enforcement authorities or other authorities to which the company undertakes to provide data in accordance with the procedure laid down by law, an image (copy) captured by video surveillance cameras or a photographic device may be issued without the consent of the persons captured in the image.

47. In order to protect the personal data and interests of the company's customers, third parties shall only be allowed to take photographs, video or audio recordings in all premises and on the territory of the service stations upon request and with the prior permission of the company's management, stating the reason for the request and whether there is a legal basis for such action.

48. The decision to allow photography, filming or audio recording on the premises and grounds of a service station shall be taken by the head of the company or a responsible person authorised by him.

FINAL PROVISIONS

49. These Regulations shall be published on the company's website www.tuvlita.lt and on the information boards of all technical inspection stations.

50. All employees of the company shall be informed of the Rules by signature and thereby undertake to comply with the Rules and other legal acts establishing the requirements for the processing of personal data.

51. The Company's employees who violate the requirements of these Rules shall be held liable in accordance with the procedure established by law.