Employee Information Notice on Video Surveillance

Information Notice for Employees on the Processing of Personal Data pursuant to Article 13 of EU Regulation 2016/679

Dear Employee,

Brivio Compensati S.p.a., acting as the Data Controller, with registered office at Via Novara 258, 27038 Robbio (PV), Tax Code 02109430153 and VAT No. 02109430153, tel. 0384 689211, email hr@brivio.it, hereby informs you that the personal data you have provided to the company will be processed in accordance with European (EU Regulation 2016/679, hereinafter the “Regulation”) and national data protection legislation.

– Purposes of personal data processing and legal bases for processing:

Personal data will be processed for the following purposes:

1. management of the employment relationship;
2. fulfilment of contractual obligations;
3. compliance with legal obligations;
4. administrative, accounting and tax management of staff;
5. management of attendance, absences and shift patterns;
6. management of health and safety at work and occupational health monitoring;
7. staff training and professional development;
8. management of disciplinary procedures and disputes;
9. management of internal company communications;
10. management of IT systems and company access;
11. protection of company assets and security, including through video surveillance systems installed in accordance with Article 4 of Law 300/1970 and applicable trade union agreements;
12. management of relations with social security, welfare and insurance bodies;
13. institutional and promotional communications for the company, including the publication of images and videos, subject to the data subject’s specific consent.

 

With regard to video surveillance, data processing is carried out for the purposes of protecting company assets, ensuring security and preventing offences, in accordance with the trade union agreement signed on 23 May 2023; the additional camera covered by the trade union agreement is, however, used exclusively for real-time monitoring of the correct positioning and unloading of materials and the operation of the production process, without the images being recorded or stored.

The processing of personal data takes place in accordance with the conditions of lawfulness set out in EU Regulation 2016/679, and in particular pursuant to Article 6(1)(b) for the performance of the employment contract or pre-contractual measures, Article 6(1), (c) for the fulfilment of legal obligations and Article 6(1)(f) for the pursuit of the Data Controller’s legitimate interests relating to organisational requirements, security and the protection of company assets; for specific purposes, such as the publication of images and videos, processing is based on the data subject’s consent pursuant to Article 6(1)(a).

With regard to special categories of data, processing is carried out in accordance with Article 9(2)(b) for the fulfilment of obligations and the exercise of rights relating to labour law and social security, and in accordance with Article 9(2)(h) for the purposes of occupational medicine and health surveillance.

Processing via video surveillance systems is in all cases carried out in accordance with Article 4 of Law 300/1970 and the applicable trade union agreements.

– Types of data processed and methods of processing

Processing may concern personal and identifying data, contact details, data relating to the employment relationship, administrative, tax and social security contribution data, data relating to training, as well as IT data and access logs to company systems; as part of company activities, data derived from video surveillance systems installed at company premises may also be processed in accordance with current legislation and applicable trade union agreements, as well as images and videos intended for publication on the website and social media channels, subject to the data subject’s consent. In compliance with regulatory and contractual obligations, data relating to the employee’s family members may also be processed where necessary for the management of the employment relationship.

The processing will be based on the principles of fairness, lawfulness and transparency, whilst respecting the data subject’s privacy and rights; the data processed may also include special categories of data within the meaning of Article 9 of the GDPR, in particular data relating to health (e.g. illness, accident, maternity or fitness for work) and trade union membership. Health-related data, processed by the occupational health doctor in accordance with Legislative Decree 81/2008, is managed by the doctor as an independent Data Controller, whilst the Employer is informed solely of the assessment of fitness or unfitness for the role.

Data processing is carried out manually and using IT tools, as well as company and security systems, adopting appropriate technical and organisational measures to ensure the security, integrity and confidentiality of the data; video surveillance systems are used exclusively for security purposes and to protect company assets, whilst any systems for monitoring production processes operate in real time without recording images and in compliance with current legislation.

– Further types of processing

In order to protect the company’s assets, ensure the physical safety of employees, customers and persons present on company premises, and prevent the commission of crimes and offences, the Data Controller has installed a video surveillance system at its premises, used in accordance with current legislation and, in particular, Article 4 of Law 300/1970, on the basis of a specific trade union agreement signed on 23 May 2023 and subsequent amendments; the footage collected is processed exclusively for security purposes and to protect company assets, and is accessible only to expressly authorised persons.

In addition, there is a further camera in the production area, intended solely for the real-time monitoring of the correct conduct of the production process and the flow of materials; this does not involve any recording or storage of footage and is not used for the remote monitoring of work activities.

For further information, please refer to the specific privacy notice on the video surveillance system, which is made available to employees. The legal basis for the processing is the Data Controller’s legitimate interest (Article 6(1)(f) of the GDPR), in compliance with the safeguards provided for in Article 4 of Law 300/1970.

– Nature of the provision of data

The provision of personal data is necessary for the purposes set out above, in particular for the management and performance of the employment relationship and for the fulfilment of the legal, contractual and regulatory obligations incumbent upon the Data Controller; Failure to provide such data will make it impossible to establish or properly continue the employment relationship and to fulfil the obligations relating to remuneration, social security contributions, tax and insurance as provided for by current legislation. For specific purposes, such as the publication of images and videos on the website or social media channels, the provision of data is optional and the related processing is based on the data subject’s consent, without prejudice to the employment relationship in the event of failure to provide such data. Processing carried out using video surveillance systems and corporate security tools, however, does not require the direct provision of data, as it is carried out by the Data Controller for the purposes of security and the protection of the company’s assets in accordance with current legislation.

– Disclosure and transfer of data

Personal data may be disclosed, for the purposes set out above, to external parties who assist the Data Controller in managing the employment relationship and fulfilling related obligations, such as employment consultants, professional firms, accountants, tax and legal advisers, social security and welfare bodies (e.g. INPS, INAIL), banks and insurance companies, public authorities and government departments, as well as to the occupational health doctor and occupational health services acting as independent data controllers; Data may also be disclosed to companies and professionals providing training services, to IT and management service providers, and to parties responsible for the management and maintenance of company systems, including security and video surveillance systems, as well as, where necessary, to trade unions, audit firms and supervisory bodies. These parties process the data in their capacity as data processors pursuant to Article 28 of the GDPR or, where applicable, as independent data controllers, whilst the data may also be processed by internal staff expressly authorised and instructed by the Data Controller. Personal data will not be disclosed, except as provided for institutional and promotional communication purposes subject to the data subject’s consent, and will not be transferred outside the European Economic Area.

– Retention of processed data

Personal data will be retained for the time strictly necessary to fulfil the purposes for which it was collected and, in any event, in compliance with applicable legal obligations; in particular, data relating to the employment relationship, including administrative, tax, social security and contractual data, are retained for 10 years from the termination of the employment relationship, subject to any further regulatory obligations or the need to protect the Data Controller’s rights in legal proceedings. Data relating to job applicants is retained for a maximum period of 24 months from the date of collection, whilst data processed for the purpose of publishing images and videos is retained until consent is withdrawn or the employment relationship ends; IT data and access logs for company systems are retained for as long as necessary to ensure the security of the systems and the protection of the Data Controller’s rights. With regard to video surveillance, recorded images are retained for a limited period, generally between 24 and 72 hours, after which they are automatically deleted, unless required for the investigation of offences or the protection of rights, whilst real-time monitoring systems for production processes do not involve any recording or retention of images. In any event, data will not be retained for longer than is necessary for the purposes for which it was collected and processed.

– Rights of the data subject

We inform you that, in relation to the processing of your data, you may exercise the rights set out in Articles 15–22 of the GDPR 2016/679, namely:

• To request and obtain the erasure, anonymisation or restriction of processing of data processed in breach of the law;
• To request and obtain the updating, rectification and completion of the data;
• To request and obtain confirmation that those to whom the data have been disclosed have been informed of such actions;
• To object, on legitimate grounds, to the processing of data or to any automated decision-making process (including profiling);
• To request and obtain the restriction of processing or the portability of data to another data controller;

 

To exercise your rights under the law and to view the up-to-date list of data processors, you may contact the Data Controller in writing at the email address hr@brivio.it or by registered letter with acknowledgement of receipt addressed to A. Brivio Compensati S.p.a., Via Novara 258, 27038 Robbio (PV).

Please also note that the data subject always has the right to lodge a complaint with the Data Protection Authority to exercise their rights or regarding any other matter relating to the processing of their personal data. The necessary forms can be downloaded from the Authority’s website at https://www.garanteprivacy.it/web/garante-privacy-en/home_en.

Robbio (PV), 5 May 2026

The Data Controller
A. Brivio Compensati S.p.a.