Privacy policy applicable to video surveillance system (CCTV)
This privacy policy (the “Policy”) is intended to explain how we process your personal data in connection with the operation of the video surveillance system we installed in our buildings of the TECHNOPOLIS complex (excluding buildings A & B) located at 12, rue Guillaume J. Kroll, L-1882 Luxembourg, Grand Duchy of Luxembourg (the “CCTV System”) and to provide you with more information on your privacy rights and how to exercise them.
We hope this will help you to have a clear view of how your personal data are processed.
1 Data controller
The data controller under the General Data Protection Regulation (EU 2016/679) (“GDPR”) is, in relation to the processing of your personal data when we operate our CCTV System:
KOWAC S.à r.l.
Société à responsabilité limitée
40, Rue de la Vallée
L-2661 Luxembourg
R.C.S. Luxembourg: B240412
We, KOWAC S.à r.l., as “data controller” under the GDPR are responsible for deciding how we hold and use the personal data we have about you.
References, herein to “we”, “us” or “our” shall refer to KOWAC S.à r.l. as data controller. References to “you” or “your” shall refer to data subjects whose personal data may be processed by the data controller.
2 What is a personnal data and what do we mean by processing personnal data?
- “Personal data” means any information relating to an identified or identifiable natural person (a “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
Example of personal data: your image on a footage - “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction
Examples of processing: the storage or deletion of a footage containing your image
3 Purpose of the processing of your personal data
The CCTV System has been installed and is operated, and your personal data is accordingly processed, for the following purposes in accordance with article 6(1)(f) GDPR (legitimate interests):
- securing the accesses to the buildings;
- ensuring the safety and security of people such as our and our tenants’ employees, customers, visitors, contractors;
- preventing and detecting theft, vandalism, trespassing, or other unlawful activities in our properties and protecting our and our tenant’s assets;
- organising and supervising the rapid evacuation of persons in the event of an incident;
- to be able to alert the emergency, fire or law enforcement services in good time and to facilitate their intervention
- supporting incident investigations and insurance claims.
Cameras’ coverage is limited to common areas, the entry/exit points, the terrace of the restaurant, the conference center and the outside parking areas; no cameras are installed in restrooms, changing rooms, break rooms, or private offices.
Monitored areas are marked with visible signage (as required by CNPD guidelines), indicating:
- the purpose of monitoring.
- the presence of video surveillance;
- the identity and contact details of the data controller;
4 Personal data collected
The CCTV System captures and processes the following personal data:
- Visual images (video recordings and still images) of individuals entering, exiting, or moving within the monitored areas;
- Metadata associated with recordings, including date, time, and location of capture (e.g., camera ID, building zone).
No audio is recorded and no biometric data (e.g. facial recognition or gait analysis) is processed by our CCTV System.
5 Legal basis for processing
The processing of personal data via CCTV System is based on our and our tenants’ legitimate interests as per article 6(1)(f) GDPR.
6 Data retention period
Video recordings are retained for a maximum of 8 calendar days from the date of capture, unless:
- a specific incident (e.g., theft, accident, security breach) has occurred, in which case relevant footage may be retained for the duration of any investigation, legal proceeding, or insurance claim — but not beyond 30 calendar days, unless required by law enforcement or a court order;
- a data subject has submitted a request for access to footage relating to them — in which case the relevant footage will be retained until the request is fully resolved.
Recordings are automatically and securely overwritten after the retention period. Access to stored footage is strictly restricted.
7 Data recipients
Your personal data may be accessed or disclosed to the following categories of recipients:
- internal personnel: authorized employees with a legitimate need to view footage;
- law enforcement authorities: only upon lawful request and in compliance with Luxembourg criminal procedure;
- insurance providers or legal advisors: in the context of claims or litigation;
- public authorities, courts, institutions, administrations, governmental corporations: in the context of a litigation or when we are legally obliged to do so;
- subcontractors: our subcontractors such as, but without being limited to:
- the contractors in charge of the CCTV System’s operation, maintenance and/or technical support;
- the contractors in charge of the security of our buildings;
- our IT service providers, auditors, advisors and external consultants;
- our assets managers;
- Technopolis Holding Plc and its affiliates.
Your personal data is not regularly processed outside the European Union (EU) and the European Economic Area (EEA). In case your personal data mentioned in this Policy have to be processed outside the EU and the EEA, we will do it only in the following cases:
- if such countries are granted an adequacy decision by the European Commission;
- if such countries have not been granted an adequacy decision by the European Commission:
- if one of the conditions laid down by article 49 GDPR is met; or
- if appropriate safeguards are provided in accordance with article 46 GDPR.
8 Your rights as a data subject
Under the GDPR, you have the following rights regarding your personal data processed via the CCTV System:
| Right | Description |
|---|---|
| Access | You may request a copy of any footage in which you are identifiable. |
| Rectification | You may request correction of inaccurate data (if applicable). |
| Erasure (Right to be Forgotten) | You may request deletion of your personal data, subject to legal retention obligations. |
| Restriction of Processing | You may request temporary suspension of processing under certain conditions. |
| Objection | You may object to processing based on legitimate interests, and we will cease processing unless we demonstrate compelling legitimate grounds. |
| Data Portability | Not applicable, as video footage is not structured personal data in a machine-readable format. |
| Lodge a Complaint | You have the right to lodge a complaint to the Commission Nationale pour la Protection des Données (“<strong>CNPD</strong>”) which is the Luxembourg supervisory authority for data protection issues. We would, however, appreciate the chance to discuss with you about your concerns before you reach out to the CNPD so please do not hesitate to contact us.<br>The details of the CNPD are the following:<br>Commission nationale pour la protection des données<br>15, Boulevard du Jazz<br>L-4370 Belvaux<br>Phone: (+352) 26 10 60 -1 |
To exercise any of these rights, please submit a written request to our contact person (see Section 9 below). We will respond within one month (extendable to two months for complex requests). To protect your privacy and prevent unauthorised access, you may be asked to provide proof of identity.
9 Contact
For questions, requests, or complaints regarding this CCTV System, this Policy or your personal data, please contact:
Mr. Valentin Tosolini by email addressed to Valentin.Tosolini@technopolis.lu or by mail addressed to the attention of Mr. Valentin Tosolini at:
KOWAC S.à r.l.
Société à responsabilité limitée
40, Rue de la Vallée
L-2661 Luxembourg
R.C.S. Luxembourg: B240412
10 Updates to this policy
We may update this Policy from time to time to reflect changes in law, technology, or our practices. The most current version will always be available on our website and at our reception in the building C / entrance C1 of the TECHNOPOLIS complex.
Updated 30 July 2026