Oy Rova-Rest Ab

Personal Data Registry and Privacy Statement: video surveillance

This is Oy Rova-Rest Ab’s Personal Data Registry and Privacy Statement concerning video surveillance, following the legislation set by the Finnish Personal Data Act (10 & 24 §), as well as the European General Data Protection Regulation (GDPR). Created 1.3.2021.

 1. Registry holder

Oy Rova-Rest Ab and its locations of business:

2. Contact person in charge of registry

Yann Verbrugghe, responsible for video surveillance system

Tel. +358 10 230 5383, e-mail: yann@verbrugghe.fi

Hilla-Rina Palokari, CEO

Tel. +358 10 230 5382, e-mail: hilla-rina@palokari.fi  

3. Name of registry

Company’s Video Surveillance Data Registry.

4. Legal basis and purpose of handling personal data

According to the European GDPR, legal basis of handling personal data is present when there exists: 
– consent from the person in question (documented, voluntary, identified, conscious and unambiguous)

– a contract, in which the registered person represents the other party

– management of public tasks or

– justified interest of the registry holder (i.e. customer relationship, contract of employment, membership).

The purpose of recording video surveillance data at Oy Rova-Rest Ab is the following: 

Concerning our customers in the common inner and outer spaces (registry in accordance with the Finnish Personal Data Act (523/99)):


• With the recorded video surveillance footage the accommodator looks after personal safety, safety of business, as well as cares for the prevention of criminal activities to the detriment of the property of the accommodator and lastly, clarifying potential questions on liability. The video surveillance also supports the accommodator’s maintenance of order as well as maintenance of the property.

Concerning our staff in the common inner and outer spaces (registry in accordance with the Finnish Act on the Protection of Privacy in Working Life (759/2004§):

• Employers have the right to use the data registry of video surveillance for the following purposes: 

  • to resolve or prove any kind of interference, harassment, or/and unprofessional behavior based on the Act on Equality between Men & Women (609/1986) and the Occupational Safety & Health Act (738/2002).
  • to resolve a situation involving a workplace accident or other endangering situation described in the Occupational Safety & Health Act.
  • in the event of proving reasons having led to the dismissal of a contract of employment in situations specified in 17§, paragraph 2, part 1-3 of the Act on the Protection of Privacy in Working Life.   

The people keeping the register and other determined responsible persons have the right, if needed, to follow the video surveillance footage in real time to the extent which is deemed necessary for the surveillance of security and course of events. 

5. The data content of the registry 

The data saved on the Data Registry of Video Surveillance is the video footage of the surveillance cameras with added technical information i.e. location of the camera with the date and hour of filming, if needed.

The surveillance footage exists up to maximum of 30 days, after which the previous footage is overwritten by the new footage.

6. Regular information sources 

The data saved into the registry is received through the video surveillance system installed at the accommodator’s place of business. The registry has no contact with other informants. 

7. Regular delivery and transfer of data, also outside of the EU or the EEA

It is possible for the reception of the accommodator or the determined responsible persons to follow the video surveillance footage in real time at the accommodator’s premises to the extent needed for the security of the location. Video surveillance data is not regularly given out to other parties. Data is processed only in situations in accordance with situations mentioned in part 4 of this Data Registry of Video Surveillance-file.

In the event, that a person wants to review video surveillance footage concerning themselves, the demand can be presented either in written form or personally at the accommodator’s place of business. Everyone has the right to review information on their person according to the Personal Data Act and the applicant must inform a sufficiently accurate time and place for the recording concerning their person. The data is preserved in our registry up to a maximum of 30 days after which the previous footage is overwritten by the new recording. In exceptional cases the recording is saved as long as the recording presents no more use. 

The data can be published to the extent which has been agreed on with the customer. Information can be transferred by the registry holder outside of the EU and EEA countries.  

8. Informing customers and employees according to the Personal Data Act

Customers and employees are notified of recoding video surveillance at the entrance and this Data Registry of Video Surveillance-file is visible to all through the accommodator’s website and reception (visiting addresses to be found on websites of each destination).

9. Principles of registry protection

No manual paper material is linked to this registry. The electronic material is to be found in the camera surveillance systems located in a surveilled space on the accommodator’s premises. The use of said registry is only permitted to the determined responsible persons and to those, who need said information in order to complete their work tasks. Information is given out only in accordance with the situations described in part 4 of this Data Registry of Video Surveillance-file. The recorded footage is only kept for a maximum of 30 days but in the case that it would be needed to resolve a situation described in part 4 of this Data Registry of Video Surveillance-file, the footage in question is separately saved on an outer hard drive until the said situation has been cleared up.

10. The right to verify data and demand correction

Each person belonging to the registry has a right to check the saved personal data on them and demand possible rectification of false information or add more specifications to inadequate information. Whether a person wishes to review personal data on him/her saved into the registry or wishes to make a correction to it, the demand must be sent in written form by e-mail to the registry holder. The registry holder may ask the person to prove their identity. The registry holder will answer to the demand within the time set by the European GDPR (mainly withing a month). You can check other possible rights through this link: rights according to the European GDPR.