Locky › Documents › Privacy policy
Privacy Policy & CCTV Notice
This privacy policy explains how Locky processes personal data (Article 13 GDPR), including CCTV recordings. Its current version is always at lockylodz.pl/en/privacy.
Data Controller
The controller of personal data, including images recorded by CCTV, is B&b Rentals Bartosz Kuźmiński, Tax ID (NIP) 727-246-57-74, ul. Uniwersytecka 42/44 m12, 90-233 Łódź, Poland, e-mail: kontakt@lockylodz.pl.
Data processed
The system may record image, appearance and behaviour in the monitored area, recording date and time and – depending on the access/payment system – technical information connected with locker use and payment. No audio is recorded.
Purposes and legal basis
CCTV is used for the safety of persons, protection of property, prevention and investigation of incidents, supervision of the proper operation of the location and the establishment, exercise or defence of legal claims. The legal basis is Article 6(1)(f) GDPR – legitimate interests pursued by the Controller and users of the location.
Recipients
Recordings may be accessed only by authorised persons and, where necessary, service providers operating CCTV, IT, security or maintenance under appropriate agreements. Data may be disclosed to competent public authorities where legally required.
Retention
As a standard policy, recordings are retained for no longer than 30 days and then automatically overwritten or deleted, unless footage has been secured in connection with an incident, complaint, proceedings or legal claim, in which case it may be retained for as long as necessary to resolve the matter.
Your rights
Subject to GDPR and the rights of other persons visible in footage, you may have rights of access, erasure, restriction and objection to processing based on Article 6(1)(f). To locate relevant footage and verify identity, the Controller may request an approximate time and place and reasonable identifying information.
Complaint to supervisory authority
You have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO) if you consider that processing infringes GDPR.
Transfers outside the EEA
The Controller does not intend to transfer CCTV recordings outside the European Economic Area.
Automated decisions
CCTV footage is not used for automated decision-making or profiling producing legal effects concerning individuals.
Layered information
A short CCTV notice is displayed before entry to the monitored area. The full information is available by QR code / website and at the Location. This layered approach keeps the entrance notice readable while providing the complete Article 13 information.
Website
The lockylodz.pl website is hosted by OVHcloud on servers in the European Union. It stores no cookies and nothing in your browser’s storage, which is why it shows no consent banner.
Anonymous visit statistics (page views, referrer, country, button clicks) are collected by PostHog on servers in the European Union, without any identifier stored in your browser. The legal basis is Article 6(1)(f) GDPR – the Controller’s legitimate interest in improving the website.
Contact form
If you write to us through the form on the website, we process the name, e-mail address and message you give us in order to answer your question. The legal basis is Article 6(1)(f) GDPR – the Controller’s legitimate interest in answering enquiries, or Article 6(1)(b) GDPR where the question concerns entering into a contract.
The website does not store the message: it is e-mailed to kontakt@lockylodz.pl and kept for as long as needed to handle the enquiry and any claims. To limit spam, a hash of the sender’s IP address (not the address itself) is kept for one hour.