This Privacy Notice explains how Lyle & Scott uses Closed-Circuit Television (CCTV) systems at its premises and how we process personal data captured by those systems.

We use CCTV to help maintain a safe and secure environment for our employees, customers, visitors, contractors and members of the public, and to protect our premises, stock, equipment and other assets.

CCTV is operated in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The data controller responsible for the CCTV system is:

Lyle & Scott Limited
37 Kentish Town Road, London, NW1 8NX
04111248

For questions relating to the use of CCTV or the processing of personal data, please contact:

Email: dataprotection@lyleandscott.com
Telephone: 0330 0570817

CCTV may be used for the following purposes:

• To protect the safety and security of employees, customers, visitors and contractors.

• To prevent and detect crime, theft, fraud and other unlawful activity.

• To protect company property, stock, equipment and other assets.

• To investigate suspected incidents or allegations of misconduct.

• To assist with the investigation of accidents, security incidents and other events.

• To support the prevention and investigation of unauthorised access to our premises.

• To provide evidence to the police, courts, insurers or other authorised organisations where appropriate.

• To assist with the resolution of disputes or complaints relating to incidents occurring on our premises.

CCTV will not normally be used for purposes unrelated to the purposes described above.

Our CCTV systems may capture:

• Images of individuals.

• Date and time of an incident or recording.

• Location of the CCTV camera.

• Images of vehicles and, where visible, vehicle registration numbers.

• Other information visible within the camera's field of view.

CCTV systems may record continuously or be activated by movement or other configured triggers, depending on the camera and its purpose.

Our primary lawful basis for processing CCTV images is legitimate interests under Article 6(1)(f) of the UK GDPR.

These legitimate interests include maintaining the security of our premises, protecting people and property, preventing and detecting crime, and investigating incidents.

Where required, we will consider the impact of CCTV on individuals' privacy and ensure that its use is proportionate and necessary for the purposes for which it is deployed.

Where CCTV captures special category data incidentally, we will ensure that any additional requirements under applicable data protection legislation are met where relevant.

CCTV may operate in areas including:

• Entrances and exits.

• Reception areas.

• Retail areas and shop floors.

• Warehouses and distribution areas.

• Loading and delivery areas.

• Car parks and external areas.

• Other areas where CCTV is necessary for security or safety purposes. 

CCTV will not normally be installed in areas where individuals would have a reasonable expectation of privacy, such as toilets or changing rooms.

Appropriate signage will be displayed in areas where CCTV is in operation.

Access to CCTV recordings is restricted to authorised personnel who have a legitimate business need to access the information.

CCTV recordings may also be disclosed where appropriate to:

• The police and other law enforcement authorities.

• Courts and tribunals.

• Our insurers or professional advisers.

• Security or other service providers acting on our behalf.

• Other third parties where we are legally required or permitted to disclose the information.

We will not routinely sell, rent or otherwise disclose CCTV recordings for commercial purposes.

Where CCTV systems are operated or supported by third-party service providers, those providers may process CCTV information on our behalf.

Where applicable, we will ensure that appropriate contractual and security arrangements are in place with such providers and that they process personal data only in accordance with our instructions and applicable data protection legislation.

CCTV recordings are normally retained for [30 days], after which they are securely deleted or overwritten.

Where a recording is relevant to an incident, investigation, complaint, insurance claim, legal matter or suspected criminal activity, it may b retained for longer where this is necessary and proportionate.

Once the relevant matter has been resolved and there is no longer a legitimate reason to retain the recording, it will be securely deleted.

We take appropriate technical and organisational measures to protect CCTV recordings against:

• Unauthorised access.

• Unauthorised disclosure.

• Accidental loss or destruction.

• Unauthorised alteration or use.

Access to CCTV systems is restricted to authorised individuals and, where appropriate, protected through authentication and access controls.

Depending on the circumstances, you may have rights under UK data protection legislation, including the right to:

• Request access to personal data we hold about you.

• Request correction of inaccurate personal data.

• Request deletion of personal data where applicable.

• Request restriction of processing where applicable.

• Object to processing where we rely on legitimate interests.

• Lodge a complaint with the Information Commissioner's Office (ICO).

Some rights are subject to exemptions and may not apply in every circumstance.

If you believe you have been captured by our CCTV system, you may make a Subject Access Request (SAR) to request a copy of footage containing your personal data.

Requests should be sent to:

Email: dataprotection@lyleandscott.com

Postal Address: 37 Kentish Town Road, London, NW1 8NX 

To help us locate the relevant footage, you should provide as much information as possible, including:

• Your full name.

• The date and approximate time of the incident.

• The location where you believe you were recorded.

• A description of yourself and, where relevant, the clothing you were wearing.

• Any other information that may help us identify the relevant footage.

We may need to verify your identity before providing CCTV footage.

Where footage contains images of other individuals, we may need to obscure or otherwise protect their personal information before providing footage to you. In some circumstances, we may be unable to provide footage where an applicable legal exemption applies.

Where appropriate, CCTV recordings may be provided to the police or other law enforcement authorities for the prevention or detection of crime or for the investigation of an offence.

We may also preserve relevant CCTV footage where we reasonably believe it may be required for legal proceedings or an investigation.

Where CCTV recordings or related personal data are transferred outside the UK, we will ensure that an appropriate lawful transfer mechanism and safeguards are in place in accordance with applicable data protection legislation.

We may update this Privacy Notice from time to time to reflect changes to our CCTV systems, business operations or applicable legal requirements.

The latest version will be made available through appropriate company communication channels and/or on our website.

If you have concerns about the way we use CCTV or process your personal data, please contact us in the first instance using the contact details above.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

You can find information about making a complaint on the ICO's website.