Industrial Security · Privacidad

Purpose

Management and control of the video surveillance and access control systems in the entity’s facilities to ensure the security of people, property, buildings, and installations.

Entity in charge

NAVANTIA S.A. S.M.E.
A84076397
C/Velázquez, 132 - 28006 MADRID (Madrid)
(+34) 913 358 400
[email protected]
[email protected]

Legal basis

The legal basis for the processing is:

Article 6(1)(e) of GDPR: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller:
- Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights.
- Law 5/2014, of April 4, on Private Security.

Data retention periods

Video surveillance recordings: kept for a maximum period of 1 month from the date of collection, unless subject to an investigation by the Security Forces or the Courts.
Access control data: kept for a maximum period of 5 years from the date of collection.

Affected groups

Employees, visitors, clients, or suppliers who access video-surveilled areas or pass through access controls at Navantia.

Data type - Infringement

Data not processed.

Data types - Special categories

Data not processed.

Data type - Identification data

Name and surname
NIF (NIE, Passport, or Residence Card Number)
Image
Employee Number
Vehicle Registration

Data type - Other

Employment details
Company or entity where they work and the area/department they are heading to

Security measures

The security measures applied correspond to those provided in Annex II (Security Measures) of Royal Decree 311/2022, of May 3, which regulates the National Security Scheme in the field of Electronic Administration and are described in the documents forming part of Navantia’s Data Protection and Information Security Policy. Security measures corresponding to Annex A of UNE-EN/IEC 27001 - Information Security Management Systems.

Organizational Measures:

Personnel accessing the system have a duty of confidentiality and secrecy.
Access to personal data by unauthorized persons is prevented.
Paper documents are stored in a secure location (cabinets or restricted access areas) 24 hours a day.
Documents or electronic media (CDs, pen drives, hard drives, etc.) containing personal data will not be discarded without ensuring their destruction.
The duty of secrecy and confidentiality persists even after the employee’s employment relationship with the company ends.

Technical Measures:

System access control through user identification in access control and video surveillance systems.
The systems follow Navantia’s information security policy.
These security measures are reviewed periodically, either by automatic mechanisms (software/tools) or manually.

Additionally, security measures are adopted for paper-based documentation according to the risks to which they are exposed, in order to ensure the confidentiality of the processed data.

Communication

Communications are foreseen when data communication can be carried out in accordance with Article 6 of GDPR regarding the legitimacy of the processing to:

State Security Forces and Bodies
Courts of Justice

Access Registries:

Cadiz Bay:

Auxiliary Industry Access Registry: Maintenance and General Services Department of Bahía de Cádiz
Auxiliary Industry Access Registry: Auxiliary Industry Coordination Office of Bahía de Cádiz
Auxiliary Industry Access Registry: Project Management of DDG’s US Navy Repairs, Naval Base of Rota
Access Registry: Production Department of Bahía de Cádiz
Access Registry: Human Resources Department of Bahía de Cádiz
Access Registry: Management of the Shipyards of Bahía de Cádiz

Cartagena’s Dock:

Auxiliary Industry Access Registry: Production Manager
Incident Access Registry: HR Manager
Auxiliary Industry Access Registry: Quality Manager

Ferrol Estuary:

Armament Dock Access Registries: Program and Production Managers of NFBI
Facility Access Registries: Main Business Managements in Ferrol and Fene
Employee Facility Access Registries: Human Resources Management of Ría de Ferrol (Operations Department)
Private Vehicle Access Registry: Legal Advisory Office of the shipyard

Madrid:

Access Registry: Human Resources Management

International transfers

Not foreseen.