CCTV Policy
Durham Coins Ltd
12 High Street, Durham, DH1 3UJ
Email: sales@durhamcoins.co.uk
Telephone: 0191 722 1421
CCTV Responsible Person: Paul Burke
Policy Effective Date: September 2026
Policy Version: 1.0
Next Review Date: September 2027
1. PURPOSE AND SCOPE
1.1
Durham Coins Ltd ("Durham Coins", "the Company", "we", "us or "our") operates a comprehensive Closed-Circuit Television ("CCTV") surveillance system throughout its retail premises.
1.2
The CCTV system is operated principally for the following purposes:
the prevention and detection of crime;
the protection of the Company's premises, stock, assets and property;
the protection of the safety and security of employees, customers, contractors, visitors and other persons attending the premises;
the investigation of suspected criminal, fraudulent or unlawful activity;
assisting the Police and other competent authorities where disclosure is lawful and appropriate;
investigating incidents involving theft, attempted theft, damage, violence, threats or other security concerns; and
establishing the circumstances surrounding security, safety or other relevant incidents.
1.3
The CCTV system is not intended to constitute general or disproportionate monitoring of employees, customers or visitors. CCTV will be operated only for legitimate, lawful and proportionate purposes consistent with this Policy.
1.4
This Policy applies to all CCTV equipment operated by or on behalf of Durham Coins at or in connection with its premises, together with all recorded images, associated information and persons authorised to access or manage such information.
2. DATA CONTROLLER
2.1
For the purposes of applicable data protection legislation, Durham Coins Ltd is the data controller in respect of personal data obtained through its CCTV system.
2.2
The Company's contact details are:
Durham Coins Ltd
12 High Street
Durham
DH1 3UJ
Email: sales@durhamcoins.co.uk
Telephone: 0191 722 1421
2.3 CCTV RESPONSIBLE PERSON
The person responsible for the administration and oversight of the Company's CCTV system is:
Paul Burke
CCTV Responsible Person
Durham Coins Ltd
12 High Street
Durham
DH1 3UJ
Email: sales@durhamcoins.co.uk
Telephone: 0191 722 1421
2.4
Paul Burke is responsible for overseeing the Company's compliance with this Policy and for ensuring that appropriate arrangements are maintained concerning CCTV access, security, retention, disclosure and the handling of requests relating to recorded footage.
3. LEGAL AND REGULATORY FRAMEWORK
3.1
CCTV images of identifiable individuals constitute personal data and their collection, recording, storage, retrieval and disclosure are subject to applicable data protection legislation.
3.2
The Company's use of CCTV will be governed by, where applicable:
the UK General Data Protection Regulation ("UK GDPR");
the Data Protection Act 2018 ("DPA 2018");
applicable provisions of the Protection of Freedoms Act 2012;
applicable employment and other relevant legislation; and
relevant guidance issued by the Information Commissioner's Office ("ICO").
3.3
The Company will operate its CCTV system in accordance with the applicable data protection principles, including lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.
4. LAWFUL BASIS FOR PROCESSING
4.1
The Company considers that the principal lawful basis for its ordinary use of CCTV is Article 6(1)(f) UK GDPR — legitimate interests.
4.2
The Company's legitimate interests include:
the prevention and detection of crime;
protection against theft, fraud and other unlawful activity;
protection of employees, customers and visitors;
protection of premises, stock and other Company property;
investigation of security and safety incidents; and
cooperation with the Police and other competent authorities where appropriate.
4.3
The Company will maintain appropriate documentation supporting its assessment of the necessity and proportionality of CCTV and will review that assessment where there is a material change to the system, its purposes or the circumstances in which it operates.
4.4
CCTV will not ordinarily be operated on the basis of consent. The Company's reliance upon legitimate interests does not remove its obligation to provide appropriate transparency information to individuals whose images are captured.
5. NECESSITY AND PROPORTIONALITY
5.1
The Company considers CCTV to be a necessary and proportionate security measure having regard to the nature of its retail premises, the value and nature of goods held and the legitimate requirement to protect employees, customers, visitors, property and stock.
5.2
Cameras will be positioned so far as reasonably practicable to achieve the Company's stated purposes without unnecessarily capturing areas in which individuals would have a reasonable expectation of privacy.
5.3
The Company will periodically review camera positioning and coverage to ensure that surveillance remains appropriate and proportionate.
5.4
CCTV will not be installed or deliberately operated in areas where individuals would ordinarily have a reasonable expectation of privacy, including toilets, changing areas or other comparable private spaces.
6. AREAS SUBJECT TO CCTV
6.1
The Company's CCTV system provides comprehensive coverage of relevant areas of the retail premises for crime prevention, security and safety purposes.
6.2
Depending upon the configuration of the system, cameras may monitor areas including:
entrances and exits;
customer areas;
sales and display areas;
till and transaction areas;
stock and storage areas;
relevant staff and operational areas;
external approaches to the premises; and
other areas reasonably necessary for the protection of the premises and persons attending them.
6.3
The precise location, coverage and technical configuration of individual cameras may be treated as security-sensitive information and will not ordinarily be disclosed publicly where doing so could undermine the effectiveness of the Company's security arrangements.
7. CCTV RECORDING
7.1
The CCTV system may operate continuously and may record images whenever the system is active.
7.2
Recorded images may include images of employees, customers, visitors, contractors, delivery personnel and members of the public who enter areas covered by the system.
7.3
Where CCTV captures an individual who can be identified, the resulting recording will be treated as personal data and handled in accordance with applicable data protection legislation.
7.4
The Company will not deliberately configure or operate the CCTV system to collect information beyond that reasonably necessary for its stated purposes.
8. AUDIO RECORDING
8.1
The Company will not intentionally record or retain audio through the CCTV system unless there is a specific, documented and lawful justification for doing so.
8.2
Where any CCTV equipment has an audio-recording capability, that functionality will remain disabled unless the Company has separately assessed the necessity, proportionality and lawful basis for its use.
8.3
Any future introduction of audio recording will be subject to an appropriate review of privacy, data protection and proportionality considerations before activation.
9. USE OF CCTV IMAGES
9.1
CCTV images may be reviewed and used where reasonably necessary for the purposes identified in this Policy.
9.2
Permitted uses may include:
investigating suspected theft or attempted theft;
investigating fraud or suspected fraudulent activity;
investigating damage to Company property;
investigating violence, threats, harassment or other inappropriate conduct;
protecting employees, customers or visitors;
investigating accidents or safety incidents;
identifying persons suspected of committing offences;
assisting the Police or other competent authorities;
responding to legitimate legal or regulatory requirements; and
establishing or defending the Company's legal rights.
9.3
CCTV images will not ordinarily be used for unrelated purposes unless the Company has established an appropriate lawful basis for such use and the use is otherwise permitted under applicable data protection legislation.
10. EMPLOYEE MONITORING
10.1
CCTV is not intended to constitute routine performance monitoring of employees.
10.2
Where CCTV footage is relevant to a genuine investigation concerning suspected misconduct, theft, dishonesty, violence, breach of security or another serious matter, the Company may review relevant footage where doing so is lawful, necessary and proportionate.
10.3
Any use of CCTV footage in connection with employment matters will be undertaken fairly and in accordance with applicable employment and data protection requirements.
10.4
The Company will not use CCTV merely to monitor employee productivity, attendance or general behaviour unless there is a specific and properly documented lawful justification for doing so.
11. CCTV SIGNAGE AND TRANSPARENCY
11.1
The Company will provide appropriate and sufficiently prominent signage informing individuals that CCTV surveillance is in operation.
11.2
CCTV notices will, where appropriate, identify:
that CCTV recording is taking place;
the principal purposes of the surveillance;
the identity of the organisation operating the system; and
appropriate contact information or directions to further privacy information.
11.3
Where practicable, signage will be positioned so that individuals are informed of the surveillance before entering the relevant area.
12. STORAGE AND SECURITY OF CCTV FOOTAGE
12.1
CCTV footage will be stored using appropriate technical and organisational security measures designed to prevent unauthorised access, alteration, disclosure, loss or destruction.
12.2
Access to recorded footage will be restricted to persons who have a legitimate operational requirement to access it and who are appropriately authorised by the Company.
12.3
Where CCTV equipment or storage systems are managed by an external service provider, the Company will take appropriate steps to ensure that the provider processes information only in accordance with the Company's instructions and applicable data protection requirements.
12.4
Passwords, access credentials and other security information relating to the CCTV system must be kept confidential and must not be disclosed to unauthorised persons.
12.5
Persons authorised to access CCTV footage must take reasonable precautions to prevent accidental disclosure, copying, downloading, photographing or distribution of recordings.
13. RETENTION OF CCTV FOOTAGE
13.1
Durham Coins Ltd retains CCTV recordings for a maximum period of 45 days from the date on which the recording is made, unless a longer period is lawfully required or justified in accordance with this Policy.
13.2
At the expiry of the 45-day retention period, CCTV footage will be automatically overwritten or securely deleted, subject to any lawful preservation requirement.
13.3
Where footage is relevant to an actual or suspected incident, investigation, complaint, legal claim, criminal investigation or other legitimate matter, the relevant recording may be preserved beyond the ordinary 45-day retention period where this is necessary and lawful.
13.4
Where footage is preserved beyond 45 days, access will remain restricted and the Company will retain the footage only for as long as is reasonably necessary for the particular purpose for which it has been preserved.
13.5
Once preserved footage is no longer required, it will be securely deleted or otherwise disposed of in a manner designed to prevent unauthorised recovery or access.
14. DISCLOSURE OF CCTV FOOTAGE TO THIRD PARTIES
14.1
CCTV footage will not be disclosed to third parties except where there is a lawful and appropriate basis for disclosure.
14.2
Circumstances in which disclosure may be appropriate include:
requests from the Police in connection with the prevention or detection of crime;
requests from other law enforcement or competent authorities;
compliance with a court order or other legal obligation;
investigation of a serious incident;
establishment, exercise or defence of legal claims;
disclosure to insurers or professional advisers where reasonably necessary and lawful; or
responding to a valid data protection rights request.
14.3
Before disclosure is made, the Company will consider whether the disclosure is lawful, necessary and proportionate and whether the recipient is entitled to receive the information.
14.4
Where footage contains images of other identifiable individuals, the Company will consider whether redaction, masking or other measures are required before disclosure.
15. REQUESTS FOR CCTV FOOTAGE BY INDIVIDUALS
15.1
An individual may have rights under applicable data protection legislation in relation to CCTV footage in which they are identifiable.
15.2
A person seeking access to CCTV footage concerning them should contact:
Paul Burke
CCTV Responsible Person
Durham Coins Ltd
12 High Street
Durham
DH1 3UJ
Email: sales@durhamcoins.co.uk
Telephone: 0191 722 1421
15.3
Requests should, where possible, provide sufficient information to allow the Company to locate the relevant footage, including:
the date and approximate time;
the location;
a description of the individual;
the nature of the incident, where relevant; and
any other information that may assist in identifying the relevant recording.
15.4
The Company may need to verify the identity of the requester before providing personal data.
15.5
Where footage contains information relating to other individuals, the Company will consider their rights and may need to redact or otherwise protect third-party information before disclosure.
15.6
The Company will deal with requests for access to personal data in accordance with applicable statutory requirements and its data protection procedures.
16. POLICE AND LAW ENFORCEMENT REQUESTS
16.1
The Company may provide CCTV footage to the Police or another competent authority where there is a lawful basis for doing so.
16.2
Employees must not provide CCTV footage to law enforcement personnel or any other third party unless they are authorised to do so or the disclosure has been appropriately approved.
16.3
Where appropriate, the Company may preserve relevant footage following an incident or request to prevent its automatic deletion before the matter has been concluded.
17. PROHIBITED USE
17.1
CCTV footage must not be:
accessed without authorisation;
copied or downloaded for personal purposes;
disclosed to friends, family or other unauthorised persons;
uploaded to social media or other public platforms without lawful authority;
used for personal entertainment or curiosity;
manipulated or altered in a manner that misrepresents the original recording; or
used for any purpose inconsistent with this Policy without appropriate authorisation and lawful justification.
17.2
Any misuse of the CCTV system or CCTV footage may constitute a disciplinary matter and, where appropriate, may result in civil or criminal proceedings.
18. CCTV SYSTEM MANAGEMENT
18.1
Paul Burke, as the Company's designated CCTV Responsible Person, will oversee the administration and appropriate operation of the CCTV system.
18.2
The Company will take reasonable steps to ensure that the CCTV system remains operational, secure and appropriately configured.
18.3
The Company will periodically review:
camera positioning and coverage;
system security;
access permissions;
the 45-day retention arrangement;
signage and privacy information;
the purposes and lawful basis for processing;
requests for access to footage;
disclosures to third parties; and
whether the continued operation of the CCTV system remains necessary and proportionate.
18.4
Where material changes are made to the CCTV system, the Company will assess whether its existing privacy documentation, risk assessments and policies require amendment.
19. DATA PROTECTION IMPACT ASSESSMENT
19.1
The Company will assess whether a Data Protection Impact Assessment ("DPIA") is required before introducing new surveillance technology or materially changing the existing CCTV system.
19.2
A DPIA may also be undertaken where the Company considers that CCTV processing is likely to result in a high risk to individuals' rights and freedoms.
19.3
Where a DPIA identifies significant risks, the Company will implement appropriate measures to mitigate those risks before proceeding, where reasonably practicable.
20. PRIVACY
20.1
The Company recognises that CCTV involves the collection of information about individuals and therefore has potential implications for privacy.
20.2
The Company will seek to balance its legitimate security interests against the privacy and other rights of individuals.
20.3
The Company will operate CCTV in a manner that is intended to be lawful, fair, transparent, necessary and proportionate.
21. RELATIONSHIP WITH THE PRIVACY POLICY
21.1
This CCTV Policy should be read together with the Company's Privacy Policy and other applicable data protection policies and procedures.
21.2
The Company's Privacy Policy provides additional information concerning how personal data is collected, used, stored and protected by Durham Coins.
21.3
Where there is any inconsistency between this Policy and applicable legislation, the legislation will prevail.
22. STAFF RESPONSIBILITIES
22.1
Employees who are authorised to access or operate the CCTV system must:
comply with this Policy;
maintain the confidentiality and security of CCTV information;
access footage only where authorised and necessary;
refrain from making unauthorised copies;
report suspected security breaches or misuse promptly;
recognise and appropriately escalate requests relating to personal data; and
cooperate with the Company's data protection procedures.
22.2
Staff must not disclose information concerning CCTV coverage, security arrangements or recordings except where authorised to do so.
23. SECURITY INCIDENTS AND DATA BREACHES
23.1
Any suspected loss, theft, unauthorised access, disclosure, alteration or destruction of CCTV footage must be reported to Paul Burke immediately.
23.2
The Company will assess any suspected personal data breach in accordance with its data breach procedures and applicable data protection legislation.
23.3
Where required by law, the Company will notify the ICO and/or affected individuals within the applicable statutory timescales.
24. COMPLAINTS AND ENQUIRIES
24.1
Any individual who has concerns regarding the operation of the Company's CCTV system should contact Paul Burke in the first instance.
Paul Burke
CCTV Responsible Person
Durham Coins Ltd
12 High Street
Durham
DH1 3UJ
Email: sales@durhamcoins.co.uk
Telephone: 0191 722 1421
24.2
The Company will investigate complaints concerning the operation or use of CCTV in accordance with its complaints and data protection procedures.
24.3
Individuals retain the right to raise concerns directly with the Information Commissioner's Office where they consider that their personal data has not been processed in accordance with applicable data protection law.
25. POLICY REVIEW
25.1
This Policy will be reviewed at least annually and whenever there is a material change to:
the Company's CCTV system;
the purposes for which CCTV is used;
applicable legislation or regulatory guidance;
the Company's premises or security requirements; or
the Company's data protection practices.
25.2
The next scheduled review of this Policy is September 2027.
25.3
The Company will take reasonable steps to ensure that this Policy remains accurate, current and consistent with the actual operation of its CCTV system.
26. CONTACT DETAILS
Durham Coins Ltd
12 High Street
Durham
DH1 3UJ
CCTV Responsible Person: Paul Burke
Email: sales@durhamcoins.co.uk
Telephone: 0191 722 1421
Policy: CCTV Policy
Version: 1.0
Effective Date: September 2026
Next Review Date: September 2027