This privacy notice explains the kind of personal data ALKALOID AD Skopje (hereinunder: Controller) collects on you when visiting the official/business premises and how the Controller uses this data. 

1. Why do we collect/process personal data? 

The Controller collects data through the video surveillance system for the following reasons/purposes: 

• To control access to the premises (building, entrance, facilities) and to ensure the security of the premises, the safety of Controller's staff and visitors, as well as property and information located or stored on the premises; 

• To prevent, deter, and if necessary, investigate unauthorised physical access, including unauthorised access to secure and protected facilities, IT infrastructure, or operational information; and 

• To prevent, detect and investigate destruction and theft of equipment, assets, and products owned by the Controller, visitors, or staff, or threats to the safety of personnel working at the premises (e.g., injury at work, fire, physical assault). 

The video surveillance system is not used for any other purpose, such as to monitor the work of employees or their attendance. The positioning of the video cameras is such that they do not cover the surrounding public space. The cameras are aimed to give a general overview of what is happening in certain places but not to recognize persons. 

The system is also not used as an investigative tool or to obtain evidence in internal investigations or disciplinary procedures unless a security incident is involved, which the video surveillance is installed for, under the Law on Data Protection. (In exceptional circumstances, we may transfer the data to investigatory bodies in the framework of a formal disciplinary or criminal investigation). 

The video surveillance cameras are installed at all sites/premises owned by the Controller and are placed and so focused that they film only people who access the official/business premises/facilities, including property. 

The video surveillance system covers the following area:  

• Perimeter fence around the Company’s site (property) 

• Entrances at the perimeter fence,  

• Secured entrances to sites, 

• Entrances to premises, 

• Internal roads, 

• Internal parking lots, 

• Facilities in premises for production or storage of specific products, including narcotic products, 

• Facilities in premises where information technology, telecommunications, or other power equipment is installed, 

• Facilities in premises for archiving/storage of documents, 

• Facilities in premises for storage of particularly valuable spare parts and equipment, 

2. What kind of data does the Controller collect? 

The Controller collects just images caught on camera and does not record voice. 

3. Who is responsible for the data processing? 

The Controller is an entity that processes personal data and determines the objectives of this processing operation, solely in compliance with the Law on Personal Data Protection. Moreover, the Head of General Services Kjire Kocev is the contact person and responsible person for this operation.

4. What is the legal basis for this processing of personal data through the video surveillance system? 

The Controller uses video-surveillance equipment for (list one or more of the listed purposes): 

• Protection of the life and health of people; 

• Protection of property; 

• Protection of the life and health of employees due to the nature of operation; or 

• Entry and exit control to/from official or business premises. 

Therefore, the processing is lawful under Article 90 of the Law on Personal Data Protection. 

In addition, at the entrance of ALKALOID AD Skopje, there is a visible and clearly posted notice about the video surveillance that allows data subjects to learn about the video surveillance, the name of the Controller performing video surveillance, and how they can obtain information about where and for how long the recordings of the video surveillance system are stored. 

5. Who can see my personal data? 

Only a person authorised for video surveillance can access the recordings (such as Controller’s employees in the security and IT&T departments). Access to the digital device or hard disc recorder is limited and protected by technical data security measures (a password and recording of any log or action from the staff members or authorised persons). The data, i.e., video recordings, cannot be accessed without the authorisation of the CEO of ALKALOID AD Skopje. 

6. How to control your data? 

You can send a request by email to [email protected] or by post to the following address: Alkaloid AD Skopje, Blvd. Aleksandar Makedonski 12, 1000 Skopje, to the attention of the Personal Data Protection Officer. 

7. Can I access my data? 

You have the right to access your data at any time and free of charge by sending a request by post to: Alkaloid AD Skopje, Blvd. Aleksandar Makedonski 12, 1000 Skopje, to the attention of the Personal Data Protection Officer or by email to: [email protected]. 

8. Can I modify my data? 

Modifying the video surveillance footage is not allowed. 

9. Can I request restriction to the processing of my data? 

You have the right to restrict the processing of your data at any time by sending a request by post to: Alkaloid AD Skopje, Blvd. Aleksandar Makedonski 12, 1000 Skopje, to the attention of the Personal Data Protection Officer or by email to: [email protected]к, when you contest the accuracy of your personal data or when the Controller no longer needs the data for completing its tasks. You can also block the processing activity when the operation is unlawful, and you oppose the erasure of the data. However, blocking is not possible in case of an official investigation. 

10. Can I delete my data? 

You have the right to delete your data at any time by sending a request by post to: Alkaloid AD Skopje, Blvd. Aleksandar Makedonski 12, 1000 Skopje, to the attention of the Personal Data Protection Officer or by email to: [email protected], when the processing activity is unlawful. 

11. Do you share my personal data with other persons? 

We keep your data inside the Controller unless you ask us or give us your permission to share it. If we share your data with third parties, you will be notified to whom your personal data has been disclosed, for what purpose, and on what legal grounds. 

12. Do I have the right to object? 

Yes, you have the right to object at any time by sending a request by post to Alkaloid AD Skopje, Blvd. Aleksandar Makedonski 12, 1000 Skopje to the attention of the Personal Data Protection Officer or by email to: [email protected], when you have legitimate reasons relating to your particular situation. The Controller will address your requests within 15 days from the receipt of the request. 

13. What can I do in the event of a problem? 

a) The first step is to notify the Controller by sending an email to [email protected] and ask us to take action. 

The second step is, if you obtain no reply from us or if you are not satisfied with it, to contact our data protection officer at [email protected]. 

At any time, you can file a complaint with the Personal Data Protection Agency at www.azlp.mk, which will process your request and adopt the necessary measures. 

14. When will you start the processing of my personal data through the video surveillance system? 

The processing operation starts when you visit the Controller sites, premises, and facilities. 

15. Security of personal data 

The Controller is committed to protecting the security of your personal data. Therefore, we use security technologies and procedures to protect your personal data from unauthorised access, use or disclosure. We keep your data on computer systems that are limited access and just in a controlled environment. 

16. How long do we keep your data? 

The Controller will keep your personal data for up to 30 (thirty) calendar days after visiting our premises. After that period, any video surveillance recorded footage is automatically deleted. 

This notice is to inform the data subjects of the manner and procedure in which they can exercise their rights concerning their personal data processed by ALKALOID AD Skopje (hereinunder: ALKALOID) under the Law on Personal Data Protection.

As data subjects whose data ALKALOID has processed, you have the right to be fully informed about the following:

• The identity of the Controller (ALKALOID) and its contact details

• The contact details of the Data Protection Officer

• The purposes and legal basis for the processing

• Alkaloid's legitimate interest (if data is processed under this legal basis)

• Categories of data subjects and personal data processed

• Recipients data are disclosed to

• Retention period

• Whether the personal data is transferred to any third countries

This information on the rights of data subjects is published on Alkaloid’s website and can be obtained at its official and business premises or delivered to you directly in hard or electronic copy.

As data subjects whose data ALKALOID has processed, you have the right to request to exercise your legal rights as follows:

Right of access

On your request, Alkaloid shall inform you what data it collects on you, the purposes of the processing, the retention period, and whether it has disclosed it to third parties.

Right to rectification

On your request, Alkaloid shall rectify and complete your personal data if the data is incomplete, inaccurate, or outdated and the processing is not in compliance with the Law on Personal Data Protection.

Right to erasure

On your request, Alkaloid shall erase your personal data if the purpose it was processed for has been achieved, if you have withdrawn your consent for processing, if the data was processed unlawfully, if you object to processing, or for compliance with Alkaloid’s legal obligations to erase the data when the legal basis for processing no longer exists.

Right to restrict processing of personal data

On your request, Alkaloid shall restrict the processing of your personal data if you contest its accuracy until it verifies its accuracy, if you think the data has been unlawfully processed, but you oppose erasure, or if you need the data to exercise a legal claim.

Right to data portability

On your request, Alkaloid will transfer your personal data in a structured, commonly used, and machine-readable format or will transmit it to another company. This right applies when personal data is processed based on consent or contract and by automated means.

Right to object

You have the right to object in a specific circumstance related to you if your personal data processing is based on legitimate interest, if your personal data is processed for direct marketing and profiling related to direct marketing, or for scientific or historical research, or statistical purposes.

Right to withdraw consent

You may withdraw the consent for the processing of your personal data at any time. File the consent withdrawal request with Alkaloid, following the procedure described below.

Right not to be subjected to automated individual decision making including profiling

You have the right not to be subjected to automated decision-making, including profiling that has a legal or similarly significant effect on you.

How to file a request

To exercise your rights under Section A of this Information Notice, you may file a request. You can find the request forms to exercise each right on Alkaloid’s website. You can file a request in several ways:

а) In hard copy, by completing a request form and submitting it in person or by post in an envelope marked “Request for ______ (write the appropriate title of the request), addressed to ALKALOID AD Skopje’s archive at Blvd. Aleksandar Makedonski 12, 1000 Skopje, Republic of North Macedonia, to the attention of the Data Protection Officer.

b) Electronically, by sending a completed request form by email to the Data Protection Officer at [email protected].

c) By calling the Data Protection Officer by telephone at: +389 2 3104 000

The request should be legible, properly completed, and signed. Each request form contains completion instructions.

The request sent to Alkaloid must contain the following data:

• Your identification - full name and surname

• Your contact details: address, telephone, and email address

• Explanation and basis for the request

• If noted on the request form, proof of your identification.

Processing requests

The person responsible for the processing of your request is the Data Protection Officer. Upon receipt, the request is registered in the Request Registry, and the processing begins. If the Data Protection Officer has reasonable doubt concerning your identity as the one filing the request, he/she may require further information to confirm it. If your identity is confirmed, the request will be assessed for admissibility. If it is impossible to establish your identity even after you have submitted additional information, the request will be rejected, and the reasons explained.

The Data Protection Officer may ask for additional documents or information for you to exercise your right. We will send you a notification in hard copy or electronically to inform you about your request. We will notify you about the activities we have taken and the conclusion we have drawn and advise you on the further steps. If we reject your request, we will provide the reasons why you are unable to exercise your right, the conclusion we have drawn, and advise you on the further steps.

We will send you the notification in hard copy, or where possible electronically unless you request otherwise.

Processing periods

Alkaloid shall inform you about the activities taken without undue delay and, in any case, within the deadline prescribed by law - within one month or no later than three months for complex requests. Alkaloid shall inform you about any delay within one month from the day of receipt of the request and will provide the reasons for the delay.

Should Alkaloid fail to take action upon your request within one month from the day of receipt of the request, it must inform you about the reasons for failing to act and about the possibility to file a request with the Data Protection Agency and of the option to take judicial action.

The deadline for processing a request for rectification of your personal data is 15 days.

The deadline for processing a request for the erasure of your personal data is 30 days.

Payment of fees

Under the Law on Personal Data Protection, the information demanded in your request shall be provided free of charge. In exceptional circumstances, if Alkaloid deems your request to be evidently unfounded or excessive, especially if repetitive, it may charge a fee. You will be informed about it, considering the volume, complexity, and time necessary to provide the information or communication or process the request.

If you do not agree to pay the requested fee necessary to take the appropriate actions, Alkaloid may reject your request.

Closure of requests

When Alkaloid delivers the necessary notification to you, the request shall be considered closed.

Should you have further questions or requests concerning Alkaloid’s processing of your personal data in the capacity of controller, you should address them to the Data Protection Officer by telephone at +38923104000 or by email at [email protected].