CCTV POLICY / INFORMATION NOTICE

Public information on the processing of personal data through CCTV

Private Kindergarten Tuti 2011 Ltd. / TUTI Private Kindergarten

Public version | current as of 15 September 2026

1. Controller and contact details

The data controller is Private Kindergarten Tuti 2011 Ltd. / TUTI Private Kindergarten.

Personal data protection contacts

Controller: Private Kindergarten Tuti 2011 Ltd. / TUTI Private Kindergarten

Address: 28 Chervena Stena St., Lozenets District, 1421 Sofia, Bulgaria

E-mail: tuti@tuti-bg.com | Tel.: +359 876 999 030

DPO: dpo@tuti-bg.com

Correspondence address: 28 Chervena Stena St., Sofia, Bulgaria

2. Purposes and legal basis

CCTV is used for the safety of children and staff, the security and protection of the premises and property, as well as to establish and clarify specific incidents and, where necessary, to defend legal claims. Under the current model, the processing is based on Article 6(1)(f) GDPR – the legitimate interests of the controller, following an assessment of necessity, proportionality and the balance with the rights and freedoms of the persons under surveillance. CCTV is not based on parental consent as a condition of attendance.

3. Monitored and non-monitored areas

Cameras are located in stairways, entrances and exits, the yard, group/activity rooms, the gym, kitchen and dining room. CCTV is not used in sleeping rooms, sanitary facilities or personal hygiene areas. The system does not record audio.

4. Categories of persons and data

Children, parents/legal representatives, employees, suppliers and visitors may come within the cameras’ field of view. The data processed include images, date/time and information about actions/presence in the monitored area. Facial recognition or other biometric identification is not used.

5. Retention period

Recordings are retained automatically for up to 30 days, after which they are overwritten/deleted. A specific excerpt may be separated and retained for longer only where necessary for a specific incident, a request to exercise rights, an inspection, proceedings, or the establishment, exercise or defence of legal claims. In such cases, the retention period is determined according to the specific necessity.

6. Access and security

Access to the system and archived recordings is restricted to expressly authorised persons according to their official duties and the specific need. A technical service provider may receive limited access only where necessary for technical support and subject to the applicable contractual, organisational and technical safeguards. Recordings are not routinely disclosed to parents or other third parties.

7. Recipients and disclosure

Recordings may be disclosed where there is an applicable legal basis – for example, to a competent public authority or in connection with the establishment, exercise or defence of rights. Any disclosure is limited to what is necessary. Parents do not have permanent or live access to the system.

8. Requests for access to CCTV recordings

A person may request information and, where the statutory conditions are met, access to their personal data contained in a CCTV recording. To locate the recording, the person may be asked to specify the date, approximate time, location and other necessary details. Where other persons appear in the recording, access is arranged in a way that protects their rights – for example, by limiting the excerpt, masking images or using another appropriate method.

9. Rights

Where applicable, data subjects have the right to information and access, rectification of inaccurate accompanying data, erasure or restriction, objection to processing based on legitimate interests, and the right to lodge a complaint with the Commission for Personal Data Protection. These rights are not absolute and are assessed in light of the specific processing, legal obligations and the rights of other persons.

10. Information signs

Before entering a monitored area, a first layer of information is provided by means of clearly visible information signs. At TUTI Private Kindergarten, signs are placed at the gate – before entering the kindergarten grounds – and at the entrance to the building – before entering the monitored indoor areas.

11. Contact and complaint

For questions and requests relating to CCTV and personal data protection, you may contact the DPO at dpo@tuti-bg.com or by post at: 28 Chervena Stena St., Sofia, Bulgaria. You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, e-mail: kzld@cpdp.bg.

12. Updates

This Policy is reviewed and updated whenever there is a material change in the cameras, monitored areas, purposes, retention period, categories of recipients, technical arrangements or applicable legal requirements.