“OPAP S.A.” (hereinafter “OPAP” or “Company”) is the Data Controller of your personal data, pursuant to the EU General Data Protection Regulation 2016/679 and Greek Law 4624/2019. This Privacy Notice intends to inform you on the processing of image and video data, as collected via the CCTV monitoring system operating at the Company’s headquarters and other monitoring points (OPAP’s premises in Athens and Thessaloniki, Protypo Store on 108 Athinon Avenue, Studio Kapa)

Information on the CCTV System:

The Company has installed cameras that do not record sound, both inside and outside of its premises, at spots that are deemed crucial for the surveillance of areas, where serious incidents may occur, such as thefts, accidents, unauthorised access and other incidents that may put at risk the security of OPAP visitors and employees, as well as OPAP’s property or business interests.

What personal data do we process?

The personal data collected via the CCTV monitoring system is the image and video data of visitors and employees of the Company.

Which areas are monitored?

We inform you that the CCTV system covers the area of the main entrance, spots near the elevators, staircases and emergency exits, areas of electrical installations of high risk, the entrance area of the management’s offices on the 7th floor, the underground and overground parking areas, the treasury area, as well as the whole exterior of the building.

For what purposes do we process personal data?

OPAP processes personal data in the context of the Company’s legitimate interests to ensure the security of the people and assets at its premises.

With whom do we share your personal data?

Your personal data is processed by OPAP employees and external business partners (providers of security services) who act on OPAP’s behalf and undertake contractual confidentiality obligations and obligations to comply with data protection legislation. In any case and only as far as this is deemed necessary ad hoc, we inform you that OPAP may transfer CCTV footage to any administrative, judicial or other public authority, or generally any legal or natural person to which this data shall or may be disclosed, pursuant to applicable legislation or a judicial decision, in the context of the Company’s legal obligations or rights.

How does the Company protect your personal data?

OPAP has implemented all appropriate organizational and technical measures, pursuant to the applicable legal framework and standards, in order to safeguard that the processing of data is legitimate, appropriate and secured against any unauthorized or illegal access, deletion, processing, amendment or any other use of the data.

How long is your personal data retained?

The retention period for image and video data collected via the CCTV monitoring system is 15 days.  Upon expiration of this term, your personal data will be deleted unless –exceptionally- required for the establishment, exercise or defense of OPAP’s or third parties’ legal claims before a judicial or other authority.

Which are your rights?

In accordance with the applicable legislation, the data subjects of the data held at the Company's premises and other monitoring points (OPAP's premises in Athens and Thessaloniki, the Protypo Store on 108 Athinon Avenue, Studio Kapa) may exercise the following rights:

  • right to access their personal data, as well as the information related to their processing,
  • right to erasure,
  • right to restrict the processing of their personal data, when explicitly provisioned by the legislation,
  • right to data portability in a structured, commonly used and machine-readable format (e.g., USB),
  • right to have their data (directly) transmitted to a different data controller,
  • right to object to the processing of personal data, subject to the conditions laid down by law.

In case you exercise the rights to erasure or restriction of personal data, these requests will be communicated accordingly to the third parties to whom the data have been disclosed.

The exercise of the aforementioned rights is carried out by submitting a written request to the Data Protection Officer of the OPAP Group, as set out below.

Whom can I contact for addressing any issues/requests?

For any queries, clarifications or requests with regard to the protection of your personal data, in the context of the CCTV monitoring system’s operation at the OPAP headquarters, you may contact our Data Protection Officer (DPO) using the following contact details: Website: | Postal address: 112 Athinon Avenue, 10442 Athens | Telephone: +30 210 5798888 | Email:

Data Protection Authority

In case you deem we did not sufficiently address your request and the protection of your personal data is affected in any way, you may submit a complaint via the special online portal to the Hellenic Data Protection Authority (Athens, 1-3, Kifissias Ave., P.C. 115 23, tel: +30 210 6475600). Detailed instructions on the submission of complaints are provided on the Authority's webpage.