Privacy Statement Video Surveillance
Video Surveillance Privacy Statement for the Americas
Protecting an individual’s privacy is crucial to the future of business. SAP has created this Privacy Statement to demonstrate our firm commitment to an individual’s right to data protection and privacy. This Privacy Statement outlines how we handle information that can be used to directly or indirectly identify an individual.
Video surveillance installations at SAP’s premises across the Americas
Video surveillance cameras (also known as closed-circuit televisions, or CCTVs) are installed to support viewing and/or recording of images to ensure an adequate level of safety and security for and at a company’s premises, supporting efforts to prevent and/or investigate break-ins, destruction, or other malicious or high-risk activities.
The surveillance cameras are installed in various locations intended to meet these objectives, including:
At the various entry and exit points of SAP’s premises
At security-relevant areas in SAP’s premises
At parking entrances, parking areas, or outer areas located at SAP’s premises
Cameras are generally intended to operate 24x7, either initiated through motion-activation sensors or otherwise set to continuously record. They include wide fields of vision and have both zoom and night-vision capabilities.
Camera locations, where your personal data may be captured, are marked with warning signs.
Who is the data controller?
The data controller for video surveillance is identified as the appropriate legal entity for the respective SAP location. A list of data controllers can be found in Annex I. The data protection officer can be reached at privacy@sap.com.
Employees and contractors within our Global Physical Security department are authorized to operate the system and access the information it contains. These team members are located in all regions in which SAP operates and follow established policies and procedures. Noncompliance with the established policies and procedures may result in discipline, up to and including termination.
What personal data does SAP collect?
If you visit or access SAP’s premises, we collect your images through video surveillance cameras, consisting of a recording of your activities, excluding sound or voice. In addition, we may, for example, collect a picture of your license plate in the parking areas or other personal data displayed within view of the cameras (your "personal data").
Why does SAP need your personal data?
SAP processes your personal data to ensure an adequate level of safety and security for and at SAP’s premises.
This process allows SAP to provide you with appropriate access to SAP’s premises and to ensure the security and safety of all SAP employees, suppliers, visitors, and assets across all global SAP locations. This process supports SAP in complying with relevant duty of care or other statutory obligations that may apply, including identification verification prior to or during access to any SAP-owned or leased facility.
Although providing personal data through CCTV is voluntary, without your personal data, SAP cannot provide you with access to SAP’s premises.
How long does SAP store my personal data?
SAP will store your personal data for a maximum period of 90 days, and after which, it will automatically be deleted in a secure manner. However, if the video surveillance recording is required for the investigation of an incident, it can be kept for as long as necessary to conclude the investigation.
SAP will also retain your personal data for additional periods if it is required by law, or to support SAP in asserting or defending against legal claims. SAP may retain your personal data until the end of the relevant retention period or until the claims in question have been settled or the statute of limitations has been met.
Who are the recipients of my personal data, and where will it be processed?
Your personal data will be passed on to the following categories of third parties for processing:
Companies within the SAP Group, as this is a global organization with global security obligations
Third-party service providers, including security agencies that are contracted to provide security services at SAP
SAP Physical Security, SAP Legal, or other relevant internal teams, as well as law enforcement agencies, insurance companies, and so on as appropriate in terms of any corporate criminal or other security investigations
As part of a global group of companies operating internationally, SAP may transfer your personal data to countries outside of the country of collection. Data transfers outside of your home country may be subject to lawful access requests from relevant authorities in the relevant jurisdiction. If these transfers are to a country for which the EU Commission has not issued an adequacy decision, SAP uses the EU standard contractual clauses to contractually require that your personal data receives a level of data protection consistent with local standards. You can obtain a copy (redacted to remove commercial or irrelevant provisions) of such standard contractual clauses by sending a request to privacy@sap.com.
What are your data protection rights?
At any time, you can request from SAP access to information about which personal data SAP processes about you and the correction or deletion of such personal data. Please note that SAP can or will delete your personal data only if there is no statutory obligation or prevailing right of SAP to retain it.
Furthermore, you can request from SAP that SAP restricts your personal data from any further processing in the event SAP no longer requires your personal data, but you state that you require SAP to retain such data in order to claim or exercise legal rights or to defend against third-party claims.
Please note, however, that SAP can or will delete your personal data only if there is no statutory obligation or prevailing right of SAP to retain it.
Please direct any requests to exercise your rights to SAP-Physical-Sec-Privacy@sap.com.
How will SAP verify requests to exercise data protection rights?
SAP will take steps to ensure that it verifies your identity to a reasonable degree of certainty before it will process the data protection right you want to exercise. When feasible, SAP will match personal data provided by you in submitting a request to exercise your rights with information already maintained by SAP. This could include matching two or more data points you provide when you submit a request with two or more data points that are already maintained by SAP.
SAP will decline to process requests that are manifestly unfounded, excessive, fraudulent, or are not otherwise required by local law. By its nature, CCTV footage can include personal data related to many individuals, which would need to be removed or redacted before any request can be processed. As this process is extremely burdensome, SAP may consider such requests as excessive by default, depending on the circumstances and nature of your request.
What are my rights to lodge a complaint?
If you take the view that SAP is not processing your personal data in accordance with the requirements in this Privacy Statement or under applicable data protection laws, you can lodge a complaint at any time with the relevant data protection authority.
Why does SAP need to use my personal data?
SAP can use your personal data for the following purposes:
To control access to SAP’s premises
To ensure adequate security for and at SAP’s premises
To ensure the safety of SAP employees and visitors to SAP’s premises
To prevent, deter, and, if necessary, investigate unauthorized physical access, including unauthorized access to secure premises and protected rooms, IT infrastructure, or operational information
To prevent sabotage, theft, and material damage
To support the rightful and valid requests of public authorities for support in an investigation
You can at any time object to SAP’s use of your personal data as set forth in this section by sending an e-mail to SAP-Physical-Sec-Privacy@sap.com. In this case, SAP will carefully review your objection and cease further use of the relevant information, subject to SAP’s compelling legitimate grounds for continued use of the information, which override your interest in objecting, or if SAP requires the information for the establishment, exercise, or defense of legal claims.
Annex I – List of Data Controllers
SAP Argentina (https://www.sap.com/latinamerica/index.html)
SAP Argentina S.A., Panamerican Bureau, Sargento Cabral 3770 - Piso 2, c.p. B1605EFJ, Munro, Buenos Aires, Argentina Phone: +54 (11) 5544 3600
SAP Brazil (https://www.sap.com/brazil/index.html)
SAP Brasil Ltda, Av. das Nações Unidas, nº 14.171 - Marble Tower - 7º andar, Vila Almeida - São Paulo, SP - CEP 04794-000 Phone: +55 (11) 5503-2400 / 5505-5757
SAP Canada Inc.
Web: Canada - English (https://www.sap.com/canada/index.html)
Web: Canada - French (https://www.sap.com/canada-fr/index.html)
SAP Canada, Inc., 360 Albert Street, Suite 1820, Ottawa, Ontario K1R 7X7, Canada Phone: +1-613-364-2500
SAP Chile (https://www.sap.com/latinamerica/index.html)
SAP Chile Limitada, Nueva Apoquindo, 4777 Los Militares Av., 7560968 / Las Condes, Santiago, Chile Tel: (56 2) 440-3500
SAP Colombia (https://www.sap.com/latinamerica/index.html)
SAP Colombia, S.A.S. Bogotá, Edificio Tierra Firme, Carrera 9na # 115-06, piso 24, oficina 2404, Bogotá – Colombia Phone: +57/1/600-3000
SAP Costa Rica (https://www.sap.com/latinamerica/index.html)
SAP Costa Rica, S.A., Plaza Tempo, Piso 4, Escazú, San José Costa Rica Phone: +506 2208 26 00
SAP Mexico (https://www.sap.com/latinamerica/index.html)
SAP México S.A. de C.V., Mexico City, Prolongación Paseo de la Reforma, número 600-Piso 1, Colonia Santa Fe, Peña Blanca, C.P. 01210, México, en la Ciudad de México Phone: 00 - 52- 55 5257 7500
SAP Andina y Caribe Peru (https://www.sap.com/latinamerica/index.html)
SAP Perú SAC, Av. Circunvalación del Club Golf Los Incas No. 154, Piso 16, Oficina No. 1601, Santiago de Surco, Lima, Perú, Phone: +511 615-6900
Quadrem Peru S.A.C., Av. Pardo y Aliaga 699, Piso 4 San Isidro, Lima - Perú, Phone: +51 1 204-6800
SAP America
SAP America, Inc., 3999 West Chester Pike, Newtown Square, PA 19073, USA, Phone: +1-610-661-1000 https://www.sap.com/index.html
SAP Labs, LLC., 3410 Hillview Avenue, Palo Alto, CA 94304, USA, Phone: +1-650-849-4000 https://www.sap.com/about/company/innovation/labs.html
SAP Industries, Inc., 1101 W Washington St, Suite 401, Tempe, Arizona 85281, Phone: +1-480-308-2500
SAP International, Inc., 5301 Blue Lagoon Drive, Suite 790, Miami, FL 33126, Phone: +1-305-476-4400
SAP Public Services, Inc., 1399 New York Avenue, N.W., Suite 800, Washington, DC 20005, Phone: +1-202-312-3500
Ariba, Inc., 3420 Hillview Ave, Palo Alto, CA 94304, USA, Tel.: +1 650 849 4000
Callidus Software Inc., 1 Perimeter Park South, Suite 200 North, Birmingham, AL 35243, Phone: +1 (205) 545-2500
Concur Technologies, Inc., 601 108th Ave NE, Suite 1000, Bellevue, WA 98004, USA, Tel: +1 425 590 5000 https://www.sap.com/index.html
Hybris (U.S.) Corporation, 3005 Center Green Drive, Boulder, CO 80301, USA, Tel: +1 650-645-4440 https://www.sap.com/index.html
Emarsys North America, Inc., 10 W. Market Street, Suite 1350, Indianapolis, IN 46204