CCTV Policy

CCTV POLICY

Lola the Cafe boat

Date: 1 May 2026
Review date: 12 months from the date above

1. PURPOSE AND SCOPE

Lola the Cafe boat operates a CCTV surveillance system on its premises. This policy explains how the system is used, who is responsible for it, and how individuals can exercise their data protection rights in relation to CCTV footage.

This policy applies to all CCTV cameras operated by Lola the Cafe boat, currently comprising 4 cameras across the following locations: Inside and Outside boat.

2. PURPOSE OF CCTV

The CCTV system is operated for the following purposes:
- Prevention and detection of crime
- Health and safety of staff and visitors

Cameras are positioned to achieve these purposes while minimising intrusion into areas where individuals have a reasonable expectation of privacy. Audio recording is enabled on specific cameras where a documented justification exists.

3. LAWFUL BASIS

Lola the Cafe boat relies on legitimate interests (UK GDPR Article 6(1)(f)) as the lawful basis for operating CCTV. A legitimate interests assessment has been conducted and is available on request. The assessment confirms that Lola the Cafe boat's interests in prevention and detection of crime; health and safety of staff and visitors outweigh the privacy rights of individuals captured on camera, given the safeguards described in this policy.

4. DATA CONTROLLER

The data controller for the CCTV system is:

Lola the Cafe boat
Address: Canal
Email: team@lolathecafeboat.co.uk

All queries, complaints, and subject access requests relating to CCTV should be directed to the above contact details.

5. SIGNAGE

Signs are displayed at all entry points to areas monitored by CCTV. Each sign includes:
- The name of the data controller (Lola the Cafe boat)
- The purpose of the surveillance
- Contact details for the data controller
- A reference to this policy

Signs are positioned so they are visible before an individual enters the camera's field of view.

6. RETENTION AND DELETION

CCTV footage is retained for a maximum of 30 days from the date of recording, unless:
- The footage is required for an ongoing investigation, legal proceeding, or insurance claim
- A subject access request has been received and the footage is being processed
- The footage has been flagged for retention due to a specific incident

Once the retention period expires, footage is automatically overwritten or securely deleted. Manual deletion is carried out where automatic overwriting is not available.

7. ACCESS AND SECURITY

Access to live and recorded CCTV footage is restricted to the following authorised personnel: Owner.

Footage is stored on a secure, password-protected recording system on the premises. Access credentials are not shared, and all access is logged where the recording system supports it.

CCTV footage will only be disclosed to third parties where:
- Required by law (e.g., a court order or police investigation)
- Necessary to comply with a subject access request
- Required for legitimate legal proceedings

8. DATA SUBJECT RIGHTS

Individuals captured on CCTV footage have the following rights under UK GDPR:

Right of access: Any individual may submit a Data Subject Access Request (DSAR) to obtain a copy of footage containing their image. Requests should be made to team@lolathecafeboat.co.uk.

Lola the Cafe boat will respond to DSARs within one calendar month of receipt. If additional information is needed to locate the footage (e.g., date, time, camera location), the response deadline pauses until the information is provided, in line with the Data (Use and Access) Act 2025.

Before footage is released, any other identifiable individuals will be redacted or obscured.

Right to erasure: Individuals may request deletion of footage containing their image. This right is not absolute — Lola the Cafe boat may retain footage where there is a legitimate and documented reason to do so.

Right to object: Individuals may object to being recorded. Lola the Cafe boat will consider such objections on a case-by-case basis, balancing the individual's rights against the purposes of the CCTV system.

9. COMPLAINTS

Any complaints about Lola the Cafe boat's use of CCTV should be directed to team@lolathecafeboat.co.uk. Complaints will be acknowledged promptly and responded to without undue delay. (Note: from 19 June 2026, a formal complaints-handling procedure will be a legal requirement under the Data (Use and Access) Act 2025.)

If a complaint is not resolved satisfactorily, individuals may contact the Information Commissioner's Office (ICO) at https://ico.org.uk or by phone on 0303 123 1113.

10. DATA PROTECTION IMPACT ASSESSMENT

Lola the Cafe boat has completed a Data Protection Impact Assessment (DPIA) for the CCTV system, assessing the necessity and proportionality of the surveillance and the risks to individuals. The DPIA is reviewed when cameras are added, repositioned, or when the purposes of the system change.

11. REVIEW

This policy is reviewed every 12 months, or sooner if:
- Cameras are added, removed, or repositioned
- The purposes of the CCTV system change
- Relevant legislation or ICO guidance is updated
- A complaint or incident highlights a gap in current practice

The review date is recorded at the top of this policy.