CCTV Policy
Name: Vikki Douel – Pippins Holiday Cottage
Property: Pippins Holiday Cottage
Date Completed: August 2025
1. Policy Statement
1.1 At [Pippins Holiday Cottage], we have assessed that security cameras and other surveillance systems have a legitimate role in helping to maintain a safe and secure environment for all our guests, visitors, and property. We understand that the use of such systems may raise concerns about privacy and data protection.
This policy aims to address those concerns by explaining how we collect, use, and protect images and audio recorded by our CCTV systems. These recordings are considered personal data under data protection laws, and we are committed to processing them lawfully and respecting the rights of individuals.
2. Definitions
2.1 For the purposes of this policy, the following terms have the following meanings:
CCTV Fixed and domed cameras, and any other recording equipment designed to capture and record images and audio of individuals and property.
Data Information which is stored electronically, or in certain paper-based filing systems. In respect of CCTV, this generally means video images with audio. It may also include static pictures such as printed screen shots.
Data subjects All living individuals about whom we hold personal information as a result of the operation of our CCTV (or other surveillance systems).
Personal data Data relating to a living individual who can be identified from that data (or other data in our possession). This will include video images of identifiable individuals.
Data controllers
The people who, or organisations which, determine the manner in which any personal data is processed. They are responsible for establishing practices and policies to ensure compliance with the law. We are the data controller of all personal data used in our business for our own commercial purposes.
Data Users
Individuals responsible for processing personal data. This includes anyone authorised to operate CCTV cameras and other surveillance systems to record, monitor, store, retrieve, and delete images. Data users must protect the data they handle in accordance with this policy and our Privacy Policy.
Data Processors
Any person or organisation that is not a data user (or other employee of a data controller) that processes data on our behalf and in accordance with our instructions (for example, a supplier which handles data on our behalf).
Processing
Any activity which involves the use of data. It includes obtaining, recording or holding data, or carrying out any operation on the data including organising, amending, retrieving, using, disclosing or destroying it. Processing also includes transferring personal data to third parties.
Surveillance systems
Any devices or systems designed to monitor or record images and/or audio of individuals or information relating to individuals. The term includes CCTV systems as well as any technology that may be introduced in the future such as body worn cameras, unmanned aerial systems, smart doorbells and any other systems that capture information of identifiable individuals or information relating to identifiable individuals.
3. About This policy
3.1 We currently use CCTV on and around our Property. This policy outlines why we use CCTV on our Property, how we will use CCTV and how we will process data recorded by CCTV cameras to ensure we are compliant with data protection law and best practice. This policy also explains how to make a subject access request in respect of personal data created by CCTV.
3.2 We recognise that information we hold about individuals is protected under data protection laws. Images recorded by CCTV cameras at the Property are considered personal data and are therefore subject to these laws. We are committed to complying with all legal obligations and follow best practice guidelines as recommended by the Information Commissioner's Office (ICO).
3.3 This policy covers all guests and visitors of the Property, It may also be relevant to visiting members of the public.
3.4 The policy will be regularly reviewed to ensure that it meets legal requirements, relevant guidance published by the ICO and industry standards.
4. Personnel Responsible
4.1 Overall responsibility for ensuring compliance with relevant legislation and the effective operation of this policy lies with Vikki Douel and Ben Douel / Pippins Holiday Cottage. Day-to-day decisions about what information is recorded, how it will be used, and to whom it may be disclosed are managed by the property owners.
5. Reasons for the use of CCTV
5.1 We currently use CCTV around our site as outlined below. We believe that such use is necessary for legitimate business purposes, including:
5.1.1 to prevent crime and protect buildings and assets from damage, disruption, vandalism and other crime
5.1.2 for the personal safety of guests, visitors and other members of the public and to act as a deterrent against crime;
5.1.3 to support law enforcement bodies in the prevention, detection and prosecution of crime;
This list is not exhaustive and other purposes may be or become relevant.
6. Monitoring
6.1 CCTV monitors areas within the boundary of the Property 24 hours a day and this data is continuously recorded.
6.2 Camera locations have been carefully chosen to minimise the viewing of any areas not relevant to the legitimate purpose of security monitoring. CCTV cameras cover the exterior entry and exit points, communal outdoor areas, and the driveway. Cameras do not focus on private guest spaces such as the garden area, inside the cottage, bedrooms, bathrooms, or other private areas intended for guest use. No CCTV is installed in bathrooms, bedrooms, or other private spaces.
To further protect privacy, cameras are equipped with privacy filters or pixelation technology to obscure any areas not relevant to security monitoring, ensuring that personal privacy is respected. We show an example of pixelation in our guest notes so guests know how this looks on the camera.
7. How we will operate any CCTV
7.1 Where CCTV cameras are installed on the Property, clear and visible signs will be displayed at the entrances to the surveillance zones to inform individuals that they may be recorded. The surveillance zones refer only to the areas covered by the cameras, not the entire property. The CCTV signs are located directly next to the Property’s name sign (“Neuadd Farm” and “Pippins”), making it clear who operates the system. The signs also state the purpose of the surveillance (e.g., to maintain security and safety).
7.2 Live feeds from CCTV cameras will only be monitored where this is reasonably necessary, for example to protect health and safety.
7.3 We will ensure that live feeds from cameras and recorded images are only viewed by the property owners, where access is necessary for security, safety, or legal purposes.
7.4 Our CCTV system is configured to send automated alerts, such as email notifications, when certain events occur (for example, when a vehicle arrives at the Property). These alerts are generated based on the detection of movement or activity captured by the cameras. The purpose of these alerts is to enhance security by keeping the owners informed of activity around the Property in real-time.
These alert emails may contain limited information such as the time and date of the event and a single image. The alerts are only sent to the owners and are treated with the same level of confidentiality and security as other CCTV data.
8. Use of data gathered by CCTV
8.1 In order to protect the rights of individuals recorded by the CCTV system, we ensure that footage is stored securely and handled responsibly. All recordings are stored locally on our secure NVR system, which is kept inside our home in a location not accessible to guests or the public. Stored data is not accessible remotely other than via secure private VPN service in which only the owners can access.
9. Retention and erasure of data gathered by CCTV
9.1 Data recorded by the CCTV system is stored locally on our secure NVR within our home. Footage is not stored on any cloud-based service. CCTV recordings are not retained indefinitely and are deleted after approximately 31 days unless required for a specific purpose, such as investigating an incident or complying with legal obligations. Where footage is retained for such purposes, it will be deleted as soon as it is no longer needed.
10. Use of additional surveillance systems
10.1 While we currently do not plan to add any new surveillance cameras or systems to the Property, should the need arise in the future, we will carefully assess their necessity and appropriateness by conducting a Privacy Impact Assessment (PIA).
10.2 The PIA will help us decide whether any additional surveillance is proportionate and necessary, and whether less intrusive alternatives are available. This process ensures we always balance security needs with respect for the privacy of individuals on the Property.
10.3 The existing Privacy Impact Assessment (PIA) covers all CCTV cameras currently installed that monitor guest areas. Any future cameras added outside guest areas will also be subject to an additional PIA before installation, ensuring they remain compliant and proportionate.
11. Covert monitoring
11.1 We do not currently engage in covert monitoring or surveillance (where individuals are unaware that monitoring is taking place). In the highly unlikely event that covert monitoring is considered necessary, it will only be carried out:
For a limited and reasonable period of time, consistent with the purpose of the monitoring;
In relation to specific suspected illegal or unauthorised activity; and
After careful consideration and formal authorisation, ensuring that it is the least intrusive option available.
Any decision to undertake covert monitoring will be fully documented.
12. Ongoing review of CCTV use
12.1 We will ensure that the ongoing use of existing CCTV cameras at the Property is reviewed periodically to ensure that their use remains necessary and appropriate, and that any surveillance system is continuing to address the needs that justified its introduction.
13. Requests for disclosure
13.1 We do not share CCTV data with any group companies or associated organisations. Data will only be shared with third parties where required by law or as necessary for legitimate purposes, such as with law enforcement or regulatory authorities.
13.2 No recordings from our CCTV will be disclosed to any other third party without express permission being given by the owners. Data will not normally be released unless satisfactory evidence that it is required for legal proceedings or under a court order has been produced.
13.3 In appropriate circumstances, we may allow law enforcement agencies to view or remove CCTV footage where this is required in the detection or prosecution of crime.
13.4 We will maintain a record of all disclosures of CCTV footage.
13.5 No CCTV footage will ever be posted online or disclosed to the media.
14. Subject access requests
14.1 Individuals have the right to request access to their personal data, which may include CCTV images and audio if captured, in accordance with our Privacy Policy.
14.2 To help us locate relevant footage, any requests for copies of recorded CCTV images should specify the date and time of the recording, the location of the footage, and, if possible, details to help identify the individual.
14.3 We reserve the right to obscure or redact images of other individuals who appear in the footage when responding to a subject access request, to protect their privacy.
15. Complaints
15.1 If you have questions about this policy or any concerns about our use of CCTV, then they should speak to the owner – Vikki Douel in the first instance.
16. Requests to prevent processing
16.1 Under the UK General Data Protection Regulation (UK GDPR), you have the right, in certain circumstances, to object to how we use your personal data. You also have the right to request that decisions about you are not made solely by automated processes without human involvement.
If you want to know more about these rights or wish to exercise them, please contact Vikki Douel – Email: pippinscottage@gmail.com