1. Purpose
StorageX Pty Ltd ACN 659 375 096 (StorageX) uses closed-circuit television (CCTV) at and around its storage facilities to:
- help maintain the safety and security of customers, staff, contractors and visitors;
- deter, detect and investigate theft, damage, unauthorised access and other incidents;
- assist with responding to complaints, claims, disputes and incidents (including emergencies); and
- support compliance with legal obligations and cooperation with law enforcement where required or permitted.
This CCTV Policy explains how CCTV operates at StorageX facilities and how CCTV footage and related information is handled.
2. Scope
This policy applies to:
- all StorageX facilities, including common areas and surrounding areas monitored by CCTV;
- all individuals who may be recorded, including customers (storers), visitors, staff, contractors and delivery personnel; and
- CCTV footage and any associated audio recordings where enabled (together, CCTV Recordings).
This policy should be read together with the StorageX Privacy Policy. To the extent of any inconsistency relating specifically to CCTV Recordings, the more specific provision will apply, provided that nothing in this policy limits any rights or obligations under the Privacy Act 1988 (Cth), the Australian Privacy Principles or any other applicable law.
3. Definitions
CCTV/Optical surveillance means cameras used to observe or record video and images.
CCTV Recordings means visual recordings and, where enabled, audio recordings captured by CCTV systems, and associated still shots and underlying data (such as time stamps).
Private activity has the meaning given under the Surveillance Devices Act 1999 (Vic) and generally refers to activity carried out in circumstances indicating the parties desire it to be observed only by themselves.
4. Where CCTV operates
CCTV may operate in and around StorageX facilities including (as applicable):
- entrances and exits
- reception and customer service areas
- corridors, lifts and common areas
- loading/unloading areas
- car parks and external perimeters
- access points to storage areas.
CCTV is not used in areas where it is prohibited or inappropriate, including:
- toilets
- washrooms or shower areas
- change rooms.
5. Notice and transparency
StorageX will take reasonable steps to inform individuals that CCTV is in use, including by displaying signage at entry points and/or in monitored areas.
Where CCTV audio recording is enabled in any area, StorageX will take reasonable steps to make that clear through signage or other notice.
6. Audio recording
Audio recording creates additional privacy and legal risk and may be regulated separately from video surveillance.
- StorageX may record audio in limited circumstances where it is operationally necessary and lawful.
- Where audio recording is enabled, StorageX will use reasonable steps to notify individuals, and will manage access and use of those recordings in accordance with this policy and the StorageX Privacy Policy.
If StorageX does not require audio recording for its operations, StorageX should disable audio functionality on CCTV systems.
7. Facial recognition and biometric technology
StorageX does not use facial recognition or other biometric identification/verification technology as part of its CCTV operations unless:
- StorageX has assessed that the collection and use is lawful and reasonably necessary for StorageX’s functions or activities; and
- StorageX has implemented appropriate notices and safeguards (and, where required, obtained valid consent).
StorageX’s CCTV systems may include facial detection technology to identify the presence of faces for the purpose of counting people or improving camera operation. This technology does not identify or verify individuals or collect biometric identity information.
If facial recognition or biometric technology is used, StorageX will update this policy and the StorageX Privacy Policy accordingly.
8. Collection, use and disclosure of CCTV Recordings
8.1 Collection
CCTV Recordings may capture images (and, where enabled, audio) of individuals at StorageX facilities.
Where an individual is identified or reasonably identifiable, CCTV Recordings are treated as personal information and handled in accordance with the StorageX Privacy Policy.
8.2 Use
StorageX may use CCTV Recordings for the purposes set out in section 1 and for other purposes permitted by law, including:
- investigating incidents, suspected unlawful activity, breaches of facility rules or contractual terms
- verifying events relevant to disputes, complaints or insurance claims
- training and operational review where appropriate and proportionate, and ensuring that individuals are not personally identifiable in compliance with this policy
- responding to legal processes and regulatory requirements.
8.3 Disclosure
StorageX may disclose CCTV Recordings (including still images or excerpts) where permitted or required by law and consistent with the StorageX Privacy Policy, including to:
- police and other law enforcement bodies;
- insurers and investigators (for claims and incident investigations);
- legal advisers;
- contractors engaged to maintain, host or manage CCTV systems (subject to confidentiality and security requirements); or
- courts, tribunals and regulators.
Unless disclosure is compelled by court order or warrant, any such disclosures must be authorised in writing by StorageX’s privacy officer and limited to the part of the CCTV Recordings reasonably necessary for the stated purpose. StorageX shall maintain a disclosure register that keeps a record of the date of disclosure, a description of the CCTV Recordings disclosed, including date and time stamps, to whom disclosure was made, manner of disclosure and who it was authorised by.
StorageX will not disclose CCTV Recordings for marketing purposes.
CCTV Recordings are stored in Australia only. If StorageX uses service providers located outside Australia to store or process CCTV Recordings, this Policy will be updated and StorageX will take reasonable steps to ensure appropriate data handling and security arrangements are in place, consistent with the StorageX Privacy Policy.
9. Access to CCTV Recordings
Individuals may request access to CCTV Recordings that contain their personal information by contacting StorageX using the contact details in section 13.
StorageX may need to:
- verify the requester’s identity;
- obtain the written authorisation from StorageX’s privacy officer for the disclosure;
- limit the manner of disclosure, such as by permitting the relevant CCTV Recordings to be viewed on-site but not otherwise downloaded, copied, photographed, video recorded or transferred;
- protect the privacy of other individuals captured in the CCTV Recordings (for example, by redacting or masking third parties where practicable); and
- refuse access where a lawful basis for refusal applies.
StorageX may charge reasonable costs of providing access where permitted by law.
If access is given, StorageX will log details of the access given in its disclosure register (see section 8.3).
If StorageX refuses access, StorageX will provide written reasons (unless it would be unreasonable to do so) and information about complaint options.
10. Storage, security and retention
StorageX stores CCTV Recordings in electronic form and takes reasonable steps to protect them from misuse, interference, loss, unauthorised access, modification or disclosure, including by:
- restricting access to authorised personnel only
- using password protection and access controls for CCTV systems and storage platforms
- applying appropriate physical security measures for equipment and monitoring locations.
StorageX will retain CCTV Recordings only for as long as reasonably required for the purposes set out in this policy, unless longer retention is required or authorised by law, needed to manage an incident, complaint, dispute, claim, investigation or legal proceeding, or otherwise permitted under the StorageX Privacy Policy.
StorageX ordinarily retains CCTV Recordings for up to 30 days, after which they are automatically overwritten or securely deleted. StorageX may retain particular CCTV Recordings for a longer period where reasonably required to investigate or manage an incident, complaint, dispute, insurance claim, suspected unlawful activity or legal proceeding, or where retention is required or authorised by law. Any CCTV Recordings retained for a longer period will be securely deleted when they are no longer required.
11. Prohibited and inappropriate surveillance
StorageX will not knowingly use CCTV to record a private activity in circumstances that would contravene applicable surveillance laws.
StorageX will take reasonable steps to ensure cameras are positioned and configured to:
- avoid capturing prohibited areas;
- avoid capturing areas outside StorageX’s premises where practicable; and
- limit monitoring to what is reasonably necessary for the purposes set out in this policy.
StorageX does not ordinarily use covert or hidden CCTV. Any proposed use of covert surveillance will be subject to prior legal review and written approval by an authorised senior officer and will only occur where permitted by applicable law, reasonably necessary for a specific and documented purpose, and proportionate to the circumstances.
12. Governance and responsibilities
StorageX will:
- limit CCTV access to authorised staff and contractors with a legitimate need
- maintain procedures for responding to incidents and requests involving CCTV Recordings
- require service providers who handle CCTV Recordings to comply with appropriate confidentiality, privacy and security obligations.
StorageX will undertake periodic camera mapping and field-of-view assessments for all CCTV cameras installed at StorageX facilities. These assessments will verify that each camera is positioned and configured to capture only those areas reasonably necessary for the security and operational purposes outlined in this policy and to avoid prohibited or inappropriate areas, including any areas where surveillance is not permitted by law.
StorageX will maintain documentation of each camera’s field of view, including:
- the physical location and orientation of each camera;
- the areas captured by each camera;
- the results of field-of-view assessments; and
- any steps taken to adjust or reconfigure cameras to ensure compliance with this policy.
These records shall be reviewed:
- as part of the installation of new cameras;
- when making material changes to existing camera positions or facility layouts; and
- at least annually, to ensure ongoing compliance with legal and policy requirements.
13. Questions and complaints
Questions about this CCTV Policy or CCTV practices, and requests or complaints relating to CCTV Recordings, can be made using the contact details in the StorageX Privacy Policy:
Email: [email protected]
If a person is not satisfied with StorageX’s response, they may escalate their complaint in accordance with the complaints process set out in the StorageX Privacy Policy (including contacting the Office of the Australian Information Commissioner).
14. Review
StorageX will review this CCTV Policy periodically and update it where its operations, technology, service providers or legal requirements change.