CCTV Surveillance & Security Recording Policy

This Policy establishes controls for the use, operation, access, protection, retention and appropriate disclosure of CCTV footage and security recordings at VahanXpert Services. The objective is to support workshop security, protection of Customer vehicles and property, employee and visitor safety, incident investigation and prevention of unauthorised access or loss.

This Policy applies to CCTV cameras, recording equipment, storage systems, monitors, related security footage and authorised personnel who install, operate, access, review, export or otherwise handle CCTV recordings at VahanXpert Services premises.

• Protection of Customer vehicles, keys, property, workshop assets and equipment.
• Monitoring of workshop entry, exit, parking and designated operational areas.
• Support for investigation of theft, damage, accidents, disputes, safety incidents or other security events.
• Deterrence and investigation of unauthorised access or suspicious activity.

Cameras may be positioned in areas where surveillance is reasonably required for security and operational purposes, such as entrances, exits, parking areas, vehicle movement areas, reception, workshop access points, stores and other designated locations. Cameras should not be deliberately positioned in areas where a high expectation of personal privacy would ordinarily exist, such as toilets or changing areas.

Where CCTV is in operation, VahanXpert Services may display appropriate signage or notice informing Customers, employees, vendors and visitors that CCTV surveillance is being used for security and related purposes.

• CCTV systems should be configured and operated in accordance with the available equipment and operational requirements.
• Recording systems should be protected against unauthorised access, tampering or avoidable loss of footage.
• System date and time should be maintained reasonably accurately where the equipment permits.
• Cameras and recording equipment should be periodically checked for operational condition.

Access to CCTV recordings shall be limited to authorised management or designated personnel with a legitimate business, security, incident-investigation or legal requirement to access the footage.

Live monitoring may be performed where operationally required. Routine monitoring should be limited to legitimate security and operational purposes and should not be used for inappropriate personal observation.

• Recorded footage may be reviewed in response to an incident, Customer complaint, vehicle damage, theft concern, safety event, security issue, suspected misconduct or other legitimate requirement.
• Personnel reviewing footage shall maintain confidentiality and avoid unnecessary disclosure.
• Footage should be reviewed only to the extent reasonably required for the relevant purpose.

• CCTV footage shall not be copied, photographed, downloaded or shared for personal purposes.
• Export of footage should be authorised by management or another designated person.
• Where footage is exported, the date, relevant camera/time period, reason and recipient may be recorded where appropriate.
• External sharing should occur only where there is an authorised business, insurance, legal, law-enforcement or other legitimate requirement.

A Customer may request that relevant CCTV footage be reviewed in connection with a vehicle, property, accident or service issue. Any request shall be assessed by authorised management, taking into account the rights and privacy of other individuals, security considerations and applicable requirements. CCTV footage shall not automatically be released merely because a request is made.

Where footage is requested by police, courts, regulators, insurers or another authorised authority, VahanXpert Services may provide relevant footage subject to appropriate verification, lawful process and applicable requirements.

CCTV recordings may be retained for a reasonable operational period based on storage capacity, security requirements and the nature of the premises. Where footage is relevant to a known incident, dispute, insurance matter or legal request, the relevant recording may be preserved for as long as reasonably necessary, subject to applicable requirements.

• Recording devices and storage systems should be located in a reasonably secure area.
• Access credentials should be restricted to authorised personnel.
• Default passwords should be changed where supported by the equipment.
• Remote access, if enabled, should be restricted and protected using appropriate authentication and security controls.

Cameras, recording devices, storage systems, power supplies and related equipment should be inspected or maintained as reasonably necessary. Faults affecting important security coverage should be reported and addressed where practicable.

• Unauthorised movement, disabling, covering, disconnecting or tampering with CCTV equipment is prohibited.
• Unauthorised deletion, alteration, copying or disclosure of footage is prohibited.
• Suspected tampering or misuse shall be reported to management.

Employees and technicians shall not use CCTV footage to monitor colleagues or Customers for personal reasons, entertainment, harassment or unauthorised social-media content. CCTV information shall be handled professionally and confidentially.

Where cameras cover vehicle parking, service bays, reception or other vehicle-related areas, footage may be used to support investigation of vehicle damage, missing property, unauthorised movement, access or other incidents. CCTV does not replace the applicable vehicle custody, key control, parking, incident-reporting or handover procedures.

• Relevant footage may be reviewed following vehicle damage, theft, accident, fire, security incident, customer complaint or suspected misconduct.
• Where footage is relevant, it may be preserved and linked to the applicable incident or complaint record.
• Access and sharing should be limited to persons involved in the investigation or authorised decision-making.

CCTV recordings may contain identifiable individuals, vehicles, registration numbers, Customer activity and other information. Such recordings shall be treated as confidential business/security records and handled consistently with the applicable Customer Data Privacy Policy and legitimate operational requirements.

CCTV vendors, security contractors, technicians or system service providers may access CCTV equipment only where authorised and only to the extent necessary for installation, maintenance, troubleshooting or other approved services. Their access should be appropriately controlled.

• Where footage is required for a serious incident, reasonable steps should be taken to preserve the original recording and avoid unnecessary alteration.
• Exported footage should be stored securely and should not be edited in a manner that could misrepresent the relevant event.
• Where practicable, relevant metadata or system information should be retained with exported evidence.

• Using CCTV footage for personal entertainment or social-media content.
• Sharing recordings with unauthorised persons.
• Using cameras to intentionally monitor private areas.
• Deleting or manipulating relevant footage to conceal an incident.
• Providing footage to a third party without appropriate authorisation.

• Management: approve CCTV use, access and material disclosures and oversee security controls.
• Designated CCTV/System Administrator: maintain access controls, system operation and authorised exports.
• Employees: respect CCTV equipment, privacy and confidentiality and report faults or suspected misuse.
• Security/Service Vendors: access equipment only for authorised work and protect information obtained during service.

Where appropriate, VahanXpert Services may maintain records of significant CCTV access, exported footage, material disclosures, system maintenance, incidents and requests. Records shall be handled according to applicable business and privacy requirements.

This Policy shall be reviewed periodically and may be updated based on workshop security requirements, CCTV technology, incidents, operational experience and applicable legal or business requirements.