CCTV Privacy Notice

At Harness, we care about your privacy and are committed to protecting your personal data. This notice explains how we use CCTV in our offices, what footage we record, why we record it, who can see it, how long we keep it, and what rights you have.

It applies to anyone (employees, contractors, visitors, delivery personnel, or members of the public) who enters a Harness office where CCTV is in use. 

1. Who we are

Depending on the office where you are filmed, the controller of your personal data is one of the following Harness entities:

• United States: Harness Inc., 55 Stockton St, San Francisco, CA 94108, USA.
• United Kingdom: Harness Group UK Limited, 69 Old Broad St., Liverpool St., London EC2M 1QS, United Kingdom. 
• India: Harness R&D Labs India Private Limited, Urban Vault, Garden Layout, Sector 2, HSR Layout, Bengaluru, Karnataka 560102.

Contact: privacy@harness.io

EU Representative

Harness France SAS

92 Av. des Champs-Élysées, 75008 Paris, France

Can be contacted at privacy@harness.io in English or French during local business hours.

2. Where we use CCTV and what we record

2.1 Offices in scope

CCTV is deployed only at Harness offices in the three countries listed above. At those offices, cameras are positioned exclusively at:

• Entry and exit points (e.g., the office front door and emergency exits);
• Stairwells;
• Elevators (where the camera belongs to Harness rather than the landlord);
• IT closets and server rooms.

Cameras do not cover workstations, cafeterias, restrooms, prayer or contemplation rooms, breastfeeding rooms, or any other common or private areas. The cameras cannot be used to monitor employee break patterns, attendance, or performance.

2.2 Co-working spaces

Where Harness employees work from co-working spaces (such as WeWork), any CCTV at those premises is managed and controlled entirely by the co-working provider. Harness has no access to that footage. The co-working provider acts as an independent controller of its own CCTV footage.

2.3 Building common areas controlled by the landlord

In some buildings, the landlord operates separate cameras covering building entrances, exits, car parks, reception areas, or corridors. Those cameras are outside Harness' control. The landlord is the controller for that footage.

2.4 What is recorded

Our CCTV system records:

• Video footage: images of identifiable individuals as they pass within camera range.
• Date and time stamps associated with each frame.
• Camera location identifiers (which physical camera, in which office, captured the image).

Our CCTV system does NOT record:

• Audio. Audio recording is disabled on all cameras.
• Biometric data. We do not use facial recognition, gait analysis, emotion detection, or any other biometric or AI-based identification on the footage.
• Real-time live monitoring. No one is watching the cameras live. Footage is only reviewed if a specific incident has occurred.

3. Why we use CCTV and our legal basis

We use CCTV for the following purposes:

• Prevention and detection of crime (e.g., theft, vandalism, unauthorised entry);
• Protection of the physical safety of employees, contractors, visitors and other people on our premises;
• Protection of company assets, including IT equipment in server rooms and IT closets;
• Health and safety monitoring (e.g., reviewing footage following an accident or near-miss);
• Support of investigations and legal proceedings.

3.1 Legal basis under the UK GDPR (United Kingdom)

We rely on our legitimate interests (Article 6(1)(f) UK GDPR) in keeping our premises, people and assets secure. 

3.2 Legal basis under the DPDP Act (India)

In India, we process CCTV footage on the basis of Section 7(i) of the Digital Personal Data Protection Act, 2023 (processing necessary for purposes of employment, or for safeguarding the employer from loss or liability). The substantive obligations of the DPDP Act take effect on 13 May 2027. We are aligning our practices with the DPDP framework in advance of full enforcement.

3.3 Legal basis in the United States

We rely on our legitimate business interest in security, premises protection and incident investigation, consistent with applicable U.S. federal and state laws.

4. Who can see the footage

4.1 Inside Harness

Access to CCTV footage inside Harness is strictly limited and granted on a need-to-know basis:

• IT team: the only team with day-to-day access to the video footage.
• Privacy, Security & AI Office (PSAI): may receive footage in connection with privacy investigations, regulatory requests, or legal proceedings.

Every footage access request is logged.

4.2 Outside Harness

We may share CCTV footage with the following categories of external recipients:

• Law enforcement agencies, upon a lawful and documented request (e.g., a court order, subpoena, or formal police request), and in consultation with Legal and HR.
• Insurers, in connection with an insurance claim arising from an incident on our premises, with appropriate confidentiality safeguards.
• Our CCTV system provider (see Section 5): strictly as our processor, on documented instructions, to provide the storage and technical infrastructure as may be required.

We do not sell CCTV footage and we do not share it for marketing, advertising, or any other purpose unrelated to those listed in Section 3.

5. Service providers and international transfers

Our CCTV system is provided by:

6. How long we keep footage

We keep CCTV footage only for as long as necessary for the purposes described in Section 3. Retention periods vary by country to reflect local legal expectations:

These periods may be extended only where a specific incident is under active investigation, or where footage is needed for the establishment, exercise or defence of a legal claim. In such cases, the relevant clip is preserved separately, with its retention documented, and is deleted as soon as the investigation or matter has concluded.

7. How we keep footage secure

We apply the following technical and organisational measures to CCTV footage:

• Cameras are positioned to capture only the areas listed in Section 2.1; positioning is audited periodically by our IT and DPO;
• Audio recording is disabled by default and across the board;
• Footage is stored in our provider's secure cloud platform, encrypted in transit and at rest;
• Access is restricted to individually named accounts (no shared logins) and is governed by role-based permissions;
• Every access to footage is logged, including timestamp and the identity of the person who viewed or exported it;
• Access requests from teams other than IT must be submitted through our FreshService ticketing system with a documented business justification, and are reviewed by the DPO;
• Where footage is exported (for example, to share with law enforcement or insurers), it is exported only to the minimum extent necessary and, where reasonably possible, third parties visible in the same footage are obscured before disclosure.

Full details of our technical and organisational measures are published in the Harness Trust Centers: https://trust.harness.io/.

8. No automated decision-making and no AI analysis

We do not use CCTV footage for any automated decision-making, including profiling, that produces legal or similarly significant effects on you. We do not run facial recognition, emotion detection, behavioural analytics, or any other AI inference on the footage. In particular, our use of CCTV does not fall within the prohibited practices of Regulation (EU) 2024/1689 (the EU AI Act): we do not use AI to infer emotions of individuals or to categorise them on the basis of biometric data.

9. Your rights

Depending on where you are located, applicable data protection laws may grant you some or all of the following rights in respect of CCTV footage that identifies you:

• Access your footage and receive a copy of it.
• Request erasure of your footage in certain situations (assessed on a case-by-case basis, subject to exceptions under Article 17(3) GDPR for legal claims or legal obligations).
• Restrict how we use footage of you in specific cases.
• Object to our processing of footage of you on the basis of our legitimate interests.
• Lodge a complaint with the supervisory authority in your jurisdiction (see Country-Specific Information).

Two rights have specific limits in the CCTV context:

• Rectification: video footage cannot be rectified by its nature. We can correct associated metadata (timestamps, camera identifiers) if it is inaccurate.
• Data portability does not apply, because our processing is based on legitimate interests rather than on consent or contract.

9.1 How to exercise your rights, including access requests for CCTV footage

You can exercise your rights through our privacy portal at  Privacy Portal. To help us locate any footage of you, please tell us:

• The office (city, building, floor) where you believe you were filmed;
• The date and approximate time; 
• A description of yourself (clothing worn, direction of travel) so we can identify you in the footage;
• Proof of identity (we will tell you what we need).

Where the relevant clip also shows other people, we will obscure or remove them before disclosing footage to you, as far as is reasonably practicable.

10. Complaints

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction (see Country-Specific Information below). You may also contact us directly first; we welcome the opportunity to resolve your concerns.

11. Country-Specific Information

The following supplements apply in addition to the main body of this notice, depending on where the office is located. Where a supplement conflicts with the core notice, the supplement prevails for individuals filmed at that location.