Ulster Stores CCTV Privacy Notice

Who we are

Ulster Stores operates closed-circuit television (CCTV) across its stores and business premises in Northern Ireland, Wales and Jersey. We are the data controller for these systems.

Our stores sit in two separate legal systems. Our Northern Ireland and Wales stores are governed by United Kingdom data protection law. Jersey is a Crown Dependency with its own data protection law, and the UK GDPR does not apply there. This notice explains how we use CCTV across all of our stores, and sets out clearly where your rights and our obligations differ depending on which store you were in.

You can contact us about any data protection matter by telephone on 028 7035 2222, or by post:

Data Protection Dept.
Ulster Stores
Strand House
Loughanhill Business Park
Gateside Road
Coleraine
BT52 2NR

Our CCTV systems

We operate CCTV cameras in and around our stores and business premises in Coleraine and Portrush (Northern Ireland), Llandudno (Wales) and St. Helier (Jersey). Cameras typically cover entrances and exits, sales floors, tills and service areas, stockrooms, loading and delivery points, and car parks and the areas immediately outside our buildings. The cameras record images of people in and around the areas they cover.

Signs are displayed at the entrances to, and within, each site to tell you that CCTV is in operation and to point you to this notice.

We also operate a video intercom at our Coleraine premises. The intercom has two-way audio and video, which are only available when a user presses the call button.

Other than the video intercom described above, our CCTV systems do not record audio. They do not use facial recognition or any other form of biometric identification, they do not use automatic number plate recognition, and they are not used to make automated decisions about any individual.

Application of legislation

The table below summarises the application of data protection legislation.

Why we use CCTV

We use CCTV in all of our locations to:

• protect the safety of our customers, staff, contractors and visitors;
• prevent, deter, detect and investigate crime and antisocial behaviour, including theft, fraud, abuse of staff and criminal damage;
• protect company property, stock and premises;
• help us respond to incidents and accidents, and to support health and safety investigations;
• help us respond to insurance claims and to establish, exercise or defend legal claims; and
• assist the police and other authorised agencies where there is a lawful basis for us to do so.

We do not use CCTV to monitor the performance or productivity of our staff.

Our lawful basis for using CCTV

Coleraine, Portrush and Llandudno (UK stores)

For the operation of our CCTV systems generally, our lawful basis is Article 6(1)(f) of the UK GDPR - legitimate interests. Our legitimate interests are those set out in the section above. We have carried out and documented a legitimate interests assessment which balances those interests against your rights and freedoms, and we keep that assessment under review.

Where we process footage specifically in order to detect, investigate or prevent crime, or to help apprehend or prosecute offenders, we rely on Article 6(1)(ea) of the UK GDPR - recognised legitimate interest. That basis, and the crime condition in Annex 1, paragraph 5 of the UK GDPR on which it depends, were introduced by the Data (Use and Access) Act 2025.

Where footage amounts to personal data relating to criminal convictions and offences (for example, footage retained because it records a suspected theft), we also rely on Article 10 of the UK GDPR together with section 10(5) of, and paragraph 10 of Schedule 1 to, the Data Protection Act 2018 - preventing or detecting unlawful acts. We maintain an Appropriate Policy Document covering that processing, as that Schedule requires.

St. Helier (Jersey store)

For the operation of our CCTV system in Jersey, our lawful basis is Article 9 of the Data Protection (Jersey) Law 2018 together with paragraph 5 of Part 1 of Schedule 2 to that Law - legitimate interests. Under Jersey law the test is whether the processing would be unwarranted by reason of prejudice to your rights and freedoms or legitimate interests. We have documented that assessment.

Jersey law treats data relating to a person’s criminal record or alleged criminal activity as special category data. Where we retain or share footage because it records suspected criminal activity, we therefore also rely on a condition in Part 2 of Schedule 2 to that Law - normally paragraph 19 (prevention of unlawful acts) or paragraph 12 (legal proceedings, and establishing, exercising or defending legal rights).

We have carried out a data protection impact assessment for our Jersey system, as Article 16 of that Law requires for the systematic monitoring of a publicly accessible area.

Wherever you are, you have the right to object to processing carried out on the basis of legitimate interests. See "Your rights" below.

Who maintains our systems

Our CCTV and associated security systems at all of our locations are installed, maintained and supported by Advanced Overwatch, a Northern Ireland specialist CCTV contractor providing CCTV installation, maintenance, consultation and control room services.

Advanced Overwatch acts only on our instructions, as our data processor, and cannot use the footage for its own purposes. We have a written contract with Advanced Overwatch which meets the requirements of Article 28 of the UK GDPR for our UK stores and Article 19 of the Data Protection (Jersey) Law 2018 for our Jersey store.

Advanced Overwatch: https://www.advancedoverwatch.com - Telephone: 028 7087 8077

Please note that requests about your personal data should be made to Ulster Stores, not to Advanced Overwatch (see "Your rights" below).

Who we share footage with

We may share footage with the police for the prevention, investigation or detection of crime, and with courts, legal representatives, insurers or other authorised agencies where there is a lawful basis for us to do so. The relevant police force depends on where the footage was recorded:

• Coleraine and Portrush - the Police Service of Northern Ireland (PSNI);
• Llandudno - North Wales Police / Heddlu Gogledd Cymru;
• Helier - the States of Jersey Police, and where relevant the Honorary Police of the Parish of St. Helier.

The PSNI and North Wales Police process footage they receive for law enforcement purposes under Part 3 of the Data Protection Act 2018. The States of Jersey Police is a competent authority for the purposes of Schedule 1 to the Data Protection (Jersey) Law 2018 and processes footage it receives under that Schedule.

We record every disclosure of footage in a disclosure log, including who requested it, what was provided and the legal basis for release.

Where footage is held, and transfers out of Jersey

Footage from our UK stores is held in the United Kingdom. We do not transfer footage from those stores outside the United Kingdom.

Advanced Overwatch, our processor, is based in Northern Ireland. Footage recorded at our St. Helier store may therefore be accessed from, or transferred to, the United Kingdom for maintenance, technical support and control room services. Under Article 66 of the Data Protection (Jersey) Law 2018 the United Kingdom is a third country, so this is a cross-border transfer. It is permitted under Article 66(2)(a) because the United Kingdom benefits from a European Commission adequacy decision, which Jersey law recognises. That decision was renewed in December 2025 and currently runs to 27 December 2031.

We do not transfer footage from any of our stores to any other country.

How long we keep footage

Footage is normally kept for 31 days and then automatically deleted. The only exception is footage that is needed for an investigation, an insurance claim or legal proceedings, which is exported, held securely and kept only for as long as it is needed for that purpose.

This retention period applies at all of our locations. Neither UK nor Jersey law sets a fixed retention period for CCTV; both require us to keep footage no longer than is necessary, and we review this period annually.

Your rights

Wherever you are, you have the right to:

• ask us to confirm whether we hold footage of you, and to be given a copy of it (a subject access request);
• ask us to correct information we hold about you that is inaccurate;
• ask us to erase footage, or to restrict how we use it, in certain circumstances;
• object to our use of footage where we rely on legitimate interests; and
• complain to us and to the relevant regulator.

These rights are not absolute. In particular, we may not be able to release footage where doing so would be likely to prejudice the prevention or detection of crime, or the apprehension or prosecution of offenders.

Making a request

Requests should be made in writing and should tell us which store you visited, the date and approximate time, and enough of a description of yourself for us to find you in the footage. Because footage is deleted after 31 days, please make any request as soon as you can.

We may ask you for proof of identity before we release footage. Where footage shows other people, we will blur or otherwise redact their images before releasing it, unless it is reasonable in all the circumstances to release it without doing so.

Write to:

Data Protection Dept.
Ulster Stores
Strand House
Loughanhill Business Park
Gateside Road
Coleraine
BT52 2NR

How long we take - Coleraine, Portrush and Llandudno

For our UK stores, we will respond within one calendar month under Article 15 of the UK GDPR. Where a request is complex, or where you have made a number of requests, we may extend that period by up to a further two months and will tell you within the first month if we do.

Two points introduced by the Data (Use and Access) Act 2025 are worth noting. First, we are required to carry out a reasonable and proportionate search for your footage - not an unlimited one. Second, if we need to confirm your identity, or need you to clarify what footage you are looking for, the time we spend waiting for your reply does not count towards the one month.

There is normally no charge. We may charge a reasonable fee, or refuse a request, only where it is manifestly unfounded or excessive.

How long we take - St. Helier

For our Jersey store, Article 27 of the Data Protection (Jersey) Law 2018 requires us to respond within four weeks, not one month. Where a request is complex, or where you have made a number of requests, we may extend that period by up to a further eight weeks; if we do, we will tell you and give our reasons within the original four weeks.

Requests are free of charge. We may charge a fee covering our administrative costs only for further copies of the same footage, or where a request is manifestly vexatious, unfounded or excessive - and the burden of showing that falls on us.

How to complain

If you are unhappy with how we handle your personal data, please contact our Data Protection Department in the first instance, using the contact details at the top of this notice.

Coleraine, Portrush and Llandudno

For our UK stores, we are required by section 164A of the Data Protection Act 2018 to make it easy for you to complain to us, to acknowledge your complaint within 30 days, and to tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
Telephone 0303 123 1113 • ico.org.uk

The ICO’s Northern Ireland team is based in Belfast and can be reached at ni@ico.org.uk. Its Wales team is based in Cardiff and can be reached at wales@ico.org.uk. A Welsh language telephone service is available by calling 0303 123 1113 and choosing the Welsh language option.

St. Helier

For our Jersey store, you have the right to complain to the Jersey Data Protection Authority, whose office is the Jersey Office of the Information Commissioner (JOIC):

Jersey Office of the Information Commissioner
2nd Floor, 5 Castle Street
St Helier, Jersey
JE2 3BT
Telephone 01534 716530 • enquiries@jerseyoic.org • jerseyoic.org

A complaint to the Authority must be made in writing on its approved form. The Authority will decide within eight weeks whether to investigate.

Legislation

This notice is provided under the following legislation.

Coleraine, Portrush and Llandudno

The UK GDPR (in particular Articles 5, 6, 12, 12A, 13, 15 and 21) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Our use of CCTV also has regard to the Human Rights Act 1998 and to the guidance published by the Information Commissioner’s Office on video surveillance and on protecting a business from crime.

The Surveillance Camera Code of Practice made under the Protection of Freedoms Act 2012 applies to relevant authorities in England and Wales, such as the police and local authorities, rather than to private businesses. It does not extend to Northern Ireland. We nevertheless have regard to its principles at our Llandudno store as a matter of good practice.

St. Helier

The Data Protection (Jersey) Law 2018 (in particular Articles 8, 9, 12, 16, 19, 27, 28 and 66, and Schedule 2) and the Data Protection Authority (Jersey) Law 2018. Our use of CCTV also has regard to the guidance on surveillance and CCTV published by the Jersey Office of the Information Commissioner.

Our Jersey business is registered with the Jersey Data Protection Authority as required by Article 17 of the Data Protection Authority (Jersey) Law 2018.

This notice was last reviewed on 17 August 2026 and is subject to regular review.