TAKE-TWO INTERACTIVE – CCTV PRIVACY POLICY

Our Use of CCTV

We have installed CCTV cameras in various areas of our premises to:

• Protect our facilities, assets, and personnel; and

• Deter, detect, record, and allow analysis of any type of incident, including malicious actions such as theft or vandalism, accidents, fires, floods, and other emergency situations.

We recognise the need to balance an individual's right to privacy with the need to ensure the safety and security of the Company’s employees, visitors, and corporate assets. We do not deploy CCTV equipment in private areas, such as toilets or changing rooms.

Where CCTV is deployed externally, we try to avoid capturing images of public streets and buildings (including private spaces) which do not belong to the Company (unless permitted by local law).

Notice of CCTV filming will be provided in the vicinity of any recorded space. Unless we can demonstrate it is otherwise justified, we will not deploy covert CCTV technology.

Our CCTV systems respond to movement and are active 24/7. Our security teams can access a live feed from the CCTV recordings as well as recordings.

Why We Collect, Use, and Store this Personal Data

We deploy CCTV for our legitimate business interests based on Art.6(1)(f) GDPR in maintaining the security of persons and integrity of our facilities and for use in connection with legal claims, compliance, regulatory, auditing, insurance, investigative, and disciplinary purposes and other ethics and compliance reporting requirements.

We take precautions to ensure that our interests do not infringe upon your data protection rights and have carried out balancing tests for all the data processing we carry out based on our legitimate interests. You can obtain information on our balancing test by contacting us using the details set out later in this policy.

We may also process your personal data contained within CCTV footage where necessary to comply with a legal obligation, such as disclosures to law enforcement agencies or in connection with legal claims, health & safety compliance, regulatory, investigative, and disciplinary purposes (including disclosure of such information in connection with legal process or litigation).

How Long We Retain CCTV Footage

As a matter of course, and depending on the location (see below), we retain the footage we collect for no longer than the time period identified below, after which any collected footage is overwritten, deleted, anonymised, or destroyed.

We only retain copies of select portions of footage for longer periods in specific circumstances where there is a specific and justified reason to do so, including for investigative or legal purposes. We retain such copies only for as long as needed for the identified purpose and a reasonable period thereafter to defend against ongoing, reasonably anticipated, or potential legal claims.

How We Share Your Personal Data

Only authorised personnel have permission to operate the CCTV systems and view the images, including our Company Physical Security Team, and appropriate management (e.g., facility manager), internal and external legal advisors, insurance providers, and police, law, and regulatory enforcement authorities.

The data is stored on premises in the Czech Republic, France, Ireland, Spain, and the United Kingdom.

Your Choices and Rights

With regard to your personal data that we process, you may have the following rights pursuant to Art. 15-18 and Art. 19-21 GDPR: you have the right to ask the Company for a copy of your personal data; to correct, delete or restrict processing of your personal data; and to obtain the personal data you provide in a structured, machine-readable format. In addition, you can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement or compelling interest).

Where we have asked for your consent, you may withdraw consent at any time. If you ask the Company processing your data to withdraw your consent, this will not affect any processing which has already taken place at that time.

In France, you also have the right to leave guidelines about the processing of your personal data after your death.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included in the GDPR and its implementing laws. We will inform you of relevant exemptions we rely upon when responding to any request you make.

To exercise any of these rights, or to obtain other information, such as a copy of a legitimate interests balancing test, you can get in touch with us using the details set out below. If you believe that we have not complied with the requirements of the GDPR with regard to your personal data, you have the right to lodge a complaint with the data protection authority in the country where you live, work, or where you believe a breach may have occurred.

Contact Us

The data controller for the data we process will depend on the location you are in and is set out in the table below. If you contact us and wish to exercise your rights pursuant to Art. 15-18 and Art. 19-21 GDPR as detailed above, please identify the controller and CCTV location where your data was captured. Also please tell us if you are a visitor or an employee of the controller in that location.

If you have questions about this policy or wish to contact us for any reason in relation to our personal data processing, please contact us at [email protected].

Last Updated: 25 August 2022