CCTV Policy

Electronic donation terminal and video assistance device
Public version 1.0, approved by the Board of Directors of Cavan Islamic Cultural Society CLG on 10 September 2026. Reviewed annually, or on any change to the system.

Data controller: Cavan Islamic Cultural Society CLG, Ballinagh Road, Gortnakesh, Cavan, H12 WE88
Contact: cavanmosque@gmail.com

A signed PDF of this policy will be available for download here.

1. Purpose of this policy

This policy sets out why Cavan Islamic Cultural Society CLG (“the Society”) operates a camera at the electronic donation terminal at Cavan Mosque, how recordings are handled, and the rights of people who may be recorded. It is written to meet the requirements of the General Data Protection Regulation (GDPR), the Data Protection Act 2018, and the Data Protection Commission’s guidance on CCTV.

2. Description of the system

The system consists of a single Ring Battery Video Doorbell Pro mounted beside the electronic donation terminal. It records video and audio when its button is pressed or when motion is detected within a defined zone covering the terminal and the space immediately in front of it. The device does not record continuously and periodic snapshot capture is switched off. Recordings are stored in Ring’s cloud service.

The camera’s field of view is confined, as far as the device allows, to the donation terminal, the protective enclosure and the approach to them. It is not intended to, and must not be positioned to, monitor the prayer area, ablution facilities or any space where worshippers have a heightened expectation of privacy. The Board will check the field of view at each review.

3. Purposes and lawful basis

The terminal was stolen earlier in 2026 and recovered by An Garda Síochána, and was interfered with again in September 2026. The system is operated for the following purposes only:

Prevention and detection of crime: deterring and evidencing interference with, damage to, or theft of the terminal, the device, the enclosure, cabling and socket protection, and the donations the terminal holds.
Protection of property and persons: safeguarding charitable funds entrusted to the Society and the safety of members and visitors using the terminal.
Assistance to visitors: the device’s call function lets a visitor request help from a member of the team; live video and two-way audio are used for that call.

The lawful basis for processing is legitimate interests, Article 6(1)(f) GDPR. The Society’s legitimate interest is the protection of charitable property and the funds donated by the community. A legitimate interests assessment has been carried out and is held by the Society. Recordings are not used for any other purpose, including monitoring attendance or conduct at worship.

4. Data controller and processor

Data controller: Cavan Islamic Cultural Society CLG, Ballinagh Road, Gortnakesh, Cavan, H12 WE88. Enquiries: cavanmosque@gmail.com.

Data processor: Ring LLC / Amazon Europe Core S.à r.l. stores recordings on the Society’s behalf under Ring’s terms of service and data processing terms. Data is held on Amazon Web Services infrastructure within the European Union for EU accounts. The Society does not use Ring’s optional features that share footage with third parties.

5. Who has access

Access to live view and recordings is restricted to the directors of the Society, each of whom holds an individual, named Ring account. No other users are registered on the system. Shared logins are not permitted. Should the Board later wish to add team members to answer assistance calls, they will be given Limited permissions only, without access to recordings, and this policy will be updated. The list of account holders is reviewed at each Board meeting and access is removed when a person ceases to hold office.

Recordings are viewed only where there is a specific reason to do so: an alert, a report of tampering or theft, a request from An Garda Síochána, or a subject access request. Routine or curiosity viewing is prohibited. Every viewing or export of a recording is entered in the Society’s access log.

6. Disclosure

Recordings will be disclosed only:

to An Garda Síochána on request in connection with the prevention, detection or investigation of an offence, or in support of a complaint made by the Society;
to the Society’s insurers or legal advisers where required for a claim or proceedings;
to a data subject exercising their right of access (section 8);
where otherwise required by law.

Recordings are not published, posted online or shared with the media or the wider community.

7. Retention

Recordings are retained in the Ring service for 30 days and are then deleted automatically. Periodic snapshot capture is disabled. A recording may be kept beyond 30 days only where it is required as evidence of an incident, for a Garda request or for a subject access request; in that case it is downloaded, stored securely by a director, logged, and deleted when no longer needed.

8. Rights of individuals

Anyone who may have been recorded has the right to:

Access: to request a copy of footage in which they appear. Requests should be sent to cavanmosque@gmail.com with the date, approximate time and a description of themselves. The Society will respond within one month. Where footage shows other people, their images will be obscured or the footage withheld if that is not possible.
Object: to object to processing based on legitimate interests; the Society will consider the objection and respond in writing.
Erasure: to ask for deletion, subject to the Society’s need to retain footage for an incident or legal claim.
Complain: to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28; www.dataprotection.ie.

9. Signage

A notice is displayed at the terminal stating that CCTV is in operation, the purposes, the lawful basis, the identity and contact details of the data controller, the retention period and where this policy can be obtained. The notice is reproduced in the Society’s donation terminal signage.

10. Security

Ring accounts are protected by two-step verification and individual passwords.
The device is mounted in a lockable enclosure; tampering is itself recorded and reported.
Downloaded footage is stored only on a director’s password-protected device and deleted when no longer needed.
Any personal data breach involving recordings is reported to the Board immediately and, where required, to the Data Protection Commission within 72 hours.

11. Review

The Board reviews this policy, the camera’s field of view, the retention setting, the list of account holders and the access log at least annually and whenever the system is changed.

How to make a subject access request

Email cavanmosque@gmail.com, or write to the address above, with the date, an approximate time window and a description of yourself so the footage can be located. Footage is only held for 30 days, so please ask promptly. The Society will:

note the date your request was received and, if there is any doubt, confirm your identity;
locate the relevant recording and export the clip, blurring other identifiable people or, if that is not possible, providing a description of the footage instead;
provide the footage or a response within one month, free of charge, and record the request in the access log;
if the request is refused in whole or in part, explain why in writing and tell you of your right to complain to the Data Protection Commission.