During the performance of physical security penetration testing, our operators will inevitably capture, process, or incidentally interact with personal data belonging to our client's employees, contractors, and visitors.4.1 What Information May Be CapturedDuring authorized testing, our team may capture:• Visual Media: Covert video footage, photographs of security perimeters, and images of unattended workstations or unsecured physical assets.• Access Control Data: Incidentally captured RFID/proximity credential payloads harvested during authorized credential-cloning assessments.• Sensitive Information: Printed documents containing proprietary corporate data, client personal data, or employee logs left exposed in common physical zones.4.2 Legal Basis for Processing Operational Data• Legitimate Interests: We process this data under the joint Legitimate Interest of the Provider and the Client. The processing is strictly necessary to evaluate the physical vulnerabilities, security perimeters, and asset protection mechanisms of the Client's facilities, enabling the Client to harden their security posture and protect human and intellectual assets.• Written Contractual Consent: All operational data captured is governed by an executed Master Services Agreement, Scope of Work, and signed Rules of Engagement (RoE).4.3 Data Minimisation & Blur-by-Default PolicyTo protect third-party privacy, Hades Security Consultancy operates under a strict "Blur-by-Default" protocol:• Any visual media containing faces of employees, security guards, or members of the public will be digitally blurred or redacted before being compiled into final deliverables, unless specifically requested otherwise by the Client for internal disciplinary investigations.• Harvested RFID badge payloads are kept strictly hashed and are permanently deleted immediately upon verification of successful access control replication.