Camera survaillance privacy notice

Last updated: Feb 17^th 2026

1. Controller

Patria Plc
Arkadiankatu 2
FI-00100 Helsinki
Finland

2. Contact in Data Protection Matters

Azahara González
Compliance Manager for Internal Controls
Hatanpään Valtatie 30
FI-33100 Tampere
Finland
Email: [email protected]

3. Purpose of Processing and Legal Basis

Patria operates camera surveillance systems at its premises and certain managed properties.

3.1 Purposes of Processing

Personal data collected through CCTV may be processed for the following purposes:

Ensuring the safety and security of employees, visitors, and stakeholders
Protecting Patria’s premises, assets, and confidential information
Preventing, detecting, and investigating criminal activity
Preventing and clarifying incidents that jeopardise security, property, or production processes
Investigating workplace accidents, injury cases, or safety incidents
Supporting access control and site security management

CCTV is not used for systematic employee performance monitoring.

3.2 Legal Basis

Processing is based on Article 6(1)(f) GDPR – Legitimate Interests.

Patria has a legitimate interest in:

Protecting its facilities and information
Ensuring the safety of employees and visitors
Preventing and investigating criminal acts
Managing security and operational risks

A documented Legitimate Interest Assessment (LIA) has been conducted to ensure that the rights and freedoms of data subjects are not overridden.

3.3 Source of Data

Personal data is collected directly via installed camera systems.

4. Categories of Data Subjects

Employees
Visitors
Contractors
Customers
Individuals located in monitored area

5. Categories of Personal Data

The CCTV system records:

Digital video images
Location of surveillance area
Date and time stamp

Audio recording is not conducted.

6. Recipients of Personal Data

Access is strictly limited on a need-to-know basis to:

Patria corporate security personnel
Authorised Patria staff where necessary
Technical system suppliers for maintenance and support

All processors are contractually bound under Article 28 GDPR.
Personal data may also be disclosed:

To law enforcement authorities upon lawful request
In compliance with court orders or legal obligations

7. Retention Period

CCTV recordings are retained only for as long as necessary for the purposes described above.

Standard retention period: 2–6 weeks, depending on system capacity and risk assessment
Recordings relevant to an incident, investigation, or legal claim may be retained for the duration of the investigation and any related legal proceedings

Recordings are automatically overwritten after the retention period expires.
Retention is determined based on proportionality and risk, not solely storage capacity.

8 Security Measures

Patria implements appropriate technical and organisational measures including:

Role-based access controls
Restricted viewing rights
Secure network infrastructure
Encrypted storage (where applicable)
Physical access controls to recording equipment
Logging of access to recordings

Access is limited to authorised personnel with a legitimate need.

9. Rights of Data Subjects

Data subjects have the following rights under the GDPR:

A. Right of Access (Article 15)

You may request confirmation of whether your personal data is being processed and obtain a copy of relevant footage, where technically feasible and where this does not adversely affect the rights of others.

B. Right to Rectification (Article 16)

Where applicable.

C. Right to Restriction (Article 18)

Under the conditions set out in Article 18 GDPR.

D. Right to Erasure (Article 17)

Where applicable under GDPR (subject to legal retention obligations)

E. Right to Object (Article 21)

As processing is based on legitimate interests, you may object on grounds relating to your particular situation. Patria will assess whether compelling legitimate grounds override your interests.

F. Right to Lodge a Complaint

You may lodge a complaint with your local supervisory authority or with:

Finland – Office of the Data Protection Ombudsman
Lintulahdenkuja 4, 00530 Helsinki
Email: [email protected]
Phone: +358 29 566 6700

Data subjects have the right to lodge a complaint with a supervisory authority if they consider that the processing of personal data concerning them infringes the applicable data protection regulations.

Country	Contact info
Finland	The Office of the Data Protection Ombudsman Lintulahdenkuja 4, 00530 Helsinki, Finland Postal address: P.O. Box 800, 00531 Helsinki, Finland Phone number: + 358 29 566 6700 Email: [email protected]
Sweden	Integritetsskyddsmyndigheten Postal address Box 8114, 104 20 Stockholm, Sweden Phone number: +46 (0)8 657 61 00 Email: [email protected]
Belgium	Autorité de protection des données Website: https://www.autoriteprotectiondonnees.be/citoyen  Phone number: +32 (0)2 274 48 00 Email: [email protected]
Latvia	Data Sate Inspectorate Republic of Latvia Elijas 17, Riga, Latvia Website: https://www.dvi.gov.lv/en  Email: [email protected]
The Netherlands	Autoriteit Persoonsgegevens Hoge Nieuwstraat 8, 2514 EL The Hague, The Netherlands Website: https://autoriteitpersoonsgegevens.nl   Phone number: +31 88 1805 250
Germany	Die Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI) Husarenstraße 30, 53117 Bonn, Germany Website: www.bfdi.bund.de  Phone number: +49 (0)228-997799-0 Email: [email protected]

11. Exercising Your Rights

Requests can be made by email to [email protected] or by submitting the FORM here
Patria may request reasonable identification information to verify identity before releasing footage. Identification requirements will be proportionate and not excessive.
Patria will respond within one month as required by GDPR.

12. Automated Decision-Making

No automated decision-making or profiling is conducted using CCTV data.

13. Updates

This Privacy Notice may be updated from time to time. The latest version will be available on Patria’s website.