V.1 Last updated
September 17, 2026
CCTV Privacy Notice
— Budbee Stores
1. Who we are
Instabee Group AB and its subsidiary Budbee Oy, within the Instabee Group (“Instabee”, “we” or “us”), respect and are committed to protecting your privacy. This notice is for anyone who visits our Budbee stores. Signs , in Finnish, outside each monitored area tell you that camera surveillance is in use. Said signs also contain a QR code which will redirect data subjects to this present Notice.
JOINT DATA CONTROLLER
Instabee Group AB
Org. no. 559396-6236
Hälsingegatan 40, 113 43 Stockholm, Sweden
JOINT DATA CONTROLLER
Budbee Oy
Org. no. 2923782-9
Perhonkatu 6, 00100 Helsinki, Finland
Instabee Group AB (Sweden) and Budbee Oy (Finland) are joint controllers for the camera surveillance described in this Notice. This means we decide together why and how the footage is used, and we have agreed between us how responsibilities are divided.
Budbee Oy (Finland) operates the camera surveillance in the Budbee stores in Finland. It deals with the service providers (processors) chosen for this activity, and it manages the handling of the footage. Most of the employees who may view footage work at Budbee Oy in Finland, and access is limited to those who need it for the purposes described in this Notice.
Instabee Group AB (Sweden) sets the group-wide CCTV policy and the data protection rules and safeguards that apply to the system. This includes rules on who may access footage, retention periods, security measures and how incidents are handled.
2. What we record
Our surveillance system records images and video of you and your belongings while you are in a camera-monitored area. That is all it records.
RECORDING HOURS
24 hours a day, 365 days a year.
RECORDING TYPE
Audio is never recorded. Video only. No hidden cameras
Anyone present in a monitored Budbee Store may appear in the footage including, end-customers, Instabee Staff, suppliers, partners and any other individuals in the Budbee Store.
3. Why we film
CCTV
Camera surveillance in Budbee stores
WHY WE USE IT
Prevent and, where necessary, investigate unauthorised access to Budbee stores.
Legitimate interests
Prevent and, where necessary, investigate theft or vandalism of equipment or assets owned by Instabee, our staff or visitors.
Legitimate interests
Prevent and, where necessary, investigate safety threats and risks, such as fire, physical violence or hazardous or unwanted objects.
Legitimate interests
WHO’S AFFECTED
Staff, suppliers, partners and all other visitors to a Budbee store
WHAT WE COLLECT
Video footage
KEPT FOR
Up to 10 days. Longer only if an incident is captured and until the matter is closed
SHARED WITH
Selected Instabee employees on a need-to-know basis; companies within the Instabee Group where necessary; and public authorities or other third parties in defined cases.
What the cameras are not for.
The CCTV system is not used to monitor employees’ work or attendance, or to monitor any other individual present in the monitored areas.
4. Legal basis
We rely on our legitimate interests (Art. 6.1(f) GDPR) in (i) protecting our property and equipment, (ii) protecting the parcels entrusted to us by merchants or customers, and (iii) providing a safe environment for customers, drivers and staff. Because our stores are unmanned, the footage lets us verify what happened when an incident is reported. Our documented balancing assessment concluded that these aims cannot be met as effectively by less intrusive means, such as on-site security personnel, and that they do not override your rights. We carried out a balancing-of-interests assessment and concluded that the processing is necessary to pursue those interests. You can object at any time, as explained in section 7.
5. How long we keep it
STANDARD RETENTION
Up to 10 days
IF AN INCIDENT IS CAPTURED
Footage is kept up until the matter is closed.
Footage of an incident is saved on a secure medium and is accessible only to personnel with a strict need-to-know. An incident includes unauthorised access to a Budbee store, theft or vandalism of equipment or other assets, or threats or security risks to individuals within monitored areas.
An incident is:
unauthorised access to one of our Budbee stores;
theft or vandalism of equipment or other assets; or
threats or security risks to individuals within monitored areas.
If a foorage is handed to authorities, they decide how long to keep it.
6. Who sees the footage
Inside our organisation. A small number of staff with a need to know, such as Security, Lockers Operations Managers, Legal and HR (only where relevant to a serious incident involving Staff or Drivers). Access is logged. All Instabee Staff is located in the EEA (mainly Sweden and Finland)
Service providers (processors). These act only on our instructions, under contracts required by Art. 28 GDPR:
Security Companies
The companies from which we bought the CCTV cameras.
Other recipients. We disclose footage only where we have a valid basis and only what is needed:
Police and other authorities, to investigate suspected crime or where the law requires it
Insurers and legal advisers, to handle claims
Courts and other parties, to establish, exercise or defend legal claims
Footage are stored on private servers located in Finland.
7. Your rights
Under data protection law, you can:
Information & access
Ask how we process your personal data and get access to it.
Object
Object to processing based on our legitimate interests.
Erasure
Have your data erased in certain circumstances.
Restriction
Ask us to restrict processing while we verify a concern.
Some of these rights apply only in specific circumstances. This processing does not involve automated decision-making. You also have the right to lodge a complaint with the Swedish or Finnish Data Protection Authority.
FINLAND
SUPERVISORY AUTHORITY
Tietosuojavaltuutettu
https://tietosuoja.fi
8. Contact & complaints
Instabee Group AB and Budbee Oy are joint data controllers for the processing described in this notice. Contact details for both companies and for our Data Protection Officer are below. You can exercise your rights against either company,
Data Protection Officer
Joint data controllers, by country of establishment.
SE
Sweden
Instabee Group AB
Hälsingegatan 40, 113 43 Stockholm, Sweden
Org. no. 559396-6236
FI
Finland
Budbee Oy
Perhonkatu 6, 00100 Helsinki, Finland
Org. no. 2923782-9
9. Changes to this notice
We review this notice regularly and update it as necessary. If a change is significant and the law requires us to notify you or ask for your consent, we will do so.
Questions about this notice? Contact our Data Protection Officer at dpo@instabee.com.