Last updated
September 17, 2026
CCTV Privacy Notice
—Instabox Stores
1. Introduction
1.1. Instabee Group AB and its subsidiaries within the Instabee Group ("Instabee", "we", or "us") respect and are committed to protecting your privacy. This privacy notice informs you about the personal data we collect, as well as how we process and protect it in accordance with applicable laws and regulations. This notice is directed to individuals who visit our Instabox stores (“you”).
1.2. In this notice, we describe how Instabee processes personal data collected through camera surveillance in our Instabox stores, in Sweden (“Stores”). We also provide information regarding this surveillance via physical signs displayed outside said Stores.
2. What Personal Data Do We Process and From Where Do We Get It From?
2.1. Instabee collects images and video footage of you and your belongings within the camera-monitored area through our surveillance system. No audio recording is performed.
2.2. Our CCTV systems are in operation 24 hours a day, 365 days a year.
2.3. The following categories of individuals may be subject to the processing of personal data covered by this privacy notice:
Instabee's staff, suppliers, and partners who are present in our Stores; and
Any other individuals present within our Stores.
3. For What Purpose Do We Process Your Personal Data?
3.1. Processing is necessary to fulfill Instabee's legitimate interest (Article 6.1(f) GDPR) to prevent and, where necessary, investigate:
unauthorized access to Stores; and
theft or vandalism of equipment or assets owned by Instabee, Instabee staff/employees, or visitors, as well as safety threats and risks (e.g., fire, physical violence, or the presence of hazardous/unwanted objects).
NOTE: The CCTV system is not used for any other purpose, such as monitoring employees' work or their attendance, or for monitoring any other individual present in the monitored areas.
4. What Are the Legal Basis for the Above Processing?
4.1. The legal basis for this processing is our legitimate interests (Article 6.1(f) GDPR). Through a balancing of interests assessment, we have determined that this processing is necessary to pursue our legitimate interests.
5. How Long Do We Keep Your Personal Data?
5.1. CCTV footage will be stored for up to 10 days.
5.2. If an incident is captured on footage, the retention period may be extended. In such cases, the footage will be retained for the duration necessary to handle and resolve the incident. The recordings will be saved on a secure medium and accessible only to personnel with a strict need-to-know basis. An incident includes:
unauthorized access to one of our Stores,
theft or vandalism of equipment or other assets; or
threats or security risks to individuals within monitored areas.
6. Recipients of Your Personal Data
6.1. Instabee applies strict guidelines regarding access to CCTV footage. Only a small number of employees selected on a "need-to-know" basis have access to the material. In some cases, it is necessary for us to share CCTV footage and the personal data contained therein with third parties. Instabee does this to fulfill the purposes set out in this privacy notice. For example, we may need to share your personal data with other companies within the Instabee Group.
6.2. Instabee may also share CCTV footage and the personal data contained therein with public authorities or other third parties:
in an investigation of suspected crime or other irregularities,
to comply with legal obligations, regulations, or administrative decisions, or to establish, exercise, or defend legal claims, or
if we otherwise have a legitimate interest.
7. Your Rights in Connection With Our Processing
7.1. Under applicable data protection legislation, you have certain rights in relation to us. These are generally outlined below:
Right to information and access (subject access request) – a right to information about our processing of your personal data and access to your personal data.
Right to object – a right to object to our processing of your personal data if it is based on our legitimate interest.
Right to erasure – a right to have your personal data erased under certain circumstances unless the data is necessary for a specific purpose or another legal basis applies.
Right to restriction of processing – a right to request that the processing of your personal data be restricted, e.g., if you contest the accuracy of the data. Our access to the data is restricted while its accuracy is being investigated.
7.2. Some of these rights apply only in specific circumstances. To exercise any of these rights or to request additional information, please contact us using the details provided in section 8.2 below ("Contact details for data controller and data protection officer"). Please note that the processing described in this notice does not involve automated decision-making. You also have the right to lodge a complaint regarding our processing of your personal data with the Swedish Authority for Privacy Protection (IMY). For more information about your rights and filing complaints, please visit their website.
8. Contact Details of the Data Controller and the Data Protection Officer
8.1. Instabee Group AB is the data controller for the processing of personal data described in this privacy notice.
8.2. In the table below, you will find contact details for our DPO
Instabee Group AB - Org. No: 559396-6236
Adress: Hälsingegatan 40, 113 43 Stockholm, Sweden Alströmergatan 39, 112 47 Stockholm, Sweden
Contact details for DPO: dpo@Instabee.com
9. Updates and Questions
9.1. We regularly review this privacy notice and update it as necessary. If significant changes are made that require notification or consent under applicable law, you will be notified or provided the opportunity to give your consent accordingly.
9.2. If you have any questions regarding this privacy notice, please contact our DPO at dpo@Instabee.com.