Last updated
September 17, 2026
CCTV Privacy Notice
— Instabox Stores
1. Who we are
Instabee Group AB and its subsidiaries within the Instabee Group (“Instabee“, “we“, or “us“) respect and are committed to protecting your privacy. This privacy notice informs you about the personal data we collect, as well as how we process and protect it in accordance with applicable laws and regulations. This notice is directed to individuals (“you”). who visit our Instabox stores, in Sweden (“Stores”).
DATA CONTROLLER
Instabee Group AB
Org. no. 559396-6236
Hälsingegatan 40, 113 43 Stockholm, Sweden
2. What we record
Our surveillance system records images and video of you and your belongings while you are in a camera-monitored area. That is all it records.
RECORDING HOURS
24 hours a day, 365 days a year.
RECORDING TYPE
Audio is never recorded. Video only. No hidden cameras
Anyone present in a monitored Instabox Stores may appear in the footage including, end-customers, Instabee Staff, suppliers, partners and any other individuals in the Instabox Stores.
3. Why we film
CCTV
Camera surveillance in Instabox Stores
WHY WE USE IT
Prevent and, where necessary, investigate unauthorised access to Instabox Stores.
Legitimate interests
Prevent and, where necessary, investigate theft or vandalism of equipment or assets owned by Instabee, our staff or visitors.
Legitimate interests
Prevent and, where necessary, investigate safety threats and risks, such as fire, physical violence or hazardous or unwanted objects.
Legitimate interests
WHO’S AFFECTED
Staff, suppliers, partners and all other visitors to a Instabos Stores
WHAT WE COLLECT
Video footage
KEPT FOR
Up to 10 days. Longer only if an incident is captured and until the matter is closed
SHARED WITH
Selected Instabee employees on a need-to-know basis; companies within the Instabee Group where necessary; and public authorities or other third parties in defined cases.
What the cameras are not for.
The CCTV system is not used to monitor employees’ work or attendance, or to monitor any other individual present in the monitored areas.
4. Legal basis
We rely on our legitimate interests (Art. 6.1(f) GDPR) in (i) protecting our property and equipment, (ii) protecting the parcels entrusted to us by merchants or customers, and (iii) providing a safe environment for customers, drivers and staff. Because our stores are unmanned, the footage lets us verify what happened when an incident is reported. Our documented balancing assessment concluded that these aims cannot be met as effectively by less intrusive means, such as on-site security personnel, and that they do not override your rights. We carried out a balancing-of-interests assessment and concluded that the processing is necessary to pursue those interests. You can object at any time, as explained in section 7.
5. How long we keep it
STANDARD RETENTION
Up to 10 days
IF AN INCIDENT IS CAPTURED
Footage is kept up until the matter is closed.
Footage of an incident is saved on a secure medium and is accessible only to personnel with a strict need-to-know. An incident includes unauthorised access to Instabox Stores, theft or vandalism of equipment or other assets, or threats or security risks to individuals within monitored areas.
An incident is:
unauthorised access to one of our Instabox Stores;
theft or vandalism of equipment or other assets; or
threats or security risks to individuals within monitored areas.
If a foorage is handed to authorities, they decide how long to keep it.
6. Who sees the footage
Inside our organisation. A small number of staff with a need to know, such as Security, Lockers Operations Managers, Legal and HR (only where relevant to a serious incident involving Staff or Drivers). Access is logged. All Instabee Staff is located in the EEA (mainly Sweden and Finland)
Service providers (processors). These act only on our instructions, under contracts required by Art. 28 GDPR:
Security Companies
Other recipients. We disclose footage only where we have a valid basis and only what is needed:
Police and other authorities, to investigate suspected crime or where the law requires it
Insurers and legal advisers, to handle claims
Courts and other parties, to establish, exercise or defend legal claims
Footage are stored on private servers located in Finland.
7. Your rights
Under data protection law, you can:
Information & access
Ask how we process your personal data and get access to it.
Object
Object to processing based on our legitimate interests.
Erasure
Have your data erased in certain circumstances.
Restriction
Ask us to restrict processing while we verify a concern.
Some of these rights apply only in specific circumstances. This processing does not involve automated decision-making. You also have the right to lodge a complaint with the Swedish Data Protection Authority.
8. Contact & complaints
Instabee Group AB is the data controller for the processing described in this notice. You will find DPO's contact details below. Y
Data Protection Officer
SE
Sweden
Instabee Group AB
Hälsingegatan 40, 113 43 Stockholm, Sweden
Org. no. 559396-6236
9. Changes to this notice
We review this notice regularly and update it as necessary. If a change is significant and the law requires us to notify you or ask for your consent, we will do so.
Questions about this notice? Contact our Data Protection Officer at dpo@instabee.com.