ICEYE CCTV privacy notice

ICEYE is committed to ensuring the safety of our employees, visitors, property, and information. We use a closed-circuit television (“CCTV”) system on our sites. This Notice explains how ICEYE processes your Personal Data regarding CCTV monitoring.

This notice has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection legislation (“Data Protection Laws”).

As a data controller, ICEYE processes your Personal Data in accordance with this Privacy Notice unless otherwise required by law. We ensure that collected Personal Data is adequate, relevant, necessary, and processed for explicit purposes.

Your Personal Data is processed to:

1. Control access to premises and restricted zones,
2. Ensure site security,
3. Protect ICEYE staff and visitors,
4. Protect ICEYE premises and information,
5. Investigate unauthorized access to premises
6. Prevent, detect, and investigate theft and sabotage of assets.

The CCTV system is not used for other purposes, such as monitoring employee performance or attendance.

Cameras provide general oversight; individual identification occurs only during security or data protection incidents.

CCTV cameras are installed at all ICEYE sites worldwide.

Visible signage with controller contact details and a QR code linking to this Privacy Notice is placed near camera locations.

We may share Personal Data internally with subsidiaries within and outside the EEA, ensuring all recipients uphold equivalent data protection standards and contractual obligations.

In exceptional circumstances and where legally grounded, security footage may be shared with law enforcement or investigative public bodies.

ICEYE abides by good data management practices, a high duty of care, and strict data security measures to protect your Personal Data. We treat your Personal Data confidentially. It is not disclosed or sold to any third party other than our vendors and subsidiaries unless disclosure is required by the law, judicial body, or government agency. Your Personal Data will be stored in secured databases, which use both technical and organizational measures to ensure data security.

We do not regularly transfer your Personal Data outside of the European Economic Area. However, the collected data may be partially stored outside of the European Economic Area if our subsidiary is located, or stores the data outside of the European Economic Area. In such cases, we aim to ensure that your Personal Data is transferred to these territories based on a valid data transfer mechanism, such as European Commission Standard Contractual Clauses , and that our subsidiaries and vendors maintain at the minimum the security standards that we set for ourselves. Your Personal Data will always be processed in accordance with the Data Protection Laws, these data protection principles, and descriptions of our data registers.

As a data subject, you have statutory rights regarding your Personal Data. ICEYE responds to all requests in accordance with applicable data protection laws.

You have a right to:

Request access to your Personal Data (commonly known as a "data subject access request"). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.

We reserve the right to refuse requests that are manifestly unfounded or vexatious. If you request multiple copies or submit more than one request per year, a reasonable administrative fee may apply.

Request rectification of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.

Request erasure of your Personal Data when there is no legitimate reason for continued processing. Erasure requests may be limited by specific legal obligations.

Object to processing where we rely on legitimate interests, if you feel it impacts your fundamental rights and freedoms. We may continue processing if we demonstrate compelling legitimate grounds.

Request restriction of processing to suspend processing in the following scenarios:

• To establish data accuracy,
• When processing is unlawful but you oppose erasure,
• When data is needed to establish, exercise, or defend legal claims,
• While verifying overriding legitimate grounds following an objection.

This Privacy Notice was last updated on September 21, 2026.

We reserve the right to update this Notice and will provide updated versions accordingly.

Data controller:
ICEYE Oy
Maarintie 6,
02150 Espoo
Finland

For questions regarding Personal Data processing or to exercise your rights, contact us at privacy@iceye.fi.