Privacy Notice: Camera Surveillance Northvolt

1. Information regarding the processing of your personal data

The purpose of this privacy notice is to provide information on how Northvolt AB (“Northvolt” or “we”) and the relevant Northvolt Group companies process personal data of employees and visitors at our offices, factories and similar sites. We respect your privacy and duly protect the Personal Data we process about you. All processing of Personal Data are made in accordance with the GDPR and the Camera Surveillance Act. The following describes how we collect, process and share your Personal Data.

2. What personal data will be processed?

In our offices and at our factories or sites Northvolt may collect and process your Personal Data when you are located within the area where we have surveillance cameras. Cameras are generally located at entry points and other strategically critical locations. You will be notified prior to entering such area by means of noticeable and well-placed signs. The cameras continuously record picture but does not record any sound (your ”Personal Data”). We do not use any image enhancing or face recognition technology, or similar.

3. What is the purpose of processing your personal data?

The purposes of processing your Personal Data are to:

§ Maintain a safe environment for Northvolt’s (and its affiliates’) employees and visitors, e.g. prevent accidents and incidents, and mitigate threats and other risks at our offices, factories or sites;

§ Protect Northvolt’s (and its affiliates’) assets from theft, sabotage, espionage and other criminal activities;

§ Support and share recorded material to the judiciary, police, firefighters or similar national civil protection services in ongoing formal criminal investigations, accidents, incidents or other emergencies relating to Northvolt or its employees or visitors.

In addition to the above main purposes of our camera surveillance, selected cameras installed in the production area of Northvolt’s sites will be used for the purpose of operating the connected factory from a control room, optimising process efficiency and monitoring the production process.

4. What is the legal basis for processing your personal data?

The processing of your Personal Data is necessary for the purposes of legitimate interest pursued by Northvolt. This means that we have carried out a balance of interest test where we have assessed that our interest in processing your Personal Data for each of the purposes described in Section 3 above outweigh the privacy intrusion that you as an employee or visitor may be reasonably exposed to, taking into consideration that (i) you are informed of our processing of your Personal Data before you enter the camera surveillance area, (ii) the processing activities is typically and reasonably expected of you as a visitor and employee, (iii) the processing of Personal Data is limited in terms of technology (no recording of sound and no image enhancing or analysing technology, such as face recognition or super resolution upscaling, is used), (iv) access to recorded material is strictly limited to a small group of trained handlers within Northvolt, tasked to manage surveillance and counter misuse, with strictly limited options to disclose recorded materials, and (v) the retention times of recorded materials are properly limited in time, considering the purposes for which they are processed.

5. Who has access to your personal data?

We have implemented appropriate technical and organisational measures to protect your Personal Data against loss or unlawful access etc. The number of persons with access to your Personal Data are strictly limited to a small group of approved handlers within Northvolt. These individuals are assigned the task to manage surveillance for the purpose of countering any misuse and have been specifically trained for this purpose. Hence, each person in this team is empowered to firmly follow protocol and Northvolt’s internal policies. Only such individuals, which strictly need to process your Personal Data in accordance with the purposes above, will have access to your Personal Data.

We will only share your Personal Data with suppliers that carry out services on our behalf such as legal advisors engaged from time to time. Furthermore we may share your Personal Data in an ongoing formal police investigation relating to Northvolt or its employees or visitors. We may also share your Personal Data to civil protection services, such as firefighters, or other governmental bodies if requested in relation to an emergency, accident or incident.

Your Personal Data will never be transferred to a country outside of EU/EEA.

6. For how long is your personal data stored?

Your Personal Data will be stored on local dedicated servers (i.e. on-site and separately from other servers) only for as long as it is necessary for the purposes in Section 3 above for which the Personal Data are processed.

Your Personal Data is deleted:

§ after three (3) days, although processing will typically involve live feed only, for the purpose of operating the connected factory from a control room, optimising process efficiency and monitoring the production process;

§ after seven (7) days when processed for the purpose of maintaining a safe indoor work and visitor’s environment;

§ after thirty (30) days when processed for the purpose of protecting Northvolt’s assets outdoors (the perimeter protection areas) or indoors as deemed necessary, e.g. at fully automated sections of a factory and high-value or high-security areas; and

§ when legal proceedings and/or ongoing investigations of criminal activities, emergencies, accidents or incidents (as applicable) have ended or been concluded, or otherwise when the recordings are no longer necessary for this purpose.

7. What are your rights?

You are entitled to know what Personal Data we are processing regarding you, and you can request a copy of such data. Note that we may be unable to fully comply with a request from you, if your request will adversely affect the interests, rights and freedoms of other data subjects in such recordings. To the extent applicable to camera surveillance, you are entitled to have incorrect Personal Data regarding you corrected, and in some cases you may request that we delete your Personal Data (if, for example, the Personal Data is no longer necessary for the purpose for which it was collected). You also have a right to object to certain processing of your Personal Data, and request that the processing of your Personal Data be limited.

If you have questions regarding how we process Personal Data concerning you, you are most welcome to contact us at gdpr@northvolt.com.

If you have any objections or complaints with the way we process your Personal Data, you have the right to lodge a complaint with the Swedish Data Protection Authority (Sw. Integritetsskyddsmyndigheten) at www.imy.se.