Video Surveillance and Access Control Privacy Notice

1. General

In this Privacy Notice, we describe our access control operations and how we process personal data collected through access control, i.e. the log data of our access control systems and video surveillance footage in which the data subject can be identified.

The data are collected directly from the data subjects themselves when they move within an area subject to access control, such as our offices or construction sites

2. Data Controller

The controller for the processing activities described in this Privacy Notice is Skanska Oy and each of its subsidiaries, as well as Skanska CDF Oy (“Skanska” or “we”), in relation to their own projects, construction sites and other places of use.

Skanska Oy’s subsidiaries are Skanska Talonrakennus Oy, Skanska Infra Oy and Skanska Rakennuskone Oy.

3. From which sources do we collect your data

The data are collected directly from the data subjects in connection with access control. Access control is indicated by clear and visible notices in the environment where the surveillance is carried out.

4. What data do ww process

In connection with access control carried out by Skanska, the following personal data are processed:

Video surveillance recordings of persons moving in Skanska’s premises and in the video surveillance area

Log data collected in connection with access control at construction sites:

name or other identifying information that can be linked to a person
time and place of the access event

5. On what grounds and in what situations do we conduct video surveillance

Video surveillance

The purpose of the processing of personal data is to ensure the personal safety of Skanska’s employees and/or other persons present in Skanska’s premises, to ensure general corporate security, and to protect the controller’s property. The purpose of processing personal data is also to monitor the proper functioning of production processes and to prevent and address identified hazardous situations and possible misuse.

The controller has taken into account the requirements imposed by national special legislation, in particular the Act on the Protection of Privacy in Working Life, regarding video surveillance.

The controller does not conduct video surveillance:

In staff and social facilities, changing rooms, toilet facilities or other similar spaces, nor in a personal office assigned for the employee’s use

For monitoring an employee or certain employees at the workplace, except where it is necessary due to:

an apparent threat of violence, danger to safety or health directed at the employee
preventing and investigating offences against property, if the employee’s duties essentially involve handling property of significant value or quality, such as money, securities or valuables
at the employee’s request, if the video surveillance is based on ensuring the employee’s interests and rights and the matter has been agreed between the employer and the employee

However, in all situations, the controller/employer has the right to use the image material also for the following purposes:

to prove the grounds for termination of an employment relationship
to investigate and prove harassment or inappropriate conduct referred to in the Equality Act, or harassment and inappropriate conduct referred to in the Occupational Safety and Health Act. In these situations, the employer must have justified grounds to suspect that the employee has engaged in harassment or inappropriate conduct
to investigate a work accident or another situation that has caused danger or a threat as referred to in the Occupational Safety and Health Act.

Access control at construction sites

The processing of data collected in connection with access control at construction sites is based on compliance with the statutory processing and retention obligations laid down in the relevant legislation. The processing of access control data may also be necessary for the establishment, presentation or defence of legal claims.

6. To whom do we disclose the data

As a rule, personal data processed in connection with video surveillance and access control are not disclosed to third parties. However, on a case-by-case basis, we may disclose your personal data in situations required and permitted by applicable law:

to other companies belonging to the Skanska Group. Our group companies may process your personal data for the purposes defined in this Privacy Notice
to subcontractors acting on behalf of Skanska, who process personal data on our behalf based on an assignment given by us. A service provider holding a licence for the security sector is responsible for managing the personal data generated by video surveillance, and processes the data on behalf of the controller
in connection with legal proceedings or at the request of an authority, on the basis of applicable law or by court order in the context of judicial or administrative proceedings. Based on a court decision, personal data (e.g. access control data from a construction site) may be disclosed to parties in civil or criminal proceedings. We may also disclose data to competent authorities, such as the police, the Tax Administration and similar entities

in situations required and/or permitted by law
based on your consent, we may also disclose data to other parties

As a general principle, personal data is not transferred outside the European Union or the European Economic Area (EU/EEA). In certain situations, however, service providers or other processors involved in the processing of personal data may be located outside the EU/EEA.

Personal data may be transferred to third countries in accordance with applicable data protection legislation and subject to appropriate safeguards. Such safeguards include, among others, standard contractual clauses adopted by the European Commission, adequacy decisions, and other transfer mechanisms permitted under applicable data protection laws.

7. How long do we retain your data

Personal data are retained only for as long and only to the extent necessary for the processing activities described above. Video surveillance recordings are deleted when they are no longer needed for the purpose of video surveillance. Individual video surveillance records may, however, be retained and processed for a longer period if this is necessary for the establishment, presentation or defence of a legal claim, or if there is another lawful basis for retention.

The retention period for access control data at construction sites is determined in accordance with the retention periods laid down in the relevant legislation.

8. Your rights

In accordance with current data protection legislation, you have the rights specified below. We process your personal data to the extent necessary to exercise your rights.

Right of access to your data

You have the right to obtain confirmation from the controller whether your personal data is being pro-cessed or not. If your personal data is being processed, you have the right of access to the personal data we process about you. We may refuse to provide information if there is a legal basis for doing so.

Right to rectification, erasure or restriction of processing

You have the right to request us to rectify any incorrect information about you. In addition, you can request us to delete some information about you or request the restriction of processing on legal grounds.

Right to object to the processing of your data

You have the right to object processing on grounds relating to your particular personal situation, provided that we are processing your personal data on the basis of legitimate interest. You can submit your objection request to us by contacting tietosuoja[at]skanska.fi. You must specify the specific situation on the basis of which you object to the processing. Skanska has the right to refuse your request if the processing is necessary for the purposes of Skanska's or a third party's legitimate interests.

Right to withdraw your consent

You have the right to withdraw your consent to the processing of your personal data to the extent that the processing is based on your consent.

Right to data portability

To the extent that we process your data on the basis of a contract and the processing is carried out by automated means, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format and the right to transmit such data to another data controller.

Right to lodge a complaint before a competent supervisory authority

If you consider that the processing of your personal data has not complied with the requirements of the applicable data protection legislation, you can always contact Skanska. You can also refer your case to the supervisory authority. In Finland, the supervisory authority responsible for data protection matters is the Data Protection Ombudsman (TSV).

9. Contact information

If you would like to know more about how we process your personal data at Skanska, or if you wish to exercise your rights as a data subject under data protection legislation, please contact us as follows:

Jere Sundqvist
P.O. Box 114, FI-00101 HELSINKI
Nauvontie 18, FI-00280 HELSINKI
tietosuoja[at]skanska.fi

10. Changes and updates to this privacy notice

We regularly review our personal data processing practices and possible update needs, and we may also make changes to this Privacy Notice from time to time. The current version is available on Skanska’s website.

Last updated: 9 June 2026