It is important to us that the handling of your personal data is transparent and trustworthy. In line with the requirements of the UK GDPR, EU GDPR, the Data Protection Act 2018, and related data protection legislation, we would like to inform you about how we process your personal data and how you can exercise your rights.

1. Data Controller

CCTV and drone systems at our UK & Ireland sites are operated by the relevant RWE Group companies responsible for each technology area, alongside the individual project companies and special purpose vehicles ("SPVs") that own or operate specific sites. Depending on the type of site, the relevant controller(s) are:

For the purposes of CCTV and drone data processing, these organisations and their respective SPVs are collectively referred to as the "RWE Group".  All entities follow common data protection standards overseen by the RWE Data Protection Team, operating within RWE Generation UK Plc.

A full list of RWE Group companies, including SPVs, is available on request by contacting the Data Protection Officer (see Section 2).

2. Data Protection Officer

You can contact our data protection officer at the following address:

• RWE Generation UK Plc, Legal Department, Trigonos, Windmill Hill Business Park, Whitehill Way, Swindon, SN5 6PB, United Kingdom.
• Email: [email protected]

3. Personal data we process and its purpose

RWE uses CCTV and drone systems to:

• Protect the safety and security of employees, contractors, and visitors
• Prevent and detect crime, vandalism, and unauthorised access
• Safeguard critical infrastructure and company assets
• Support the investigation of security incidents, accidents, and allegations of misconduct
• Ensure compliance with legal, operational, and health and safety obligations.

Drone surveillance may also be used for site security investigations and to assist operations, especially in restricted or hard-to-reach areas. While not intended for continuous individual monitoring, identifiable persons may occasionally be recorded during incidents or  security-related activities.

We do not intentionally collect special category or criminal offence data.

Please note that automated decision-making, including profiling, is not carried out.

4. Areas Monitored and collection of Personal Data

• CCTV is used only in areas where there is legitimate security or safety need, with clear signage and communication.
• Surveillance zones are regularly reviewed to minimise intrusion.

5. Legal basis for processing your personal data

• The processing of personal data by CCTV and drones is primarily based on RWE's legitimate interests and, where applicable, those of third parties.
• In certain cases, monitoring may be required by law, for example, under the NIS Regulations for critical infrastructure.
• The legal bases and purposes are recorded and kept under review, with regular Data Protection Impact Assessments (DPIAs).

6. Legitimate Interests Assessment (LIA) and DPIA

• An LIA is kept on record and regularly reviewed to ensure continued compliance and proportionality.
• Routine and periodic DPIAs are undertaken where required, especially if significant changes occur in technology, law, or risk profile.

7. Can Individual’s Opt-Out?

• No general opt-out is offered, as monitoring is automatic and necessary for legitimate interests.
• However, individuals may object to processing based on legitimate interests.  We will assess such objections and stop processing unless we can demonstrate compelling legitimate grounds or where processing is required by law or for the establishment, exercise or defence of legal claims.

8. Data Access and Security

• Surveillance is proportionate and restricted to necessary locations.
• No special category or criminal offence data is intentionally collected.
• Footage is only accessed, when necessary (e.g., following incidents), and not for routine monitoring.
• Access is restricted to authorised personnel.  Access may also be provided to approved service providers under contract (e.g., monitoring centres, integrators, security contractors), subject to appropriate safeguards.
• Technical and organisational safeguards, such as encryption are implemented to minimise privacy impact.
• Regular staff training and policy reviews uphold strict procedures for handling data subject rights and complaints.

9. International Data Transfers

Footage is not routinely transferred outside the UK/EEA. If required, appropriate safeguards (UK IDTA or Addendum, EU SCCs, supplementary measures) will be applied.

10. Data Retention

• CCTV and drone footage is generally deleted within 31 days unless required for an ongoing investigation or legal reasons.
• Data retention is periodically reviewed to ensure necessity and proportionality.

11. Your rights

You can exercise the following rights:

• the right to access and receive a copy of your data;
• the right to rectification and erasure (where applicable);
• the right to request restriction of processing;
• the right to data portability (in certain cases)