Privacy notice video surveillance

F. Hoffmann-La Roche AG (“we”) is committed to protecting your personal data. This privacy notice applies to the collection and processing of data within the context of video surveillance at the Basel and Kaiseraugst locations and describes

• what personal data we collect, store, and process,

• how and for what purposes we collect, process, and share your personal data, and

• what rights you have regarding the use of your personal data.

In this privacy notice, “personal data” means all information relating to you as a directly or indirectly identifiable person, for example your contact details such as your name, address, email address or telephone number, or the license plate number of a vehicle registered to you or used by you.

1. Data controller and contact details

The data controller responsible for processing personal data in accordance with this privacy notice is:

F. Hoffmann-La Roche Ltd

If you have any questions about data protection, please feel free to contact us at the following address:

Grenzacherstrasse 124
4058 Basel
+41 61 688 11 11
Email: global.privacy@roche.com

2. Processing of your personal data

We process your personal data for the following purposes:

• Securing the Basel/Kaiseraugst site against unauthorized access,

• Access control,

• Support for measures and investigations in the event of incidents and accidents on and in the immediate vicinity of the factory premises, as well as for training purposes,

• Documentation of construction, repair, maintenance and demolition measures,

• Investigation of serious misconduct on and in the immediate vicinity of the factory premises, including criminal offenses in critical areas,

• Organization of parking permits and access to parking.

The personal data we process about you comes from different sources:

• Data provided: Personal data that you voluntarily provide to us when you submit data to us or communicate with us (e.g. booking parking spaces);

• Data collected: Personal data that we collect through the use of surveillance cameras and cameras at site access.

3. Disclosure and recipients of your personal data

Your personal data may be shared with other companies of the Roche Group, who will process your personal data for the same purposes as we do. A full list of the companies of the Roche Group is available in the then current financial report, which you can find in the investor section of our website www.roche.com.

Your personal data will be passed on to third parties who provide services on our instructions for the following purposes:

• for system administration and data storage,

• for system and data analysis, process and system optimization,

• where this is necessary for operational audits or reviews, or to investigate or respond to a complaint or threat to security.

Based on court orders, we release your personal data to criminal investigation and prosecution authorities.

Personal data we process may be transferred to and stored in countries with different data protection regulations, including those with less stringent laws than Switzerland. We ensure all such transfers comply with applicable law.

Not all of these countries have an adequate level of data protection. We compensate for the lower protection through appropriate contracts, in particular the so-called Standard Contractual Clauses of June 4, 2021 (EU 2021/914) of the European Commission adapted to Swiss law in accordance with the guidance of the Federal Swiss data protection authority. In certain cases, we may also transfer personal data in accordance with data protection regulations without such contracts, e.g., if you have consented to the disclosure or if the disclosure is necessary for contract processing, for the establishment, exercise or enforcement of legal claims, or for overriding public interests.

4. Information regarding your rights concerning your personal data

You can request information about the data stored about you, its origin and recipients, and the purpose of the data processing. Under the statutory conditions, you also have the right to rectification, erasure, restriction of processing, or objection to processing. You can revoke any consent you have given at any time with effect for the future. The aforementioned rights may be subject to legal restrictions. Exercising these rights may impair or prevent the provision or use of our services.

If you wish to exercise such a right, please contact us (section 1). We will generally need to verify your identity (e.g., by requesting a copy of your ID).