CATARC Europe Testing and Certification GmbH (CATARC) is pleased that you are interested in our company and Advanced Driver Assistance Systems (ADAS) products. We treat the protection of your personal data seriously and strive to ensure that you feel secure and comfortable during our ADAS road tests. The ADAS road test means that a test vehicle equipped with Advanced Driver Assistance Systems drives on public roads, collects and stores road video and image data outside the test vehicle.
In accordance with the provisions of Articles 13 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data collected from ADAS road tests of CATARC and your rights in this regard. To ensure that you are fully informed about the processing of your personal data, please take note of the following information:
1. Name and contact data of the Controller
CATARC Europe Testing and Certification GmbH
Otto-Hahn-Str. 8
85435 Erding
Tel: +49 8122 9458 93 7/8/9
E-Mail: info.europe@catarc.ac.cn
2. Contact data of the Data Protection Officer (DPO)
Externer Datenschutzbeauftragter der CATARC Europe Testing and Certification GmbH
c/o TÜV SÜD Akademie GmbH
Westendstr. 160
80339 München
E-Mail: dpo.europe@catarc.ac.cn
3. Purpose of processing
We use photos and videos captured by our test vehicles to support our research, analysis and verification activities. In particular, we analyze these photos and videos to understand information about the movement and behavior of pedestrians and other drivers on the road, to develop and train detection sensors used in new vehicles (which may be vehicles sold by us or another vehicle manufacturer), and to develop and train the artificial intelligence used in our products and services.
In any case, the images we collect will never be correlated with other data that could be used to identify you, nor will they be used to make decisions about you. We are not interested in identifying you, nor do we allow other people to identify you from our images. The images are only used for technical and statistical purposes to develop and improve products and are used in scientific research to improve artificial intelligence and all related technologies.
4. Personal data processed
The video and image data collected by the test vehicle inevitable involve the following personal data:
· Facial images of pedestrians
· Behavioral information of pedestrians
· License plate numbers of passing vehicles
· Location
It should be noted that there may be other types and categories of personal data that are inevitably collected during the ADAS road test. The raw data collected during the road test phase will be anonymized within 7 working days. The anonymized data will no longer contain any personal data.
5. Legal basis of the processing
The legal basis in this case is the legitimate interest as defined in Art. 6 p.1 lit f GDPR.
6. Source of data
The video and image data are collected by cameras integrated in the advanced driver assistance systems.
7. Data recipients or categories of recipients
We only transfer your personal data to other recipients or only grant other recipients access to your personal data if this is necessary for the purposes of processing this personal data or if we have entrusted other recipients with the fulfillment of individual tasks or services and access to this personal data is necessary or cannot be ruled out.
The categories of recipients of personal data are:
- Affiliated companies in our group of companies
- Processors
- OEM partners and their suppliers
The transfer of the personal data is based on the legitimate interest of the controller pursuant to Art. 6 para. 1 lit. f GDPR.
8. Data transfer outside the EU/EEA
In general, we do not transfer your data outside the European Union (EU) or the European Economic Area (EEA).
If, in exceptional cases, your personal data is transferred to countries/service providers outside the EU or EEA, we conclude the necessary data protection contracts, in particular EU standard contractual clauses, or take the measures required under Art. 44 et seq. DS-GVO required measures.
9. Storage duration
We store the original data, which may contain personal data, for one month, in special cases for three months, in encrypted form in a secure environment. The original data is only used as a backup to ensure that the anonymized data is not corrupted and can be used in further analysis, after which the original data is deleted.
Anonymized data does not contain any personal data. This data will be deleted after processing and analysis, at the latest after one year.
10. Automated decision-making
Automated decision-making within the meaning of Art. 22 GDPR, which has a legal effect on you, does not take place.
11. Your rights as data subject
Please note that in this case we are not in a position to identify the data subject, and for the purpose of data processing we do not require the identification of a data subject. Therefore, according to the Art. 11 p. 2 GDPR, if you want to exercise your rights as a data subject, please provide us with more additional information to help us fulfill your request.
The additional information which we needed is the date, time, and location where you encountered our test vehicle, as well as your clothing or license plate information at the time, or any other information that would help us identify you personally.
· Right of access:
As the data subject, you have a right to rectification under the conditions set forth in Art. 16 GDPR.
This primarily means that you are entitled to obtain confirmation from us as to whether we process your personal data. If this is the case, you are also entitled to information about these personal data and the information listed in Art. 15 p.1 GDPR. This includes, for example, information about the purpose of processing, the categories of the processed personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed (Art. 15 p.1 lit. a, b and c GDPR).
· Right to rectification of inaccurate data:
As the data subject, you have a right to rectification under the conditions set forth in Art. 16 GDPR.
This primarily means that you are entitled to obtain from us the rectification of inaccurate personal data or completion of incomplete personal data concerning you without undue delay.
· Right to erasure:
As the data subject, you have the right to erasure (“right to be forgotten”) under the conditions set forth in Art. 17 GDPR.
This means that you have the fundamental right to obtain from us the erasure of the personal data concerning you without undue delay and that we have the obligation to erase personal data without undue delay where one of the grounds listed in Art. 17 p. 1 GDPR applies. This can be the case, for example, if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
By way of exception, the right to erasure (“right to be forgotten”) shall not apply to the extent that processing is necessary on the grounds listed in Art. 17 p. 3 of the GDPR.
· Right to restriction of processing:
As the data subject, you have a right to restriction of processing under the conditions set forth in Art. 18 GDPR.
This means that you are entitled to obtain from us the restriction of processing where one of the conditions listed in Art. 18 p.1 GDPR applies.
· Right to object:
As the data subject, you have a right to object provided the conditions set forth in Art. 21 GDPR apply.
As the data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art 6 p.1 lit. e or f GDPR.
· Right to complain to a supervisory authority:
As the data subject, you have a right to lodge a complaint with a supervisory authority on the grounds set forth in Art. 77 GDPR.
If you as the data subject believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
To assert your above right, please send your request to the E-Mail address given under “2. Contact data of the Data Protection Officer (DPO)”.
Stand: 08.2024
