Privacy Policy For Road Test

Privacy Notice - United Kingdom

Privacy Notice for the processing of video and image data in the context of test drives in the United Kingdom for research, development and testing of iMotion Automotive GmbH (“iMotion”) for driving assistance systems, automated driving, driving functions and other services.

Protection of personal data is our top priority and is considered in all our business processes. In the following data protection notices, data subjects will receive an overview of the processing of personal data by iMotion in connection with the processing of video and image data as part of iMotion research, development and testing processes on driving assistance systems, automated driving, driving functions and other services.

We would like to inform the data subjects below about the collection of their personal data within the meaning of Art. 13 and 14 of the UK General Data Protection Regulation (UK GDPR), read together with the Data Protection Act 2018, as amended:

List of contents

1. Who does this Privacy Notice apply to?
2. Who is responsible for the processing of the data and who can be contacted by data subjects regarding data protection?
3. Where does the data come from and what data is processed?
4. What is the data used for (purpose of processing) and on what basis (legal basis) is this happening?
5. Will the data be shared?
6. Will the data be transferred outside the United Kingdom?
7. Is automated decision-making taking place?
8. How long will the data be stored?
9. What rights do data subjects have with iMotion?

1. Who does this Privacy Notice apply to?

Here we inform data subjects about the protection of personal data in the collection, processing and storage of video and image data of the public road environment in the United Kingdom. This data is collected by test vehicles of iMotion for conducting research, development and testing in the fields of driving assistance systems, automated driving, driving functions and other services. This data processing may affect anyone who is in the vicinity of one of the marked test vehicles during testing operations.

The capture of identifying details, such as faces and vehicle number plates, is incidental to recording the surrounding road environment. We do NOT use the recordings to establish individuals’ identities or to build profiles of their personal characteristics or habits. Any analysis of road users’ positions and movements is limited to understanding traffic situations and evaluating the performance of the systems being developed and tested.

2. Who is responsible for the processing of the data and who can be contacted by data subjects regarding data protection?

Controller	We, the iMotion Automotive GmbH Einsteinstr. 12 85716 Unterschleißheim, Germany Tel.: +49 75311272652 E-Mail: info@imotion.ai are the “Controller” responsible for data processing within the meaning of the UK GDPR.
Our DPO	You can contact our Data Protection Officer at: External Data Protection Officer of iMotion Automotive GmbH c/o TÜV SÜD Akademie GmbH Westendstraße 160 80339 Munich, Germany E-Mail: Datenschutz@imotion.ai
Our UK representative	You may also contact our UK representative (Article 27 UK GDPR) about this processing and to exercise your rights under the UK GDPR: TÜV SÜD Limited Octagon House, Concorde Way, Segensworth North, Fareham, PO15 5RL E-Mail: info.uk@tuvsud.com
Our Data Processor	Processor conducting the UK road tests: Lumo Intelligent Technology GmbH Torgauerstr. 231-233 04347 Leipzig, Germany eu.datenschutzvertreter@lumo-intelligent.de Lumo conducts the UK road tests and processes the associated personal data on behalf of iMotion and in accordance with iMotion’s documented instructions.

3. Where does the data come from and what data is processed?

Within the scope of the above-mentioned research, development and testing processes, marked test vehicles move in the public road environment in the United Kingdom. The vehicles use their built-in 360° surround-view camera systems, which comprise fisheye cameras. These systems collect, process and store video and image data from the vehicle environment for the purposes described in Section 4 of this Privacy Policy.

This data may also contain the following personal information, depending on the individual case:

Faces, other characteristics and behavior and environment of road users and other persons in the vicinity of the test vehicles
Number plates, other characteristics and surroundings of vehicles and other objects in the vicinity of the test vehicles
Location

iMotion has taken technical and organizational measures to protect personal data during collection, transfer, storage and use. These measures include IT security controls, data-handling procedures and staff training. Access to video and image data is restricted to authorized personnel who require access for the research, development and testing purposes described in Section 4 of this Privacy Policy.

4. What is the data used for (purpose of processing) and on what basis (legal basis) is this happening?

The purposes of this data processing are research, development and testing in the areas of driving assistance systems, automated driving, driving functions and other services, including documentation of these processes and fulfilment of other downstream obligations.

Driving assistance systems and driving functions already serve to increase road safety, but also comfort, in today's vehicles. In future automated and autonomous vehicles, technical systems for the perception and management of traffic and environmental situations enable such vehicles to participate in road traffic in a compliant and safe manner. Other services make it possible to make means of transport, traffic and traffic systems safer, more efficient and more comfortable.

Research, development and testing of such systems require their use in test vehicles under real environmental and traffic conditions - also in public road environments - including the collection, processing and storage of video and image recordings during and after these operations. Using these materials, technical systems for the perception and classification of road users, vehicles, infrastructure and other objects in the context of traffic and environmental situations are researched, developed and tested.

In the context of data processing, persons, vehicles, other objects are classified and further processed only as "objects" in the context of traffic and environmental situations; e.g. as "pedestrian on the right side of the road", "car on junction", "siren signal behind the vehicle". A name or other personal identification of captured persons or an assignment of captured vehicles or objects to such identified persons is not a purpose of this processing. Individuals may nevertheless be identifiable in raw footage, which is handled as personal data.

The primary legal basis for processing is the "protection of legitimate interests" in accordance with Article 6(1)(f) UK GDPR. iMotion has a legitimate interest to carry out research, development and testing on driving assistance systems, automated driving, driving functions and other services.

We rely on this basis only where the processing is necessary for those interests and those interests are not overridden by the interests, rights and freedoms of the people concerned. In addition, technical and organisational measures are taken to protect the collected personal data. Your right to object is explained in Section 9.

5. Will the data be shared?

iMotion engages Lumo Intelligent Technology GmbH as a data processor to support the testing activities and associated data handling. Lumo uses IBM Cloud services to facilitate the transfer of video and image data, with the relevant cloud service provider acting as Lumo’s sub-processor. Lumo and its sub-processor process these data on behalf of iMotion and in accordance with the applicable data processing instructions.

The video and image data are also provided to iMotion’s parent company in China for decoding and technical analysis in connection with the research, development and testing purposes described in Section 4 of this Privacy Policy.

6. Will the data be transferred outside the United Kingdom?

Personal data collected during UK test drives is transferred to iMotion’s parent company in China for decoding and technical analysis for the purposes described in Section 4 of this Privacy Policy. Lumo Intelligent Technology GmbH, acting as iMotion’s processor, uses IBM Cloud services to support the data transfer.

China is not covered by UK adequacy regulations. For these transfers, we rely on the European Commission’s Standard Contractual Clauses (EU SCCs), supplemented by the International Data Transfer Addendum issued by the UK Information Commissioner’s Office (UK Addendum), as the contractual safeguard under Article 46 UK GDPR.

7. Is automated decision-making taking place?

We do NOT use the data to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals within the meaning of Articles 22A to 22D UK GDPR. We do NOT carry out profiling of individuals.

8. How long will the data be stored

We keep the collected data in a secure environment for the time necessary to achieve the purpose for which it was collected but no longer than 3 months from collection date.

9. What rights do data subjects have with iMotion?

Our test vehicle is equipped with stickers to notify data subjects that their images might be captured by the test vehicle. The stickers also provide QR code on how to access this privacy notice issued by iMotion.

As a data subject, you have certain rights under the UK GDPR. However, please note that in this case we are not in a position to identify the data subject, and for the purpose of data processing we do not require the identification of a data subject. Therefore, according to the Art. 11 p. 2 UK GDPR, if you want to exercise your rights as a data subject, please provide us with more additional information to help us fulfill your request. The additional information needed is the date, time, and location where you encountered our test vehicle, as well as your clothing or license plate information at the time, or any other information that would help us identify you personally.

· Right of access:

As the data subject, you have a right to access under the conditions set forth in Art. 15 UK GDPR. It means that you are entitled to obtain confirmation from us as to whether we process your personal data. If this is the case, you are also entitled to information about this personal data and the information listed in Art. 15 p.1 UK GDPR. This includes, for example, information about the purpose of processing, the categories of the processed personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.

· Right to rectification of inaccurate data:

As the data subject, you have a right to rectification under the conditions set forth in Art. 16 UK GDPR. Since video and image recordings are a factual representation of reality at a specific moment, they are by nature "accurate." As we do not process these recordings to create a profile or a biography, rectification typically does not apply to the visual content itself.

· Right to erasure:

As the data subject, you have the right to erasure (“right to be forgotten”) under the conditions set forth in Art. 17 UK GDPR. This means that you have the fundamental right to obtain from us the erasure of the personal data concerning you without undue delay and that we have the obligation to erase personal data without undue delay where one of the grounds listed in Art. 17 p. 1 UK GDPR applies. This can be the case, for example, if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. By way of exception, the right to erasure (“right to be forgotten”) shall not apply to the extent that processing is necessary on the grounds listed in Art. 17 p. 3 of the UK GDPR.

· Right to restriction of processing:

Data subjects have the right to request a restriction of the processing of their data.

· Right to object:

As the data subject, you have a right to object provided the conditions set forth in Art. 21 UK GDPR apply.

As the data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art 6 p.1 lit. e or f UK GDPR.

· Right to complain to a supervisory authority:

You have the right to complain to the Information Commissioner's Office (ICO) about our processing of your personal data.