Privacy Policy for ADAS Road Tests

The protection of personal data is our top priority and is integrated into all our business processes. We treat the protection of your personal data seriously and strive to ensure that you feel secure and comfortable during our Advanced Driver Assistance Systems (ADAS) road tests. 

The ADAS road test means that a test vehicle equipped with Advanced Driver Assistance Systems drives on public roads, collects and stores road video and image data outside the test vehicle. In accordance with the provisions of Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data collected from ADAS road tests of Lumo Intelligent Technology GmbH and your rights in this regard. To ensure that you are fully informed about the processing of your personal data, please take note of the following information:

1. Name and contact data of the Controller

Lumo Intelligent Technology GmbH

Torgauerstr. 231-233

04347 Leipzig, Germany

Tel: +49 176362630

E-Mail: Xuanqiang.shen@lumo-intelligent.ai

2. Contact data of the Data Protection Officer (DPO)

External data protection officer of Lumo Intelligent Technology GmbH

c/o TÜV SÜD Akademie GmbH

Westendstr. 160

80339 Munich, Germany

E-Mail: eu.dpo@lumo-intelligent.de

3. Purpose of processing

We collect video and image data collected during the ADAS road tests to develop, test, validate and improve the algorithms and accuracy of the advanced driver assistance systems. Principally, the video and image data collected from our ADAS road tests are processed to compare whether the advanced driver assistance systems correctly recognize road Information, such as traffic signs, and whether there are vehicles driving or pedestrians passing next to or in front of the test vehicle. In addition, we do not further process the video and image data collected to identify the data subjects.

4. Personal data processed

The video and image data collected by the test vehicle inevitable involve the following personal data:

• Facial images and behavioral patterns of pedestrians within the perception range

• License plate numbers and distinctive characteristics of vehicles in the vicinity

• Location

It should be noted that there may be other types and categories of personal data that are inevitably collected during the ADAS road test. However, we do not carry out any processing or analysis of this data or data related to it. 

The video and image data collected during our ADAS road tests will be uploaded to the IBM Cloud platform in Germany, where personal identifiers such as faces and license plates will be blurred as part of data masking measures. Only the processed data will subsequently be used for algorithm testing and improvement purposes.

5. Legal basis of the processing

The legal basis in this case is the legitimate interest as defined in Art. 6 p.1 lit f GDPR. Prior to the processing, we carried out a balancing test to ensure that our legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subjects.

6. Source of data

The video and image data are collected by cameras integrated in the test vehicles.

7. Data recipients or categories of recipients

With regard to video and image data collected during ADAS road tests, raw data are uploaded to IBM Cloud, acting as our processor, for the purposes of masking, pseudonymisation, temporary storage and the transmission of the resulting masked or pseudonymized data on our behalf.

The recipients of masked or pseudonymized are:

• IBM Cloud, acting as our processor; 

• our cooperation partner in China, which receives masked or pseudonymized data for the purposes of developing, testing, validating and improving advanced driver assistance systems; and 

• other recipients, where disclosure is required by law.

The transfer or disclosure of personal data is based, where applicable, on Article 6(1)(f) GDPR.

8. Data transfer outside the EU/EEA

We transfer only masked or pseudonymized personal data to our cooperation partner in China where this is necessary for the purposes described in this Privacy Notice, in particular for the development, testing, validation and improvement of advanced driver assistance systems.

Such transfers are carried out in accordance with Articles 44 et seq. GDPR. In particular, we have entered the EU Standard Contractual Clauses with the recipient and, where required, implemented supplementary technical and organisational measures.

9. Storage duration

During ADAS road tests, the raw video and image data are initially stored on hard drives. Once uploaded to the IBM Cloud platform for masking and pseudonymisation, the raw data are deleted from the hard drives without undue delay. Any raw data remaining on the IBM Cloud platform are deleted after the masking and pseudonymisation process and, in any event, no later than one month after upload.

Following masking and pseudonymisation, the resulting masked or pseudonymized data are temporarily stored on the IBM Cloud platform and securely transmitted to our cooperation partner in China. The masked or pseudonymized data are deleted from the IBM Cloud platform within one month. Our cooperation partner stores the data for up to two years and uses them for the development, testing, validation and improvement of advanced driver assistance systems.

10. Automated decision-making

Automated decision-making within the meaning of Art. 22 GDPR, which has a legal effect on you, does not take place.

11. Your rights as data subject

As a data subject, you have certain rights under the GDPR (Articles 15–22). However, please note that in this case we are not in a position to identify the data subject, and for the purpose of data processing we do not require the identification of a data subject. Therefore, according to the Art. 11 p. 2 GDPR, if you want to exercise your rights as a data subject, please provide us with more additional information to help us fulfill your request. The additional information needed is the date, time, and location where you encountered our test vehicle, as well as your clothing or license plate information at the time, or any other information that would help us identify you personally.

• Right of access: 

As the data subject, you have a right to access under the conditions set forth in Art. 16 GDPR.

This primarily means that you are entitled to obtain confirmation from us as to whether we process your personal data. If this is the case, you are also entitled to information about these personal data and the information listed in Art. 15 p.1 GDPR. This includes, for example, information about the purpose of processing, the categories of the processed personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed (Art. 15 p.1 lit. a, b and c GDPR).

• Right to rectification of inaccurate data: 

As the data subject, you have a right to rectification under the conditions set forth in Art. 16 GDPR.

Since video and image recordings are a factual representation of reality at a specific moment, they are by nature "accurate." As we do not process these recordings to create a profile or a biography, rectification typically does not apply to the visual content itself.

• Right to erasure: 

As the data subject, you have the right to erasure (“right to be forgotten”) under the conditions set forth in Art. 17 GDPR.

This means that you have the fundamental right to obtain from us the erasure of the personal data concerning you without undue delay and that we have the obligation to erase personal data without undue delay where one of the grounds listed in Art. 17 p. 1 GDPR applies. This can be the case, for example, if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

By way of exception, the right to erasure (“right to be forgotten”) shall not apply to the extent that processing is necessary on the grounds listed in Art. 17 p. 3 of the GDPR.

• Right to restriction of processing: 

As the data subject, you have a right to restriction of processing under the conditions set forth in Art. 18 GDPR.

This means that you are entitled to obtain from us the restriction of processing where one of the conditions listed in Art. 18 p.1 GDPR applies.

• Right to object: 

As the data subject, you have a right to object provided the conditions set forth in Art. 21 GDPR apply.

As the data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art 6 p.1 lit. e or f GDPR.

• Right to complain to a supervisory authority: 

As the data subject, you have a right to lodge a complaint with a supervisory authority on the grounds set forth in Art. 77 GDPR.

If you as the data subject believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

To assert your above right, please send your request to the E-Mail address given under “2. Contact data of the Data Protection Officer (DPO)”.

Update log: 

This is released version 1.0.