Privacy Policy for ADAS Road Tests

Joint Controllership Notice: This data processing is carried out jointly by Nanjing Thundersoft Software Technology Co., Ltd. (hereinafter referred to as the “Thundersoft”) and Lumo Intelligent Technology GmbH (hereinafter referred to as the “Lumo”) (hereinafter referred to as the "Parties"). The Parties act as Joint Controllers within the meaning of Art. 26 of the UK General Data Protection Regulation (UK GDPR). In a joint controllership agreement, the Parties have determined their respective tasks and responsibilities for the processing of personal data and defined who fulfills which data protection obligations. Specifically, this concerns the collection of environmental data through sensor-equipped test vehicles.

The protection of personal data is our top priority and is integrated into all our business processes. We treat the protection of your personal data seriously and strive to ensure that you feel secure and comfortable during our Advanced Driver Assistance Systems (ADAS) road tests.

The ADAS road test means that a test vehicle equipped with Advanced Driver Assistance Systems drives on public roads, collects and stores road video and image data outside the test vehicle. In accordance with the provisions of Articles 13, 14 and 21 of the UK GDPR and the Data Protection Act 2018 (DPA 2018), we hereby inform you about the processing of your personal data collected from ADAS road tests of the controller and your rights in this regard. To ensure that you are fully informed about the processing of your personal data, please take note of the following information:

1. Name and contact data of the Joint Controllers

The parties responsible for the collection and processing of your personal data (Joint Controllers) are:

· Nanjing Thundersoft Software Technology Co., Ltd.

Address, Postal Code, China

E-Mail: 

· Lumo Intelligent Technology GmbH

Torgauerstr. 231-233, 04347 Leipzig, Germany

E-Mail: dpo@lumo-intelligent.ai

In accordance with Art. 26 GDPR, Thundersoft and Lumo have concluded an agreement to determine their respective responsibilities. The essence of this allocation is as follows:

· Information Obligations and Public Notice: Thundersoft is responsible for providing mandatory information at the point of capture, primarily through signs and QR codes attached to the test vehicles.

· Exercise of Data Subject Rights: Lumo (via its DPO and UK Representative) is the central point of contact for all inquiries. Lumo is responsible for coordinating and responding to requests regarding data subject rights.

· Cooperation with Supervisory Authorities: Lumo (via its DPO and UK Representative) acts as the primary liaison for communications with the relevant data protection supervisory authorities in the EU.

· Data Security: Both Parties ensure the technical and organizational security of data within their respective control.

UK Representative of Thundersoft and Lumo:

Pursuant to Article 27 of the UK GDPR, the joint controllers appointed a representative in the United Kingdom to act as our point of contact for UK data subjects and the Information Commissioner's Office (ICO).

You may contact our UK Representative at:

Name/Company:

Address:

E-Mail:

Data Protection Officer of Lumo

You may contact our Data Protection Officer by post at the address of the controller, marked ‘Attn: Data Protection Officer – ADAS’, or by e-mail at: eu.dpo@lumo-intelligent.ai 

2. Purpose of processing

We use video and image data collected during the ADAS road tests to develop, test, validate and improve the algorithms and accuracy of the advanced driver assistance systems. Principally, the video and image data collected from our ADAS road tests are processed to compare whether the advanced driver assistance systems correctly recognize road Information, such as traffic signs, and whether there are vehicles driving or pedestrians passing next to or in front of the test vehicle. In addition, we do not further process the video and image data collected to identify the data subjects.

3. Personal data processed

The video and image data collected by the test vehicle inevitable involve the following personal data:

· Facial images and behavioural patterns of pedestrians within the perception range

· License plate numbers and distinctive characteristics of vehicles in the vicinity

· Location

It should be noted that there may be other types and categories of personal data that are inevitably collected during the ADAS road test. However, we do not carry out any processing or analysis of this data or data related to it. 

The video and image data collected during our ADAS road tests will be uploaded to our platform hosted in Frankfurt, Germany, where personal identifiers such as faces and license plates will be automatically blurred as part of data masking measures. Only data that has been processed in a masked or pseudonymized form will subsequently be used for the purposes of algorithm testing and improvement.

4. Legal basis of the processing

The legal basis in this case is the legitimate interest as defined in Art. 6 p.1 lit f UK GDPR.

5. Source of data

The video and image data are collected by cameras integrated in the test vehicles.

6. Data recipients or categories of recipients

With regard to video and image data collected during ADAS road tests, raw data are not transferred to any recipients.

We only transfer masked or pseudonymized data to other recipients or only grant other recipients access to this data if this is necessary for the purposes of processing this data or if we have entrusted other recipients with the fulfilment of individual tasks or services and access to this data is necessary or cannot be ruled out.

The transfer of the personal data is based on the legitimate interest of the controller pursuant to Art. 6 para. 1 lit. f UK GDPR.

7. Data transfer outside the UK

The raw video and image data collected during ADAS road tests in the United Kingdom (UK) are transferred to the cloud platform in Frankfurt, Germany. This transfer is covered by the UK Government's regulations recognizing the European Union (EU) / European Economic Area (EEA) as providing an adequate level of data protection (Adequacy Decision).

Following data masking and pseudonymization on the Frankfurt cloud platform, the data is transferred to the Controller located in China. To ensure appropriate safeguards for this subsequent transfer of data outside the UK/EEA, we implement necessary contractual data protection frameworks, specifically standard contractual clauses pursuant to Chapter V of the UK GDPR.

8. Storage duration

During ADAS road tests, raw video and image data are initially stored locally on encrypted hard drives installed in or connected to the test vehicles. Once uploaded to our platform, the raw data are deleted from the hard drives without undue delay. Any raw data on the platform are removed after data masking, and in any case no later than one month after upload.

The masked or pseudonymized data, with personal identifiers such as faces and license plates blurred, are stored for up to two years. These data are used solely to develop, test, validate, and improve the advanced driver assistance systems.

9. Automated decision-making

Automated decision-making within the meaning of Art. 22 UK GDPR, which has a legal effect on you, does not take place.

10. Your rights as data subject

As a data subject, you have certain rights under the UK GDPR. However, please note that in this case we are not in a position to identify the data subject, and for the purpose of data processing we do not require the identification of a data subject. Therefore, according to the Art. 11 p. 2 UK GDPR, if you want to exercise your rights as a data subject, please provide us with more additional information to help us fulfill your request. The additional information needed is the date, time, and location where you encountered our test vehicle, as well as your clothing or license plate information at the time, or any other information that would help us identify you personally.

· Right of access:

As the data subject, you have a right to access under the conditions set forth in Art. 15 UK GDPR.

This primarily means that you are entitled to obtain confirmation from us as to whether we process your personal data. If this is the case, you are also entitled to information about these personal data and the information listed in Art. 15 p.1 UK GDPR. This includes, for example, information about the purpose of processing, the categories of the processed personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.

· Right to rectification of inaccurate data:

As the data subject, you have a right to rectification under the conditions set forth in Art. 16 UK GDPR.

Since video and image recordings are a factual representation of reality at a specific moment, they are by nature "accurate." As we do not process these recordings to create a profile or a biography, rectification typically does not apply to the visual content itself.

· Right to erasure:

As the data subject, you have the right to erasure (“right to be forgotten”) under the conditions set forth in Art. 17 UK GDPR.

This means that you have the fundamental right to obtain from us the erasure of the personal data concerning you without undue delay and that we have the obligation to erase personal data without undue delay where one of the grounds listed in Art. 17 p. 1 UK GDPR applies. This can be the case, for example, if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

By way of exception, the right to erasure (“right to be forgotten”) shall not apply to the extent that processing is necessary on the grounds listed in Art. 17 p. 3 of the UK GDPR.

· Right to restriction of processing:

As the data subject, you have a right to restriction of processing under the conditions set forth in Art. 18 UK GDPR.

This means that you are entitled to obtain from us the restriction of processing where one of the conditions listed in Art. 18 p.1 UK GDPR applies.

· Right to object:

As the data subject, you have a right to object provided the conditions set forth in Art. 21 UK GDPR apply.

As the data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art 6 p.1 lit. e or f UK GDPR.

· Right to lodge a complaint with the Commissioner:

As the data subject, you have a right to lodge a complaint with the Commissioner if you as the data subject believe that the processing of your personal data violates the UK GDPR.

To assert your above-mentioned rights, please send your request to the DPO E-Mail address given under “1. Name and contact data of the Joint Controllers”.

Update log:

This is released version 1.0.