DENSO Privacy Notice: On-Board Camera Data Collection

a. The Controllers that are responsible for processing your personal data are: DENSO CORPORATION 1-1 Showa-cho, Kariya-shi, Aichi, 448-8661 Japan (“DNJP”) (also here referred to as “we” or “us” or “our”).

b. The contact details of our Data Protection Officer are as follows:
Sean Duncan
DENSO Automotive Deutschland GmbH („DNDE“)
Rothenfelder Str. 4738440 Wolfsburg, Niedersachsen, Germany
Email: eu_dnde_dpo@eu.denso.com

c. The Controller’s European Representative is:
DENSO International Europe B.V. („DIEU“)
World Trade Centre, Tower-I floor 4, Strawinskylaan 1865, 1077 XX Amsterdam, The Netherlands

This Privacy Notice sets out the basis upon which we process, and how we protect any personal data that we collect from you, or that you provide to us.

The Controller is in the process of developing a further generation of the “advance driver assistance system” (ADAS”). We will therefore be conducting vehicle mobility exercises using specially purposed motor cars, with mounted cameras. The cameras will video record live footage of surrounding public roads. This video footage will therefore capture data about road users, including images of pedestrians, other vehicles and license plates.

If you encounter one of our vehicles engaged in the Project, it may collect the following personal data about you, including video, electronic or visual information:
- Your location;
- The number on the license plate of the vehicle that you are driving;
- Images of any motor vehicle that you have, or are present in;
- Visual indicators of your external features, including your general age group.

The vehicle may also collect the following special categories of personal data, such as:
- your apparent gender;
- facial features;
- ethnicity;
- any visible expressions of your political, religious or philosophical beliefs;
- data concerning your apparent health (mobility or any visible medical devices);
- or any visibly displayed indicators of your sexual orientation.

The ways that you provide us with information include the following:
- By being present within the vehicle camera radius during live Project exercises
- By corresponding with us by phone, e-mail or otherwise (for example, if you contact us to exercise any of your rights as a Data Subject)
- If you report a problem or issue to us
If you contact us, we may keep a record of that correspondence but only for a minimal time period to legally validate how we managed any issue raised.
When you visit our website(s), we may automatically collect information about your computer, including your IP address, information about your visit, your browsing history, and how you use our website or our mobile application(s). This information may be combined with other information you provide to us, as described above.
Please note that all of this is subject to our stated or otherwise reasonable retention period (in section 8 below), and subject at all times to your full rights as Data Subjects (covered in section 9 below).

We will restrict the collection of personal data to what is absolutely necessary and never collect unnecessary personal data. We process your personal data for the following purposes:
- We are trying to develop systems which increase road safety, and improve and enhance the public use of vehicles, by reducing the risk of traffic accidents
- To achieve this, as part of our "advance driver assistance system" ("ADAS"), we are currently researching and developing the recognition of camera. ADAS technology acts as a driving aid and ensures that human beings and road signs are recognized, and the ADAS reacts accordingly. ADAS has programs that make the decisions in the vehicle and help to control the vehicle, enabling (partly) autonomous driving. It contains algorithms for image recognition (AI).
- To develop and improve ADAS, based on the image recognition algorithms.
- To evaluate the ADAS -System & Sensor technology integrated into the test vehicles.

We will only use your personal data when the law allows us to, which is referred to as the “legal basis” for processing. For the purposes of the current Project, the legal bases are mainly covered by the following situations:
Where it is necessary for our legitimate business interests if your interests and fundamental rights do not override those interests- this means that your interests and fundamental rights come first. The legal basis for processing your personal data is our legitimate interests in validating and improving the ADAS functionality. Our primary goals include avoiding traffic accidents and any harmful incidents to persons or property, by recognizing traffic participants and infrastructure, and to support driving processes by acting as a driving aid. More information on the balancing of your interests is also available upon request.
To the extent we process any special categories of personal data, such processing is incidental and necessary for our scientific research purposes. The reason is that such personal data would be impractical or impossible to eliminate before processing (e.g. health data showing that you are using very visible medical devices, such as crutches). In those cases, our interests in incidentally processing such data substantially outweigh those of the data subject in not processing the data, given our objectives.
Where We need to Comply with a Legal or Regulatory obligation (for example, if footage from our cameras detected information relevant to a serious crime)
Where this is in the public health or public interest (for example, during pandemics or medical emergencies)

We require all of our third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. Our instructions are always linked to the legal bases covered above.

We never share your personal information with any parties outside the DENSO Group without your knowledge, and this is always subject to your legal rights as a data subject. The only exception to this is where we are legally obliged to do so, or need to comply with a public health or public interest obligation.

Please consider that we may sometimes sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new participants may use your personal data in the same way as set out in this Notice. They would also be bound by the same legal obligations and responsibilities for your personal data.

We have engaged the following external service providers to provide certain services to us in connection with the Project:
a.DIEU, one of our Group Companies (also the Controller’s European Representative)
b.DNDE, one of our Group Companies, which will coordinate your personal data on our behalf and be operating the vehicles and cameras during the execution of the Project;
c. J-QuAD Dynamics Inc. ( Muromachi Furukawa Mitsui Building, 2-3-1, Nihonbashi Muromachi, Chuo-ku, Tokyo 103-0022, Japan), which will coordinate your personal data on our behalf;
d. DENSO ITALY S.R.L.(Frazione Masio, 24 - 10046 Poirino, Torino, ITALIA), one of our Group Companies, which will coordinate your personal data on our behalf and be operating the vehicles and cameras during the execution of the Project;
e. DENSO AUTOMOTIVE UK, LTD(Coventry Office, Eden Road, Walsgrave Triangle, Coventry, CV2 2TB, The United Kingdom), one of our Group Companies, which will coordinate your personal data on our behalf and be operating the vehicles and cameras during the execution of the Project;
f. Other DENSO entities in Japan which will assist with recognition development of camera. g. The Controllers may in future, due to legitimate business need, engage other processors or sub-processors in other countries, who are not mentioned in this Privacy Notice. In such cases, this Privacy Notice will be updated with such parties' details. Please therefore take note to keep informed by checking this Privacy Notice for any relevant updates.

These service providers have access to and otherwise process your personal data (i.e. they act as processors/sub-processors on our behalf). We will execute legally required contracts(called Data Processing Agreements) with all external service providers that will require them to safeguard your personal data and to process such data only as instructed.

The personal data that we collect about you is transferred to and processed by recipients which are located in Japan. Japan has been recognized by the EU Commission as providing an adequate data protection level as within the EU (Art. 45 GDPR).

The personal data that we collect from you is encoded and temporarily stored within Germany transferred to DENSO in Japan. From there, it is securely stored on servers located within DENSO Japan, or approved sub-processors. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Notice. DENSO has also concluded strict agreements with all parties processing personal information on its behalf.

All information you provide to DENSO is stored on secure servers. The following measures are used to protect your personal data:
All data is securely stored on servers in Japan and encrypted during transfer
All data access has an audit trail
Although the transmission of information via the internet is never completely secure, we will do our best to protect your personal data. Once we have received your personal data, we will use strict procedures and security features to prevent unauthorized access.

Your personal data will be kept for up to 3 years after the end of the Project, subject to your rights referred to in section 9 below. The reason for this period is due to the nature of the technology that we are developing and its need to learn from and refer to the data in its original form. For developmental and accountability reasons, we also need to maintain the original data in its original format for a longer period. In all cases, we will never keep your information longer than strictly necessary under (national or EU) law.

As a Data Subject, you have certain rights and you may freely exercise them at any time by contacting us through this web form. Below is a summary of your rights and what they mean from your perspective:
Access: “show me my personal data.”
Rectification: “correct my personal data.”
Erasure (the Right to be Forgotten): “forget all about my personal data."
Restricted Processing: “you can only do [x,y,z…] with my personal data.”
Notification: “I must know that you have my personal data and what you are doing with it.”
Data Portability: “if I ask you, you must give me my personal data in a format that I can easily use or share.”
Objection: “you cannot process my personal data.”
We would need to immediately stop Processing the Personal Data, unless:
- we somehow had compelling and legitimate grounds for processing your personal data, which override your interests, rights and freedoms (very rare); or
- we needed to continue processing your personal data in order to establish or defend an existing or actually expected legal claim.
Exemption from automated decisions: “you cannot use your systems or processes to categorise me and make automatic decisions about me using my personal data, unless you get extra permission from me with the right for me to obtain human intervention to express my point of view and contest the decision"
If you exercise a right, we will revert to you as soon as possible, and complete it within 1 month, unless the request is exceptional. Please consider that we will be able to satisfy your deletion request only if and when we are not obliged to keep your information under national or EU legislation or reason of public interest.

If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated: privacy@eu.denso.com or eu_dnde_dpo@eu.denso.com.

At all times, you have an absolute right to refer matters about how we use your personal data to: Bayerisches Landesamt für Datenschutzaufsicht