Privacy Policy: Video Recordings during Research and Development Drives

Für eine deutsche Version bitte hier klicken.

We, Dr. Ing. h.c. F. Porsche AG (hereafter "we" or "Porsche AG"), take the protection of your personal data very seriously, and treat it in strictest confidence. Your personal data is processed only within the scope of the legal provisions of the European Union's data protection law, in particular the General Data Protection Regulation (hereafter "GDPR"), and the German Federal Data Protection Act (Bundesdatenschutzgesetz, hereafter “BDSG”).

In this privacy policy, we provide you with information about the processing of your personal data within the scope of production and evaluation of video recordings in the course of performance and analysis of research and development drives by Porsche AG and about your data protection rights within the scope of such measures.

Within the scope of research and development drives, video recordings inside and outside the vehicle are produced, in particular, for the testing of driver assistance systems. On this occasion dash cams and camera-based assistance systems are used.

1. Controller and data protection officer for data processing; contact

The data processing controller within the meaning of the data protection legislation is:

Dr. Ing. h.c. F. Porsche AG
Porscheplatz 1
70435 Stuttgart
Germany
Contact: https://www.porsche.com/germany/privacy/contact

Please do not hesitate to contact us if you have questions or ideas relating to data protection.

You can contact our data protection officers at the following address:

Dr. Ing. h.c. F. Porsche AG
Data protection officer
Porscheplatz 1
70435 Stuttgart
Germany
Contact: https://www.porsche.com/germany/privacy/contact

2. Subject matter of data protection

The subject matter of data protection is the protection of personal data. This is all the information that relates to an identified or identifiable natural person (known in the legislation as the data subject). This covers, for example, information such as name, postal address, e-mail address, or telephone number as well as video recordings.

3. Purposes of and legal grounds for data processing

An overview of the purposes of and legal grounds for data processing within the scope of the production and evaluation of video recordings made in research and development drives is provided below.

3.1 Safeguarding of legitimate interests
We process your personal data for the production and evaluation of video recordings in the course of performance and analysis of research and development drives for the following purposes and legitimate interests, respectively:

  • Development of products, services and service offering (component development, applied research, fundamental research)
  • Improvement of product quality, elimination of errors and malfunctions with the help of video recording analysis (product monitoring)
  • Safeguarding of legal compliance, prevention of and protection against violations of the law (in particular criminal offences), assertion of and defence against legal claims
  • Maintenance of availability, operation and security of technical systems as well as technical data management

The following data are processed during the production and evaluation of the video recordings or are linked with those recordings, respectively:

  • Video data (incl. audio and photo data); particularly when testing driver assistance systems, biometric features (e.g. in the face) may also be recorded, but not for identification purposes
  • Vehicle and vehicle usage data (technical vehicle data, vehicle interior and environment information)
  • Location and position data (GPS position)

The production and evaluation of video recordings in the course of performance and analysis of research and development drives is based on of Article 6 (1) (f) GDPR. We process the personal data that is necessary to pursue and safeguard the above-mentioned legitimate interests, unless your interest in the protection of personal data overrides in the individual case.

3.2 Compliance with legal obligations
We also process your personal data to comply with legal obligations to which we are subject. The respective purposes may arise from the respective legal obligation, for example, the processing may serve the purpose of fulfilling state control and information obligations.

Such data processing is based on Article 6 (1) (c) GDPR. In this respect, we process the personal data required to fulfil the legal obligation.

4. Recipients of personal data

Internal recipients: Within Porsche AG, the only people who have access are those who need it for the purposes named in Section 3 above.

External recipients: We only forward your personal data to external recipients outside Porsche AG if this is necessary for the analysis of data from research and development drives.

External recipients can be:

  • Processors
    Affiliate companies of Porsche AG or external service providers, in particular in the area of measuring data evaluation and interpretation for product, component and software optimization. We carefully select and regularly inspect these processors. The service providers may only use the data for the purposes we have specified.
  • Public bodies
    Authorities and public institutions to which we must transfer personal data for legal reasons. The data is transferred on the basis of Article 6 (1) (1) (f) GDPR.
  • Affiliate companies of Porsche AG
    Affiliate companies of Porsche AG to which we transfer data to pursue legitimate interests. The transmission is then based on Article 6 (1) (1) (f) GDPR.
  • Research partners
    Research institutes as well as research and developing partner companies to which we transfer data in order to pursue legitimate interests. The data is transferred on the basis of Article 6 (1) (1) (f) GDPR.

5. Data processing in third countries

If data is transferred to bodies whose headquarters or place of data processing is not located in a member state of the European Union or in another country outside of the European Union that is a signatory to the treaty, we ensure before forwarding the data that, outside of legally permitted exceptional cases pertaining to the recipient, either an appropriate level of data protection exists (e.g., through an adequacy decision of the European Commission, through suitable guarantees such as a self-certification by the recipient for the EU-US Privacy Shield, or the agreement of EU standard contractual clauses between the European Union and the recipient) or your sufficient consent exists.

We can provide you with an overview of the recipients in third countries and a copy of the specifically agreed regulations to ensure the appropriate level of data protection. To obtain these, please contact the address specified in Section 1.

6. Duration of storage, deletion

We store your personal data only for the length of time necessary to fulfill the purposes stated in Section 3. In case of your objection we delete your personal data provided that no other legal grounds apply. We also delete your personal data when we are obliged to do so under applicable law.

In application of these general principles and as a general rule, we delete your personal data immediately

  • after the legal grounds cease to apply and provided that no other legal grounds apply. If the latter is the case, we delete the data once the other legal grounds cease to apply.
  • if we no longer need the data to pursue and safeguard legitimate interests and no other legal grounds apply. If the latter is the case, we delete the data once the other legal grounds cease to apply.
  • if our purpose of processing ceases to apply and no other legal grounds apply (e.g. obligations to preserve records arising from tax or commercial law). If the latter is the case, we delete the data once the other legal grounds cease to apply.

7. Rights of data subjects

As the data subject affected by the data processing, you have several rights. Specifically,

Right of access: You have the right to obtain information from us about the data that we have stored about you.

Right of rectification and erasure: You have the right to demand that we rectify incorrect data and – provided the legal requirements are met – that we delete your data.

Restriction of processing: You have the right – provided the legal requirements are met – to demand that we restrict the processing of your data.

Data portability: If you have provided us with data on the basis of a contract or consent, you have the right, in accordance with the legal requirements, to obtain the data you have provided in a structured, standard, and machine-readable format or you can demand that we transfer this data to another controller.

Objection to the processing of data on the legal grounds of "legitimate interest": You have the right to object at any time, on grounds relating to your particular situation, to our processing of your data, provided this objection is based on the legal grounds of "legitimate interests". If you exercise your right to object, we will cease the processing of your data unless we can – pursuant to the legal requirements – prove compelling legitimate reasons for further processing, which override your rights.

Withdrawal of consent: If you have given us consent to process your data, you can withdraw this consent at any time with effect for the future. The lawfulness of the processing of your data remains unaffected up until the time of the withdrawal of consent.

Please note the following particularities in case of processing of data for the purposes of research and development drives: The recorded video data essentially is processed to capture the vehicle environment in order to identify obstacles as well as other road users and, for example, effectively avoid accidents or enable (partially) autonomous driving. This serves to develop the vehicle systems into market-ready functionalities. An identification of the recorded individuals is generally not possible for Porsche AG and is not intended to be. Accordingly, Porsche AG may not be obliged or able to grant rights of access, rectification, cancellation, or limitation of processing, and may not be obliged or able to comply with data transferability and/or objection rights. If identification is not possible, we will provide respective explanation to you. In such a case, you have the option to provide Porsche AG with additional information to enable identification (e.g. details regarding your appearance and clothing at the time of recording; place, time and date of contact with the test vehicle; registration plate or at least type and color of test vehicle). If we are able to identify you with the help of this additional information, we will of course comply with your rights within the scope of our legal obligations.

Right to lodge a complaint with a supervisory authority: You can also submit a complaint to the competent supervisory authority if you believe that the processing of your data is in breach of the legislation. To do so, you can apply to the data protection authority that is responsible for your town/city or country or the data protection authority that is responsible for us.

Contacting us and exercising your rights: Please do not hesitate to contact us if you have any questions regarding the processing of your personal data, your rights as a data subject and any consent that you may have given. To exercise all of these previously mentioned rights, please contact https://www.porsche.com/international/privacy/contact/ or at the postal address specified above in Section 1. In doing so, please ensure that it is possible for us to uniquely define you. If you wish to withdraw your consent, you can use the method of contact that you used when you gave your consent.

8. Status

The latest version of this privacy policy applies.
Status 04/16/19.