Privacy Notice for ADAS Road Tests
The protection of personal data is our top priority and is integrated into all our business processes. We treat the protection of your personal data seriously and strive to ensure that you feel secure and comfortable during our Advanced Driver Assistance Systems (ADAS) road tests.
The ADAS road test means that a test vehicle equipped with Advanced Driver Assistance Systems drives on public roads, collects and stores road video and image data outside the test vehicle. In accordance with the provisions of Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data collected from ADAS road tests of Guangzhou WeRide Technology Co., Ltd. and your rights in this regard. To ensure that you are fully informed about the processing of your personal data, please take note of the following information:
1. Name and contact data of the Controller
Guangzhou WeRide Technology Co., Ltd.
Units 01, 02, 03 and 04, 16th Floor, Building A, KWG Cosmo Plaza, No. 68 Luoxuan Avenue, Guangzhou International Bio Island, Huangpu District, Guangzhou, China.
E-Mail: privacy@weride.ai
Website: www.weride.ai.
In accordance with Article 27 GDPR, the controller has appointed the following EU representative:
EU Representative (Art. 27 GDPR):
Company Name: WeRide Germany GmbH
Address: c/o PROJEKTCAMPUS, Alemannenstrasse 19-23, 71296 Heimsheim
E-Mail: privacy@weride.ai
Website: www.weride.ai
The EU representative acts as the contact point for supervisory authorities and data subjects within the European Union in all matters relating to data protection. For all inquiries regarding data protection and the exercise of your rights, you may send an E-mail to: privacy@weride.ai.
2. Purpose of processing
We collect video and image data collected during the ADAS road tests to develop, test, validate and improve the algorithms and accuracy of the advanced driver assistance systems. Principally, the video and image data collected from our ADAS road tests are processed to compare whether the advanced driver assistance systems correctly recognize road information, such as traffic signs, and whether there are vehicles driving or pedestrians passing next to or in front of the test vehicle. In addition, we do not further process the video and image data collected to identify the data subjects.
3. Personal data processed
The data collected by the test vehicle inevitably involve the following personal data:
- Facial images movements of pedestrians and other road users within the perception range of the vehicle's external cameras;
- License plate numbers and distinctive characteristics of vehicles in the vicinity;
- The geographic route travelled by the vehicle;
- 3D point-cloud data of the surrounding environment captured by LiDAR sensors;
- Short acoustic snapshots are used only for road-event detection.
It should be noted that there may be other types and categories of personal data that are inevitably collected during the ADAS road test. However, please note that we have no intention, nor the technical capability within our system, to identify specific natural persons. Our systems are not equipped with facial recognition or identity tracking functions. The vehicle's sensors are designed to perceive and model the driving environment for the safe operation of the autonomous driving system, not to track or identify individuals.
On-board de-identification: In accordance with the principle of Privacy by Design, we employ state-of-the-art, industry-leading in-vehicle masking technology. Faces and license plates detected in the raw images and video collected during road testing are automatically masked in real time within the vehicle before the data is stored or transmitted outside the vehicle . Consequently, the data retained and subsequently used for the training, validation and further development of our autonomous driving algorithms are subject to automated masking and de-identification measures designed to reduce the identifiability of individuals. While these measures significantly reduce the likelihood of identifying individuals, complete anonymization may not always be technically possible at present. As a result, residual identifiable elements, such as facial images or vehicle license plate information that have not been detected by the automated masking process, may remain present in limited circumstances. We do not use the collected data to identify individuals and continuously review and enhance our masking technology in line with the evolving state of the art to ensure an appropriately high level of data protection.
4. Legal basis of the processing
The legal basis in this case is the legitimate interest as defined in Art. 6(1)(f) GDPR. Prior to the processing, we carried out a balancing test to ensure that our legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subjects.
5. Source of data
The data are collected by external cameras and microphones, LiDAR sensors and other sensors integrated in the test vehicles.
6. Data recipients or categories of recipients
We only transfer masked or pseudonymized data to the following categories of recipients:
- WeRide group companies (in European Union (EU), European Economic Area (EEA), China), on a strict need‑to‑know basis, for the R&D purposes;
- our processors, including the entities conducting road tests, responsible for uploading the data, or providers of cloud storage and data transmission services;
- our cooperation partner in EU and/or EEA and/or China, which receives masked or pseudonymized data for the purposes of developing, testing, validating，performance evaluation and improving advanced driver assistance systems and automated driving technologies; and
- other recipients, where disclosure is required by law.
The transfer or disclosure of personal data is based, where applicable, on Article 6(1)(f) GDPR.
7. Data Sharing and Transfers
7.1 Data Sharing within the EU/EEA
To support the development, testing, validation and improvement of ADAS, we may share certain masked or pseudonymized personal data with carefully selected cooperation partners located within the EU or EEA, including partners involved in the joint development of ADAS technologies.
Cooperation partners receiving data under this section act as independent controllers within the meaning of the GDPR. They are responsible for their own processing activities and must comply with their own obligations under applicable data protection laws.
Recipients are contractually required to process the data only for specified purposes, implement appropriate technical and organizational security measures, and refrain from attempting to identify individuals or reverse any masking or de-identification measures applied to the data.
7.2 Data Transfer outside the EU/EEA
We, the controller, are established in China, a country outside the EEA for which the European Commission has not adopted an adequacy decision. In connection with the road-testing activities described in this Privacy Notice, masked or pseudonymized personal data may be transferred by our processors in the EEA to us in China, where such transfer is necessary for the development, testing, validation and improvement of advanced driver assistance systems.
These transfers are carried out in accordance with Articles 44 et seq. GDPR. In particular, the applicable EU Standard Contractual Clauses have been entered into between the relevant data exporter in the EEA and us as the data importer in China. Where necessary, supplementary technical and organisational measures are also implemented to ensure an appropriate level of protection for the transferred personal data.
8. Storage duration
During ADAS road testing, raw video and image data are processed and masked in real time within the vehicle and are not retained in their original form. Only the resulting masked or pseudonymized data are stored on the vehicle’s hard drives. Once these data have been successfully uploaded to the designated cloud platform, they are deleted from the hard drives without undue delay and, in any event, within one week of the upload.
The masked or pseudonymized data are stored on the cloud platform for no longer than six months before being deleted. They are securely transferred to us in China for the development, testing, validation and improvement of ADAS algorithms. The transferred data are retained in China for no longer than two years and are deleted once they are no longer required for these purposes. The extended retention period in China reflects the long development and iteration cycles of ADAS algorithms, the need to maintain historical datasets for safety regression testing, the investigation of rare edge cases and system anomalies, long-term system stability validation, and compliance with potential safety and regulatory audit requirements.
9. Automated decision-making
Automated decision-making within the meaning of Art. 22 GDPR, which has a legal effect on you, does not take place.
10. Your rights as data subject
As a data subject, you have certain rights under the GDPR (Articles 15–22). However, please note that in this case we are not in a position to identify the data subject, and for the purpose of data processing we do not require the identification of a data subject. Therefore, according to the Art. 11 p. 2 GDPR, if you want to exercise your rights as a data subject, please provide us with more additional information to help us fulfill your request. The additional information needed is the date, time, and location where you encountered our test vehicle, as well as your clothing at the time, or any other information that would help us identify you personally.
Right to withdraw consent:
Since the processing of your personal data described in this Privacy Notice is based on our legitimate interest pursuant to Article 6(1)(f) GDPR and not on your consent, there is no right to withdraw consent under Article 7 GDPR. However, you have the right to object to the processing on grounds relating to your particular situation, as described under "Right to object" below.
Right of access:
As the data subject, you have a right to access under the conditions set forth in Art. 15 GDPR.
This primarily means that you are entitled to obtain confirmation from us as to whether we process your personal data. If this is the case, you are also entitled to information about these personal data and the information listed in Art. 15 p.1 GDPR. This includes, for example, information about the purpose of processing, the categories of the processed personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed (Art. 15 p.1 lit. a, b and c GDPR).
Right to rectification of inaccurate data:
As the data subject, you have a right to rectification under the conditions set forth in Art. 16 GDPR.
Since video and image recordings are a factual representation of reality at a specific moment, they are by nature "accurate." As we do not process these recordings to create a profile or a biography, rectification typically does not apply to the visual content itself.
Right to erasure:
As the data subject, you have the right to erasure (“right to be forgotten”) under the conditions set forth in Art. 17 GDPR.
This means that you have the fundamental right to obtain from us the erasure of the personal data concerning you without undue delay and that we have the obligation to erase personal data without undue delay where one of the grounds listed in Art. 17 p. 1 GDPR applies. This can be the case, for example, if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
By way of exception, the right to erasure (“right to be forgotten”) shall not apply to the extent that processing is necessary on the grounds listed in Art. 17 p. 3 of the GDPR.
Right to restriction of processing:
As the data subject, you have a right to restriction of processing under the conditions set forth in Art. 18 GDPR.
This means that you are entitled to obtain from us the restriction of processing where one of the conditions listed in Art. 18 p.1 GDPR applies.
Right to object:
As the data subject, you have a right to object provided the conditions set forth in Art. 21 GDPR apply.
As the data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art 6 p.1 lit. e or f GDPR.
Right to complain to a supervisory authority:
As the data subject, you have a right to lodge a complaint with a supervisory authority on the grounds set forth in Art. 77 GDPR.
If you as the data subject believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.
11. Changes to this notice
Our test vehicles used in ADAS road tests display clearly visible markings, including a QR code and/or a shortened URL linking to this Privacy Notice, so that pedestrians and other road users who may come into contact with our test vehicles can readily access information about the processing of their personal data.
We may update this notice from time to time. The version and date at the foot of the page indicate when the notice was last changed. Material changes will be highlighted on the vehicle sticker and QR‑code landing page for a reasonable period before they take effect.
_____________________________
Version: 2.0
Status: September, 2026