Privacy Notice for Autonomous Driving Road Tests

The protection of personal data is our top priority and is integrated into all our business processes. We treat the protection of your personal data seriously and strive to ensure that you feel secure and comfortable during our autonomous driving road tests.

The autonomous driving road test means that a test vehicle equipped with autonomous driving systems drives on public roads, collects and stores road video, image and sensor data from the surroundings of the test vehicle. In accordance with the provisions of Articles 13, 14 and 21 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of your personal data collected from autonomous driving road tests of WeRide Mobility, S.L. and your rights in this regard. To ensure that you are fully informed about the processing of your personal data, please take note of the following information:

1. Name and contact data of the Controller

WeRide Mobility, S.L. (Spain)

Address: AVENIDA DOCTOR ARCE 14, 28002, MADRID

E-Mail: privacy@weride.ai

Website: www.weride.ai

2. Purpose of processing

We collect video, image and sensor data during autonomous driving road tests to develop, test, validate and improve the algorithms and accuracy of the autonomous driving systems. Principally, the video and image data collected from our road tests are processed to compare whether the autonomous driving systems correctly recognize road Information, such as traffic signs, and whether there are vehicles driving or pedestrians passing next to or in front of the test vehicle. In addition, we do not further process the video and image data collected to identify the data subjects.

3. Personal data processed

The data collected by the test vehicle during autonomous driving road tests may involve the following categories of personal data:

• Facial images and behavioral patterns of pedestrians and other road users within the perception range of the vehicle's external cameras;

• License plate numbers and distinctive characteristics of vehicles in the vicinity;

• The geographic route travelled by the vehicle;

• 3D point-cloud data of the surrounding environment captured by LiDAR sensors;

• Short acoustic snapshots are used only for road-event detection.

It should be noted that there may be other types and categories of personal data that are inevitably collected during the autonomous driving road test. However, please note that we have no intention, nor the technical capability within our system, to identify specific natural persons. Our systems are not equipped with facial recognition or identity tracking functions. The vehicle's sensors are designed to perceive and model the driving environment for the safe operation of the autonomous driving system, not to track or identify individuals.

In accordance with the principle of Privacy by Design, we employ state-of-the-art, industry-leading in-vehicle masking technology. Raw data collected during road testing is masked automatically and in real time within the vehicle before being stored. Consequently, only data that has undergone the masking process is retained and subsequently used for the training, validation and further development of our autonomous driving algorithms. While these measures significantly reduce the likelihood of identifying individuals, residual identifiable elements may remain in limited circumstances. We continuously review and enhance our masking technology in line with the evolving state of the art to ensure an appropriately high level of data protection.

4. Legal basis of the processing

The legal basis in this case is the legitimate interest as defined in Art. 6 p.1 lit f GDPR. Prior to the processing, we carried out a balancing test to ensure that our legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subjects.

5. Source of data

The data are collected by cameras, LiDAR sensors and other sensors integrated in the test vehicles.

6. Data recipients or categories of recipients

We only transfer masked or pseudonymized data to the following categories of recipients:

• WeRide group companies (in European Union (EU), European Economic Area (EEA), China), on a strict need-to-know basis, for R&D purposes;

• Our processors, including the entities conducting road tests, responsible for uploading the data, or providers of cloud storage and data transmission services;

• Our cooperation partner in EU and/or EEA and/or China, which receives masked or pseudonymized data for the purposes of developing, testing, validating, evaluating performance and improving autonomous driving technologies; and

• Other recipients, where disclosure is required by law.

The transfer or disclosure of personal data is based, where applicable, on Article 6(1)(f) GDPR.

7. Data Transfer outside the EU/EEA

In connection with the road-testing activities described in this Privacy Notice, masked or pseudonymized personal data may be transferred by our processors in the EEA to us in China, where such transfer is necessary for the development, testing, validation and improvement of autonomous driving systems.

These transfers are carried out in accordance with Articles 44 et seq. GDPR. In particular, the applicable EU Standard Contractual Clauses have been entered into between the relevant data exporter in the EEA and us as the data importer in China. Where necessary, supplementary technical and organisational measures are also implemented to ensure an appropriate level of protection for the transferred personal data.

8. Storage duration

During autonomous driving road testing, raw video, image and sensor data are processed and masked in real time within the vehicle and are not retained in their original form. Only the resulting masked or pseudonymized data are stored on the vehicle's hard drives. Once these data have been successfully uploaded to the designated cloud platform, they are deleted from the hard drives without undue delay and, in any event, within one week of the upload.

The masked or pseudonymized data are stored on the cloud platform for no longer than two years before being deleted. They are securely transferred to us in China for the development, testing, validation and improvement of autonomous driving algorithms. The transferred data are retained in China for no longer than ten years and are deleted once they are no longer required for these purposes. The extended retention period in China reflects the long development and iteration cycles of autonomous driving algorithms, the need to maintain historical datasets for safety regression testing, the investigation of rare edge cases and system anomalies, long-term system stability validation, and compliance with potential safety and regulatory audit requirements.

9. Automated decision-making

Automated decision-making within the meaning of Art. 22 GDPR, which has a legal effect on you, does not take place.

10. Your rights as data subject

As a data subject, you have certain rights under the GDPR (Articles 15–22). However, please note that in this case we are not in a position to identify the data subject, and for the purpose of data processing we do not require the identification of a data subject. Therefore, according to the Art. 11 p. 2 GDPR, if you want to exercise your rights as a data subject, please provide us with more additional information to help us fulfill your request. The additional information needed is the date, time, and location where you encountered our test vehicle, as well as your clothing or license plate information at the time, or any other information that would help us identify you personally.

Right to withdraw consent: Since the processing of your personal data described in this Privacy Notice is based on our legitimate interest pursuant to Article 6(1)(f) GDPR and not on your consent, there is no right to withdraw consent under Article 7 GDPR. However, you have the right to object to the processing on grounds relating to your particular situation, as described under "Right to object" below.

Right of access: As the data subject, you have a right to access under the conditions set forth in Art. 15 GDPR. This primarily means that you are entitled to obtain confirmation from us as to whether we process your personal data. If this is the case, you are also entitled to information about these personal data and the information listed in Art. 15 p.1 GDPR. This includes, for example, information about the purpose of processing, the categories of the processed personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed (Art. 15 p.1 lit. a, b and c GDPR).

Right to rectification of inaccurate data: As the data subject, you have a right to rectification under the conditions set forth in Art. 16 GDPR. Since video and image recordings are a factual representation of reality at a specific moment, they are by nature "accurate." As we do not process these recordings to create a profile or a biography, rectification typically does not apply to the visual content itself.

Right to erasure: As the data subject, you have the right to erasure ("right to be forgotten") under the conditions set forth in Art. 17 GDPR. This means that you have the fundamental right to obtain from us the erasure of the personal data concerning you without undue delay and that we have the obligation to erase personal data without undue delay where one of the grounds listed in Art. 17 p. 1 GDPR applies. This can be the case, for example, if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed. By way of exception, the right to erasure ("right to be forgotten") shall not apply to the extent that processing is necessary on the grounds listed in Art. 17 p. 3 of the GDPR.

Right to restriction of processing: As the data subject, you have a right to restriction of processing under the conditions set forth in Art. 18 GDPR. This means that you are entitled to obtain from us the restriction of processing where one of the conditions listed in Art. 18 p.1 GDPR applies.

Right to object: As the data subject, you have a right to object provided the conditions set forth in Art. 21 GDPR apply. As the data subject, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art 6 p.1 lit. e or f GDPR.

Right to complain to a supervisory authority: As the data subject, you have a right to lodge a complaint with a supervisory authority on the grounds set forth in Art. 77 GDPR. If you as the data subject believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

To assert your above rights, please send your request to the E-Mail address given under "2. Contact data of the Data Protection Officer (DPO)".

11. Changes to this notice

Our test vehicles used in autonomous driving road tests display clearly visible markings, including a QR code and/or a shortened URL linking to this Privacy Notice, so that pedestrians and other road users who may come into contact with our test vehicles can readily access information about the processing of their personal data.

We may update this notice from time to time. The version and date at the foot of the page indicate when the notice was last changed. Material changes will be highlighted on the vehicle sticker and QR-code landing page for a reasonable period before they take effect.

—————————

Version: 1.0

Status: September, 2026