Privacy Notice for Autonomous Driving Road Tests and Operations in the Kingdom of Saudi Arabia

The protection of personal data is our top priority and is integrated into all our business processes. We treat the protection of your personal data seriously and strive to ensure that you feel secure and comfortable during our autonomous driving road tests and operations.

For purposes of this Privacy Notice, autonomous driving road tests and operations mean that vehicles equipped with autonomous driving systems drive or operate on public roads in Saudi Arabia for road testing, validation, demonstration and/or autonomous driving services, and collect and store road video, image and sensor data from the surroundings of the vehicles. In accordance with the Personal Data Protection Law of the Kingdom of Saudi Arabia (PDPL), its Implementing Regulations and other applicable laws and regulations in the Kingdom of Saudi Arabia, we hereby inform you about the processing of personal data collected from our autonomous driving road tests and operations and your rights in this regard. To ensure that you are fully informed about the processing of your personal data, please take note of the following information:

1. Name and contact data of the Controller

Guangzhou WeRide Technology Co., Ltd.

Units 01, 02, 03 and 04, 16th Floor, Building A, KWG Cosmo Plaza, No. 68 Luoxuan Avenue, Guangzhou International Bio Island, Huangpu District, Guangzhou, China.

E-Mail: privacy@weride.ai

Website: www.weride.ai.

2. Purpose of processing

We collect video, image and sensor data during autonomous driving road tests and operations to develop, test, validate and improve the algorithms and accuracy of the autonomous driving systems and to ensure the safe, stable and reliable operation of our autonomous vehicles. Principally, the video and image data collected are processed to compare whether the autonomous driving systems correctly recognize road information, such as traffic signs, and whether there are vehicles driving or pedestrians passing next to or in front of the vehicle, and to support safe vehicle operation, troubleshooting and incident analysis. In addition, we do not further process the video and image data collected to identify the data subjects.

Important note if you are a passenger

If you have accessed this Privacy Notice in connection with a ride requested through a mobility service or operating platform, the applicable privacy notice of that platform shall explain how the platform processes your personal information. The platform shares with WeRide only limited trip information necessary for WeRide to provide your ride, such as your pickup and drop-off addresses. WeRide does not otherwise have access to personal information collected or processed by the platform in connection with your ride, including any in-cabin audio and video recordings.

This Privacy Notice covers only the external, road-facing sensor data that WeRide collects from outside the vehicle.

3. Personal data processed

The data collected by the vehicle during autonomous driving road tests and operations may involve the following categories of personal data:

• Facial images movements of pedestrians and other road users within the perception range of the vehicle's external cameras;
• License plate numbers and distinctive characteristics of vehicles in the vicinity;
• The geographic route travelled by the vehicle;
• 3D point-cloud data of the surrounding environment captured by LiDAR sensors;
• Short acoustic snapshots are used only for road-event detection.

It should be noted that there may be other types and categories of personal data that are inevitably collected during autonomous driving road tests and operations. However, please note that we have no intention, nor the technical capability within our system, to identify specific natural persons. Our systems are not equipped with facial recognition or identity tracking functions. The vehicle's sensors are designed to perceive and model the driving environment for the safe operation of the autonomous driving system, not to track or identify individuals.

On-board de-identification: In accordance with the principle of Privacy by Design, we employ state-of-the-art, industry-leading in-vehicle masking technology. Faces and license plates detected in the raw images and video collected during road testing are automatically and irreversibly masked in real time within the vehicle before the data is stored or transmitted outside the vehicle. Consequently, the data retained and subsequently used for the training, validation and further development of our autonomous driving algorithms is subject to automated and irreversible masking and de-identification measures designed to reduce the identifiability of individuals. While these measures significantly reduce the likelihood of identifying individuals, complete anonymization may not always be technically possible at present. As a result, residual identifiable elements, such as facial images or vehicle license plate information that have not been detected by the automated masking process, may remain present in limited circumstances. We do not use the collected data to identify individuals and continuously review and enhance our masking technology in line with the evolving state of the art to ensure an appropriately high level of data protection.

4. Legal basis of the processing

We process personal data in accordance with the PDPL and its Implementing Regulations. To the extent permitted by applicable Saudi Arabian law, the processing described in this Privacy Notice is based on our legitimate interests in safely conducting autonomous driving road tests and operations, troubleshooting vehicle operation, and testing and improving autonomous driving technologies, provided that such interests do not prejudice the rights and interests of data subjects. We conduct the applicable legitimate interest assessment as required. Where another legal basis is required by applicable law for a specific processing activity, we will rely on such legal basis and comply with the applicable requirements.

5. Source of data

The data are collected by external cameras and microphones, LiDAR sensors and other sensors integrated in the vehicles.

6. Data recipients or categories of recipients

Access to the data is restricted on a strict need-to-know basis. Under the current arrangement, the data are accessible only to authorized personnel located in Saudi Arabia, including local engineers, and to service providers supporting local cloud storage and related technical services, where necessary and subject to appropriate contractual and security safeguards. Data may also be disclosed to competent public authorities where required by applicable law.

No personal data collected under the current road-test and operational arrangements are intended to be accessed from, transferred to, or otherwise made available outside the Kingdom of Saudi Arabia.

7. Data location

All data collected in connection with the road-testing and operational activities described in this Privacy Notice are stored and processed within the Kingdom of Saudi Arabia.

If the data processing arrangement changes in the future and any transfer of personal data outside the Kingdom of Saudi Arabia is contemplated, we will assess and implement the applicable requirements under Saudi Arabian law before such transfer takes place, and update this Privacy Notice as appropriate.

8. Storage duration

During autonomous driving road testing and operations, raw video and image data are subject to real-time masking of detected faces and license plates within the vehicle. Under our general retention requirements applicable to this project:

• On-board data are retained for no longer than 30 days; and

• Masked/de-identified data stored on the cloud platform in Saudi Arabia are retained for no longer than three years.

We will not retain personal data for longer than necessary for the purposes described in this Privacy Notice and will delete or otherwise dispose of the data securely when the applicable retention period expires or the data are no longer required, subject to applicable legal or regulatory retention requirements.

9. Automated decision-making

We do not use the personal data collected through the autonomous driving road tests and operations to make automated decisions about individuals that produce legal effects or similarly significant effects on them.

10. Your rights as data subject

Subject to the conditions and exceptions under the PDPL and its Implementing Regulations, you may have rights in relation to your personal data, including the right to be informed about the processing of your personal data, the right to access and obtain a copy of your personal data, the right to request correction, completion or updating of your personal data, and the right to request destruction of your personal data where applicable.

Please note that, in this case, we generally do not seek to identify data subjects and the road-test and operational data are not collected by name or other direct identifier. Therefore, if you wish to exercise your rights, we may need additional information to help locate data relating to you, such as the date, approximate time and location where you encountered our vehicle, your clothing at the time, or other information that would reasonably assist us in identifying the relevant recording. We will use such additional information only for the purpose of handling your request.

To exercise your rights or raise a question regarding this Privacy Notice, please contact us at privacy@weride.ai.

11. Changes to this notice

Our vehicles used in autonomous driving road tests and operations display clearly visible markings so that pedestrians and other road users who may come into contact with our vehicles can readily access information about the processing of their personal data.

We may update this notice from time to time. The version and date at the foot of the page indicate when the notice was last changed. Material changes will be communicated through the vehicle sticker, QR-code landing page or other appropriate means for a reasonable period before they take effect, where appropriate.

Version: 1.0

Status: November 2026