INFORMATION NOTICE

Information concerning the processing of video, image, and audio data collected during testing procedures conducted by Automated Driving Alliance between Robert Bosch GmbH and CARIAD SE (“Cooperation Partners“) and their Indian partners/affiliates (“Responsible Parties“) for research, development, and testing of driver assistance systems, automated driving, driving functions, and other services. Our vehicles are equipped with camera systems offering various viewing angles, focal lengths, and sensor technologies; in some cases, external microphones and other sensor systems are also installed and information is collected during their movement in public traffic areas and (insofar as lawful) on private factory, testing, and other facilities.

Data privacy notice on the collection of video, image and audio data as part of the project “Automated Driving Alliance”

The protection of personal data has the highest priority for Responsible Parties and is taken into account in all our business processes.

1. Who is the responsible controller for the processing of the data and who can be contacted about data protection?

Within the scope of the “Automated Driving Alliance” project, the Cooperation Partners are jointly responsible for the data processing activities described below.

For these specific data processing activities, the legally required joint controllership agreement has been concluded between the Cooperation Partners.

For more information on the joint controllership, please see Section 8.

Responsible Parties

Joint Controllers:

Robert Bosch GmbH
Robert-Bosch-Platz 1
70839 Gerlingen- Schillerhöhe
Germany

and

CARIAD SE
Major-Hirst-Straße 7
38442 Wolfsburg
Germany

If you would like to contact us, please use the following contact options:

E-Mail: privacy@automated-driving-alliance.com

To exercise your data subject rights and to report data protection incidents, you can contact both Cooperation Partners’ Data Protection Departments:

Data Protection Officer - Robert Bosch GmbH:

Abteilung Informationssicherheit und Datenschutz Bosch-Gruppe (C/ISP)
Postfach 300220
70442 Stuttgart
Germany

E-Mail: DPO@bosch.com

Data Protection Officer - CARIAD SE:

Major-Hirst-Straße 7
38442 Wolfsburg
Germany

E-Mail: privacy@cariad.technology

The Cooperation Partners act with the help of local affiliates/partners such as :

Concerned Indian affiliates (Processors):

Bosch Automotive Electronics India Private Limited,
Building No. 703, C/o Bosch Limited,
Electronic City Post Office, Naganathapura, Bangalore,
Karnataka, India – 560100

Bosch Limited,
PO Box No 3000, Adugodi, Hosur Road,
Bangalore, Karnataka, India - 560030

Bosch Global Software Technologies Private Limited,
No. 123, Industrial Layout, Hosur Road,
Koramangala, Bangalore, Karnataka, India - 560095

2. Scope of application, and addressees of this data privacy notice, purpose and legal basis

This data privacy notice applies to the collection and processing of personal data within research and development projects related to driving assistance systems, automated and autonomous driving, driving functions and other services.

Potential addressees of this data privacy notice and data subjects to the data processing described herein, are all road users which are in the vicinity of one of the marked test vehicles during their operation.

Research, development and testing of such systems require their use in test vehicles under real environmental and traffic conditions - also in public traffic areas - including the acquisition, processing and storage of video, image and audio recordings during and after these operations.

These data sets are used to research, develop and test technical systems for the perception and classification of road users, vehicles, infrastructure and other objects in the context of traffic and environmental situations.

Persons, vehicles, other objects and audio information are only analyzed, classified and processed as "objects" in the context of traffic and environmental situations, e.g. as

• pedestrian on the right-hand side of the road
• car at an intersection
• siren signal behind the vehicle

Typically, it is not possible to identify persons by name or otherwise personally or to assign detected vehicles or objects to specific persons in this way from the video, image and audio material, and the detection mostly only takes place very briefly as the vehicle passes by.

However, identifiability and identification of natural persons cannot be completely precluded in special situations (e.g. traffic lights, traffic jams, pedestrian crossings), so that the Cooperation Partners consider the processed data to be personal data.

The primary legal grounds of the processing are the pursuit of legitimate interests by the joint controllersto conduct of research, development, and testing procedures for driving assistance systems, automated driving, driving functions, and other services which are crucial for enhancing road safety and transportation efficiency. Where required by applicable local law, we will also rely on other legal bases such as explicit consent, contractual necessity, or compliance with a legal obligation.

The conflicting interests, fundamental rights and freedoms of the data subjects do not outweigh this, as identification by name or other personal identification of individual data subjects is neither necessary nor envisaged. In addition, technical and organizational measures are taken to ensure that the data collected is processed in accordance with data protection requirements.

3. Which types of personal data are processed by the Cooperation Partners?

Within the scope of the above-mentioned research and development purposes, marked test vehicles move in public traffic areas and - insofar as permitted by other laws - on private factory, test and other premises.

The vehicles are equipped with camera systems with different angles of coverage, focal lengths and sensor technologies, and in some cases with external microphones and other sensor systems. These systems collect, process and store video, image and audio data from the vehicle environment for the purposes described in Section 2 of this privacy notice.

This data may - depending on the individual use-case - also include the following personal information:

• photos and video sequences showing humans (including facial- and other features) and surroundings of road users in the vicinity of the test vehicles.
• license plates, other characteristics and surroundings of vehicles and other objects in the vicinity of the test vehicles.
• acoustic information from the vicinity of the test vehicles
• additional data from other sensor systems (such as radar, LIDAR) as well as GPS position and time stamp

4. Transfer of personal data to other recipients

In addition to the processors mentioned in Section 1, the data is only shared with other companies affiliated with the BOSCH or CARIAD group, development partners, data processors or other third parties within purposes described above.

Data will only be disclosed if it is legally permissible due to legal provisions and / or official or judicial orders or if the third party has a legitimate interest.

Categories of recipients to whom data may be disclosed within the scope of the purposes described above are in particular:

• Internal and external partners as well as development partners of the persons responsible within the framework of the research and development processes.
• Suppliers within the scope of the research and development processes.
• Other service providers (in particular IT service providers as well as service providers for data processing / data evaluation).

If data is transferred to recipients in third countries as part of the research, development and testing processes or downstream processing, this will only be done if an adequacy decision has been taken, on the basis of suitable guarantees or if permitted under other applicable law.

5. Automated decisionmaking

There is no automated decision making, nor a “profiling” taking place.

6. Retention of personal data

The video and image data are processed and stored for as long as is necessary for the research, development and testing processes mentioned. If, on a case-by-case basis, there is a further legal basis or a further legitimate interest for continued storage and processing (for example, for the proper documentation of the aforementioned processes, due to legal retention obligations or other legal requirements), the data will be stored for a correspondingly longer period.

7. Data subjects’ rights towards the joint controllers

Data subjects have the following rights, that can be exercised against any of the joint controllers.

Additional information on the exercise of data subjects' rights:

This is a processing activity for which the identification of the data subject is not necessary. No additional identification features of data subjects are processed beyond the video, image and audio data collected.

Exercising and fulfilling data subject rights will therefore - depending on the individual case - often require further information from the data subject, in particular information on the LOCATION and TIME at which he or she may have been affected by the joint processing (i.e. information on when and where you were specifically in the vicinity of one of the trial vehicles). This additional information may be necessary, in order to determine whether a specific person is affected by the joint processing at all and to actually be able to fulfil the rights mentioned below, such as access, erasure, etc.

• Right of access: Data subjects have the right to request information on whether personal data in question are being processed. If data are processed, data subjects have the right to be informed about these data as well as about the modalities of the processing.
• Right to rectify inaccurate data: Data subjects have the right to request the correction of personal data in question.
• Right to erasure: Data subjects have the right to request the erasure of personal data concerning them.
• Right to restriction of processing: Data subjects have the right to request restriction of the processing of their data.
• Right to object: Data subjects have the right to object to the processing of their personal data.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a data protection authority. To do so, you can contact the data protection authority responsible for your place of residence or federal state or the data protection authority responsible for each of the Cooperation Partners.

Special remarks on the restrictability of data subjects' rights:

We would also like to point out that, in the context of the present processing, your rights (right of access, right to rectification, right to erasure, right to restriction of processing and right to object) may be subject to special additional restrictions. These special restrictions apply if the exercise and fulfilment of these rights in the specific case would probably make the realisation of research purposes impossible or seriously impair them and the restriction is therefore necessary for the fulfilment of these research purposes.

Contact persons are listed in Section 1.

8. Information on joint controllership

What is the reason for the joint controllership of the Cooperation Partners?

Robert Bosch GmbH and CARIAD SE work closely together in function and vehicle development as part of the “Automated Driving Alliance” project. This also applies to the processing of personal data, insofar as this has been collected by corresponding development vehicles. The Cooperation Partners have jointly defined the processing phases of this data in the individual process stages. They are therefore jointly responsible for the protection of your personal data within the process steps described below.

For which process stages is there joint controllership?

The joint controllership of the Cooperation Partners includes the collection, storage and further processing of video, image and audio data. The Cooperation Partners collect data on test vehicles and transmit it to a common IT system where the data is stored and can be accessed or processed by both Cooperation Partners for research, (further) development and testing purposes.

Outside the project, the Cooperation Partners can process data under separate responsibility, provided this is legally permissible.

What have the parties agreed?

As part of their joint controllership, the Cooperation Partners have also agreed that the collection of data also fulfils the information obligations with regard to joint controllership.

What does this mean for data subjects?

Data protection rights can be asserted both with Robert Bosch GmbH and with CARIAD SE through the contact data provided in Section 1. The Cooperation Partners will inform each other without delay about requests from data subjects. They will provide each other with all information necessary to respond to such requests in a timely manner.

9. Amendments of our privacy policy information 

We reserve the right to amend any measures under our security and privacy policies. When we do so, we will also modify our data privacy notice to reflect the changes. Please ensure that you are viewing the most recently revised version of our data privacy notice. 

Last revised on: August 14th 2026