天瞳欧洲路测数据采集隐私声明
EUROPE ROAD TEST DATA COLLECTION PRIVACY NOTICE
本隐私声明说明北京天瞳威势电子科技有限公司（“天瞳”、“我们”或“数据控制者”）在欧洲开展车辆道路测试、智能驾驶模型研发、测试和验证过程中，如何收集、使用、存储、匿名化及在适用情况下传输与道路使用者有关的个人数据。
This Privacy Notice explains how Beijing Tiantong Weishi Electronic Technology Co., Ltd. (“Calmcar”, “we”, “us” or the “Controller”) collects, uses, stores, anonymises and, where applicable, transfers personal data relating to road users in connection with vehicle road testing and intelligent-driving model research, development, testing and validation activities in Europe.
测试车辆可能通过车载摄像机、激光雷达、GPS、CAN数据读取设备及其他车载传感器记录道路环境。因此，行人、骑行者、驾驶员、乘员、车辆及其他道路参与者的信息可能在测试过程中被记录。
Test vehicles may record the road environment using onboard cameras, LiDAR, GPS, CAN data-reading devices and other onboard sensors. As a result, information relating to pedestrians, cyclists, drivers, passengers, vehicles and other road users may be recorded during testing.
本隐私声明旨在根据 GDPR 第12至14条（视具体数据获取方式而定）及其他适用数据保护法律提供透明信息。对于英国、瑞士等非欧盟/欧洲经济区测试地点，当地数据保护法律可能同时适用。
This Privacy Notice is intended to provide transparent information in accordance with Articles 12 to 14 GDPR, as applicable to the manner in which the data are obtained, and other applicable data-protection laws. For testing locations outside the EU/EEA, including the United Kingdom and Switzerland, applicable local data-protection laws may also apply.
本项目的数据控制者为：
The Controller for the processing described in this Privacy Notice is:
| 公司名称 / Company Name | Beijing Tiantong Weishi Electronic Technology Co., Ltd. / 北京天瞳威势电子科技有限公司 |
| 注册地址 / Registered Address | 北京市北京经济技术开发区宏达北路10号1号楼7层701-7A室 Room 701-7A, 7th Floor, Building 1, No. 10 Hongda North Road, Beijing Economic and Technological Development Zone, Beijing, the PRC |
| 注册号 / Registration No. | 91110108MA01AL5J7F |
| 隐私邮箱 / Privacy Email | [contact@calmcar.com] |
| 一般联系方式 / General Contact | contact@calmcar.com |
天瞳决定本项目个人数据处理的目的和主要方式，并承担其作为数据控制者的适用法律责任。
Calmcar determines the purposes and essential means of the relevant processing activities and remains responsible for its applicable obligations as Controller.
在 GDPR 第27条适用的情况下，天瞳已书面指定以下欧盟代表：
Where Article 27 GDPR applies, Calmcar has designated the following representative in the European Union in writing:
| 姓名 / Full Name | Ying Chen |
| 欧盟地址 / EU Address | Heyenbaumstrasse 170A,47802 Krefeld |
| 成员国 / Member State | Federal Republic of Germany / 德意志联邦共和国 |
| 电子邮箱 / Email | wendychen1104@outlook.de |
| 电话 / Telephone | +49 17655289674 |
数据主体和监管机构可就本声明所述处理活动及 GDPR 权利，通过上述联系方式联系欧盟代表。
Data subjects and supervisory authorities may contact the EU Representative using the details above in relation to the processing described in this Notice and the exercise of GDPR rights.
如天瞳已指定数据保护官（DPO），请在此填写其联系方式；如未指定，可仅填写专用 Privacy Contact。
If Calmcar has appointed a Data Protection Officer (“DPO”), insert the relevant contact details here. If no DPO has been appointed, a dedicated Privacy Contact may be provided instead.
DPO / Privacy Contact: [ Xiaoyao ZHUGE] Email: [xiaoyao.zhuge@calmcar.com]
根据当前项目需求，欧洲道路测试地点可能包括以下国家。实际开展测试的国家和城市应以项目执行计划为准：
According to the current project requirements, road testing may take place in the following European countries. Actual countries and cities should be confirmed against the operational test plan:
| 测试国家 / Testing Countries / 西班牙、法国、英国、意大利、德国、爱尔兰、荷兰、比利时、奥地利、瑞士、葡萄牙、卢森堡、芬兰、挪威、瑞典、丹麦、波兰、捷克、斯洛伐克、立陶宛、爱沙尼亚、拉脱维亚、保加利亚、罗马尼亚、匈牙利、希腊、克罗地亚、斯洛文尼亚、马耳他。 Spain, France, the United Kingdom, Italy, Germany, Ireland, the Netherlands, Belgium, Austria, Switzerland, Portugal, Luxembourg, Finland, Norway, Sweden, Denmark, Poland, Czechia, Slovakia, Lithuania, Estonia, Latvia, Bulgaria, Romania, Hungary, Greece, Croatia, Slovenia and Malta. |
根据当前项目需求，测试车辆可能收集以下数据类别：
Under the current project requirements, test vehicles may collect the following categories of data:
视频及图像数据，包括道路环境影像以及可能出现的行人面部信息。
Video and image data, including road-environment imagery and facial images of pedestrians that may appear in the recorded scene.
车辆 CAN 数据，包括车辆运行期间采集的车身和底盘相关信息。
Vehicle CAN data, including vehicle body and chassis information collected during vehicle operation.
驾驶员日志信息。
Driver log information.
GPS 位置数据及地理坐标数据。
GPS location data and geographic coordinate data.
点云数据及激光雷达（LiDAR）数据。
Point-cloud data and LiDAR data.
与数据采集设备、工控机、录制软件和测试系统相关的必要技术日志。
Necessary technical logs relating to data-collection devices, industrial control computers, recording software and test systems.
道路环境视频中可能附带记录个人面部图像。除非另行明确说明并具备适当法律依据，天瞳不会以唯一识别自然人为目的对该等面部图像进行生物识别处理。仅仅记录到人脸图像，并不当然意味着该数据属于用于唯一识别个人的生物识别数据。
Road-environment video may incidentally capture facial images. Unless expressly stated otherwise and supported by an appropriate legal basis, Calmcar does not process such facial images for the purpose of uniquely identifying natural persons through biometric identification. The mere capture of a facial image does not, by itself, mean that the data are used as biometric data for unique identification.
视频数据通过车载摄像机及屏幕录制软件记录至工业控制计算机，随后从工控机复制至硬盘等数据存储设备，再按照项目流程上传至云端进行匿名化处理。
Video data are recorded to an industrial control computer using onboard cameras and screen-recording software, copied from the industrial control computer to hard drives or other storage devices, and then uploaded to the cloud in accordance with the project workflow for anonymisation.
车辆 CAN 数据通过 CAN 数据读取设备采集，并在车辆运行期间获取相关车身和底盘信息。
Vehicle CAN data are collected using CAN data-reading devices, including relevant vehicle body and chassis information during vehicle operation.
GPS 数据通过相关设备导出为二进制数据文件，并可与测试时间、路线及道路环境数据关联。
GPS data are exported through the relevant devices as binary data files and may be associated with test time, route and road-environment data.
点云及激光雷达数据通过激光雷达和录制软件记录至工业控制计算机，并按照项目流程复制到硬盘等存储设备。
Point-cloud and LiDAR data are recorded to the industrial control computer using LiDAR and recording software and are copied to hard drives or other storage devices in accordance with the project workflow.
用于智能驾驶模型训练、测试和验证。
Training, testing and validating intelligent-driving models.
优化车辆自动驾驶及智能驾驶性能。
Optimising automated-driving and intelligent-driving performance.
验证车辆、传感器、软件和算法的功能、可靠性和安全性。
Validating the functionality, reliability and safety of vehicles, sensors, software and algorithms.
发现、分析和解决测试过程中出现的技术问题。
Identifying, analysing and resolving technical issues arising during testing.
改进道路环境感知、目标检测和相关算法性能。
Improving road-environment perception, object detection and related algorithm performance.
在 GDPR 适用的情况下，天瞳拟主要依据 GDPR 第6(1)(f)条的合法利益处理本声明所述个人数据。相关合法利益包括车辆及智能驾驶技术研发、模型训练和验证、产品性能优化以及车辆和道路交通技术安全性的改进。
Where the GDPR applies, Calmcar intends primarily to rely on Article 6(1)(f) GDPR (legitimate interests) for the processing described in this Notice. Relevant legitimate interests include vehicle and intelligent-driving technology research and development, model training and validation, product-performance optimisation, and improving the safety of vehicles and road-transport technologies.
在依赖合法利益之前，应完成并保留适当的合法利益评估（LIA），确认处理目的具有合法性、处理具有必要性，并对天瞳利益与受影响个人的权利和自由进行平衡。
Before relying on legitimate interests, an appropriate Legitimate Interests Assessment (“LIA”) should be completed and retained to confirm that the purpose is legitimate, the processing is necessary, and Calmcar’s interests are appropriately balanced against the rights and freedoms of affected individuals.
仅收集完成道路测试、模型训练、验证和安全改进所合理需要的数据。
Collect only data reasonably necessary for road testing, model training, validation and safety improvement.
对原始数据和存储设备实施访问权限控制。
Apply access controls to raw data and storage devices.
根据实际系统架构对数据存储和传输采取适当加密措施。
Use appropriate encryption for data at rest and in transit, based on the actual system architecture.
通过云端流程对数据进行匿名化，并根据技术可行性对人脸、车牌或其他识别信息进行模糊化、遮挡或其他去识别化处理。
Use cloud-based anonymisation processes and, where technically feasible, blur, mask or otherwise de-identify faces, licence plates and other identifying information.
记录必要的访问、复制、上传和下载操作，并限制未经授权的数据复制、传输和下载。
Maintain necessary records of access, copying, uploads and downloads and restrict unauthorised copying, transfer and downloading of data.
对参与项目的人员和处理者实施保密、数据保护及信息安全要求。
Apply confidentiality, data-protection and information-security requirements to project personnel and processors.
在实现上述目的所必要的范围内，个人数据可能由以下类别的接收方或服务提供商处理：
To the extent necessary for the purposes described above, personal data may be processed by the following categories of recipients or service providers:
天瞳及经授权参与项目的工作人员。
Calmcar and authorised personnel involved in the project.
欧洲道路测试和数据采集服务提供商，包括在其实际角色为处理者时的Tigroup Technology international GmbH。
European road-testing and data-collection service providers, including Tigroup Technology international GmbH where it acts as a Processor.
提供云端匿名化、IT、存储或技术支持的服务提供商Tigroup Technology international GmbH。
Cloud anonymisation, IT, storage and technical-support service providers Tigroup Technology international GmbH.
代表天瞳处理个人数据的处理者应根据书面数据处理协议、天瞳的书面指示及适用法律要求处理数据。
Processors acting on behalf of Calmcar must process personal data under a written data-processing agreement, Calmcar’s documented instructions and applicable data-protection law.
根据当前项目流程，采集的数据将上传至腾讯云进行匿名化处理，匿名化后的数据随后下载/传输至中国境内进行本地存储，并用于智能驾驶模型训练、测试、验证及相关研发活动。
Under the current project workflow, collected data are uploaded to the Tencent cloud for anonymisation. The anonymised data are then downloaded/transferred to China for local storage and for intelligent-driving model training, testing, validation and related research and development activities.
如果在任何阶段传输至中国或由中国境内远程访问的数据仍构成 GDPR 意义上的个人数据（例如匿名化尚未完成、匿名化不足以达到不可逆标准，或仍存在合理重新识别可能性），天瞳将根据 GDPR 第五章采取适用的国际数据传输机制和保障措施。
If, at any stage, data transferred to China or remotely accessed from China still constitute personal data under the GDPR (for example, because anonymisation has not yet been completed, is not sufficiently irreversible, or reasonable re-identification remains possible), Calmcar will implement an applicable international-transfer mechanism and safeguards in accordance with Chapter V GDPR.
在适用情况下签署欧盟委员会标准合同条款（SCCs）。
Execute the European Commission Standard Contractual Clauses (“SCCs”) where applicable.
在需要时开展 Transfer Impact Assessment（TIA）。
Carry out a Transfer Impact Assessment (“TIA”) where required.
根据评估结果采取必要的补充技术、合同或组织措施。
Implement necessary supplementary technical, contractual or organisational measures based on the assessment.
| 个人数据保存期 / Personal Data Retention Period 本项目中采集的原始道路图像、视频以及其他仍可识别或可关联到自然人的个人数据保存期限为 60 天。 Raw road images, video and other data that remain identifiable or linkable to a natural person are retained for 60 days. |
60天保存期限届满后，相关个人数据将被删除或进行不可逆匿名化处理，除非适用法律要求继续保存，或为建立、行使或抗辩法律请求而确有必要延长保存期限。
At the end of the 60-day retention period, the relevant personal data will be deleted or irreversibly anonymised, unless a longer period is required by applicable law or is necessary for the establishment, exercise or defence of legal claims.
经不可逆匿名化后，若任何自然人均无法被识别且无法被合理重新识别，该等数据不再构成 GDPR 意义上的个人数据，可根据研发、智能驾驶模型训练、测试和验证需求继续保存和使用。
Once data have been irreversibly anonymised so that no natural person can be identified or reasonably re-identified, those data no longer constitute personal data under the GDPR and may be retained and used for research, intelligent-driving model training, testing and validation purposes.
考虑到项目可能涉及大规模道路环境视频、行人面部图像、精确位置数据以及多国持续道路测试，天瞳将在 GDPR 第35条适用时开展并记录数据保护影响评估（DPIA），并根据评估结果实施适当的风险缓解措施。
Given that the project may involve large-scale road-environment video, pedestrian facial images, precise location data and ongoing road testing across multiple countries, Calmcar will carry out and document a Data Protection Impact Assessment (“DPIA”) where Article 35 GDPR applies and implement appropriate risk-mitigation measures based on the assessment.
道路测试数据可能用于智能驾驶算法和模型的训练、测试和验证。但是，除非另行明确告知，天瞳不会仅基于本声明所述道路测试数据，对道路上的行人、驾驶员、骑行者或其他道路使用者作出对其产生法律效果或类似重大影响的完全自动化个人决策。
Road-test data may be used for training, testing and validating intelligent-driving algorithms and models. However, unless expressly stated otherwise, Calmcar does not use the road-test data described in this Notice to make solely automated decisions about pedestrians, drivers, cyclists or other road users that produce legal effects or similarly significantly affect those individuals.
在 GDPR 适用且相关法定条件满足的情况下，您可能享有以下权利：
Where the GDPR applies and the relevant legal conditions are met, you may have the following rights:
访问权：确认我们是否处理与您有关的个人数据，并在适用情况下申请访问。
Right of access: to confirm whether we process personal data concerning you and, where applicable, request access.
更正权：要求更正不准确的个人数据。
Right to rectification: to request correction of inaccurate personal data.
删除权：在法定条件满足时要求删除您的个人数据。
Right to erasure: to request deletion of your personal data where the legal conditions are met.
限制处理权：在特定情况下要求限制处理。
Right to restriction: to request restriction of processing in certain circumstances.
反对权：对基于 GDPR 第6(1)(f)条合法利益进行的处理，基于与您具体情况有关的理由提出反对。
Right to object: to object, on grounds relating to your particular situation, to processing based on legitimate interests under Article 6(1)(f) GDPR.
数据可携权：仅在 GDPR 第20条规定的适用条件满足时适用。
Right to data portability: only where the specific conditions of Article 20 GDPR are met.
向主管数据保护监管机构投诉的权利。
Right to lodge a complaint with a competent data-protection supervisory authority.
如果处理依据 GDPR 第6(1)(f)条，您有权基于与您具体情况有关的理由随时提出反对。在有效反对后，除非天瞳能够证明存在超越您的利益、权利和自由的重大合法理由，或者处理对于建立、行使或抗辩法律请求是必要的，否则将停止相关处理。
Where processing is based on Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Following a valid objection, Calmcar will cease the relevant processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
道路测试图像和传感器数据通常不会以个人姓名建立索引。因此，为帮助我们定位可能涉及您的数据，您可以在合理范围内提供以下信息：
Road-test imagery and sensor data are generally not indexed by an individual’s name. To help us locate data that may relate to you, you may provide the following information where reasonably available:
大致地点、道路或路线。
Approximate location, road or route.
日期和大致时间。
Date and approximate time.
测试车辆的外观、编号或其他识别信息（如已知）。
Appearance, number or other identifier of the test vehicle, if known.
您本人或相关车辆的必要描述。
A necessary description of yourself or the relevant vehicle.
其他能够合理帮助定位相关记录的信息。
Other information that may reasonably assist in locating the relevant records.
请勿提供超出定位数据所合理需要的信息。为防止未经授权披露他人的个人数据，我们可能在必要时要求提供合理的身份核验信息。
Please do not provide information beyond what is reasonably necessary to locate the relevant data. To prevent unauthorised disclosure of another person’s data, we may request reasonable identity-verification information where necessary.
Controller Privacy Contact: [xiaoyao.zhuge@calmcar.com] | EU Representative: [wendychen1104@outlook.de]
如果您认为我们对您的个人数据的处理违反适用数据保护法律，您有权向主管数据保护监管机构提出投诉。根据 GDPR，您通常可以向您的惯常居住地、工作地点或涉嫌违规行为发生地所在成员国的监管机构投诉。
If you believe that our processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with a competent data-protection supervisory authority. Under the GDPR, you may generally complain to the supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement.
天瞳及其处理者将根据处理风险实施适当的技术和组织措施，以保护个人数据免遭未经授权或非法处理以及意外丢失、破坏或损坏。项目各方应建立数据泄露和安全事件的内部报告、升级和沟通机制，并根据适用法律履行监管机构和数据主体通知义务。
Calmcar and its processors will implement appropriate technical and organisational measures proportionate to the processing risks to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. Project parties should maintain internal reporting, escalation and communication procedures for personal-data breaches and security incidents and comply with applicable notification obligations to supervisory authorities and data subjects.
我们可能因项目范围、测试国家、数据类别、技术架构、接收方、跨境传输安排或法律要求发生变化而更新本隐私声明。最新版本将持续发布于天瞳官方网站，并在页面顶部标明版本和更新日期。
We may update this Privacy Notice where the project scope, testing countries, categories of data, technical architecture, recipients, international-transfer arrangements or legal requirements change. The current version will remain available on Calmcar’s official website and will show the version number and update date at the top of the page.
Privacy Notice URL: [www.calmcar.com]
| Data Controller / 数据控制者 | Beijing Tiantong Weishi Electronic Technology Co., Ltd. 北京天瞳威势电子科技有限公司 Room 701-7A, 7th Floor, Building 1, No. 10 Hongda North Road, Beijing Economic and Technological Development Zone, Beijing, the PRC 北京市北京经济技术开发区宏达北路10号1号楼7层701-7A室 Email: [contact@calmcar.com] |
| EU Representative / 欧盟代表 | [Ying Chen] [Heyenbaumstrasse 170A,47802 Krefeld] Email: [wendychen1104@outlook.de] |
| DPO / Privacy Contact | [Xiaoyao ZHUGE] Email: [xiaoyao.zhuge@calmcar] |