Data protection concept of the real vehicle study in the CADJapanGermany:HF project

The German Aerospace Center (hereinafter referred to as "DLR") takes the protection of your personal data, which you provide to us in your capacity as a participant (m/f/d) in the "CADJapanGermany" study of the German Aerospace Center (DLR), very seriously.

Before you start filling out the registration form, we would like to inform you which personal data we process as a test person (m/f/d), for how long and for what purposes we do this and provide you with further information.

In accordance with the GDPR and the BDSG, we use the terms defined in the GDPR and the BDSG. The definitions can be viewed on the Internet, for the GDPR at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AL%3A2016%3A119%3ATOC and for the BDSG at http://www.gesetze-im-internet.de/bdsg_2018/__2.html.

1. Name and address of the person responsible

German Aerospace Center (DLR)
Institute of Transportation Systems
Lilienthalplatz 7, 38108 Braunschweig

2. Name and address of the data protection officer

German Aerospace Center (DLR)
Data Protection Officer Uwe Gorschütz
Linder Höhe
51147 Köln
E-Mail: datenschutz[at]dlr.de

3. Purpose and legal basis for data processing

The scientific research purpose of the CADJapanGermany study with a real vehicle is to evaluate different types of communication of a real vehicle in interaction with pedestrians. The processing of personal data is pseudonymised and the pseudonymisation key is deleted after the data evaluation has been completed.
The legal basis for the processing of personal data is Art. 6 para. 1 lit a) and b) and Art. 9 para. 2. letter j) GDPR in conjunction with § SECTION 27 BDSG.

External DLR Works Security: We transmit the personal data for DLR on-site appointments: Surname, first name and nationality to the external DLR Works Security on the legal basis of Art. 6 para. 1. letter c) and d) GDPR (export control and Major Accidents Ordinance) and store them for a period of 5 years after the date of the visit.
DLR's in-house bank: The account details are transferred to the financial accounting department and bank for payment of the compensation.

6. Storage

The personal data (see 4. Data categories) are stored on an internal, secure DLR server, which is managed by a central, certified DLR provider.

7. Processing and deletion

We process your personal data in accordance with Art. 32 GDPR (security of processing) for as long as is necessary to fulfil the purpose set out in section 3. If the personal data from the data category "respondent" - see section 4 - is no longer required for the fulfilment of contractual obligations, it will be deleted after 10 years.

8. Your rights as a test subject (m/f/d) in relation to your personal data

If your personal data is processed, you are a data subject within the meaning of the GDPR and you are entitled to the following rights vis-à-vis the controller in accordance with the provisions set out below:

(1) In accordance with Art. 15 GDPR, you can request information about the personal data processed by us. In particular, you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your personal data has been or will be disclosed, the planned storage period and the existence of the rights explained in this section 4 and 6.

(2) In accordance with Art. 16 GDPR, you can request the immediate correction of incorrect or incomplete personal data stored by us.

(3) In accordance with Art. 17 GDPR, you can request the deletion of your personal data stored by us, unless the processing is necessary for reasons specified by law, in particular to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or for the assertion, exercise or even potential defence of legal claims.

(4) In accordance with Art. 18 GDPR, you can request the restriction of the processing of your personal data if you dispute its accuracy, if the processing is unlawful but you refuse to delete it and we no longer need the personal data, but you need it for the assertion, exercise or defence of legal claims or if you have lodged an objection to the processing in accordance with Art. 21 GDPR.

(5) In accordance with Art. 20 GDPR, you can receive your personal data that you have provided to us in a structured, commonly used and machine-readable format or request that it be transferred to another controller.

(6) In accordance with Art. 7 Para. 3 GDPR, you can revoke your data protection consent at any time. The consequence of this is that we may no longer continue the data processing that was based on this consent in the future.

(7) Pursuant to Art. 21 GDPR, right to object If personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1) (f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, provided that there are reasons for this arising from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which will be implemented by us without specifying a particular situation, unless the processing is necessary for the performance of a task carried out in the public interest, Art. 21 para. 6 of the GDPR.

(8) In accordance with Art. 77 GDPR, you can lodge a complaint with a supervisory authority. As a rule, the supervisory authority of your usual place of residence or workplace or the registered office of the controller is available for this purpose.