1. Name and Contact Information of the Data Controller           

Name and Address:
fka GmbH                                           
Steinbachstraße 7                               
52074 Aachen                                     
Germany                                       

Contact:
fka GmbH
Phone: +49 241 8861 0
E-Mail: info@fka.de
Website: www.fka.de

Further information about the company and details regarding authorized representatives are available at: www.fka.de/impressum

2. Contact Information for the Data Protection Officer

The data protection officer at fka can be reached at the following contact information for questions and other concerns regarding data protection.

fka GmbH
– Data Protection Officer –
Steinbachstraße 7, 52074  Aachen
E-Mail: dsb@fka.de

3. Categories of Personal Data, Purposes, and Legal Basis for Data Processing

 The following categories of personal data are subject to processing under the Participant Agreement:

• Basic and contact information (name, address) of the participant;
• Images and video recordings made as part of the simulator user study in which the participant may be visible;
• Measurement data, e.g., in the form of vehicle parameters, which, when combined with the time and date information from the images and video recordings, allow for identification of the individual;
• Questionnaire responses.

The creation, use, and disclosure of this data are governed by the participant agreement between fka and the participant and include the processing of personal data within the scope of the contractually granted or transferred copyrights, neighboring rights, personality rights, or other rights. The legal basis for the collection, storage, and processing of personal data—including its publication and disclosure to third parties in connection with its use and exploitation—is Article 6(1)(b) of the GDPR, where applicable in conjunction with Section 22 of the German Artistic Copyright Act (Copyright Law).

4. Duration of Storage

The data will be stored for as long as it is used within the scope of the subject matter of the contract or is intended for further use. In particular, to the extent that the processing of the data takes place in connection with the exercise of granted or transferred rights of use, ancillary copyright, personality rights, or other rights, the personal data affected thereby will remain stored in whole or in part for as long as there is a corresponding intention to use it.

If there is no longer an intention to use the data, it will be deleted, unless and to the extent that statutory retention obligations (such as those under commercial or tax law) or a legitimate interest for the purpose of asserting, exercising, or defending legal claims require longer retention within the statutory retention or statute of limitations provisions.

5. Recipients/Categories of Recipients

In the exercise or assertion of the rights of use, neighboring rights, personality rights, or other rights granted or transferred under the performer’s contract, personal data may, in particular, be disclosed to the client of fka GmbH for whom the production (consisting of photo and video recordings, recorded measurement data, and completed questionnaires) is being created. Master and contact data are generally not disclosed in this process.

If our client, for whom the production is being created, is based outside the European Economic Area, data may be transferred to a third country in the exercise of the rights of use, neighboring rights, personality rights, or other rights granted to fka GmbH under the participant agreement. Subject to standard data protection clauses concluded with the recipient (Art. 46(2)(c) GDPR), this transfer is based on Art. 49(1), first subparagraph, (a), (b), and/or (e) GDPR. We expressly point out that a transfer of personal data from the production to the United States may be considered. Our customers in the United States ensure that personal data is handled appropriately and securely. However, according to the case law of the European Court of Justice, there is no generally adequate level of data protection in the United States. Furthermore, measures may be taken there against which no sufficient legal protection can be sought.

6. Rights as a Data Subject

Pursuant to Article 15 et seq. of the GDPR, the participant has the right, subject to the conditions defined therein, to request from fka access to the personal data concerning him or her, as well as the right to rectification, erasure, or restriction of processing; the right to object to processing; the right to withdraw consent where consent has been given; and the right to data portability.

The participant also has the right to lodge a complaint with a data protection supervisory authority regarding the processing of personal data by fka if he or she believes that the processing of data concerning him or her violates the GDPR.

Below, we provide information about the processing of your personal data in connection with your participation in a clinical trial. Additional information on data protection can be found at www.fka.de/de/datenschutz.

1. Name and Contact Information of the Data Controller

The data controller under data protection law (“we”) is:

Name and Address:
fka GmbH                                           
Steinbachstraße 7                               
52074 Aachen                                     
Germany                                       

Contact:
fka GmbH
Phone: +49 241 8861 0
E-Mail: info@fka.de
Website: www.fka.de

You can find more information about our company, details about our authorized representatives, and additional contact options in the legal notice on our website: www.fka.de/impressum

2. Contact Information for the Data Protection Officer

We have appointed a data protection officer. The easiest way to contact him or her with questions or other concerns regarding data protection is at:

fka GmbH
– Data Protection Officer –
Steinbachstraße 7, 52074  Aachen
E-Mail: dsb@fka.de

3. Categories of Personal Data, Purposes, and Legal Bases for Data Processing

We process the following data and categories of data—provided by you or collected by us in connection with the conduct of the study/trial—for the purposes specified below:

• Basic and contact information (in particular, first and last name, address, email address, phone number);
• Additional personal information (e.g., age, gender, driving experience, pre-existing medical conditions);
• Content data (image, video, or audio recordings, vehicle parameters, questionnaire responses, personal observations and perceptions).

We process your data for the organization, conduct, documentation, and evaluation of the study/trial based on your consent pursuant to Article 6(1)(a) of the GDPR, if and to the extent that you have provided such consent. Data sets may also be aggregated with other data sets or archived and reused for further studies or research projects.

Apart from your consent, the following legal bases may apply: We process the data necessary for organizing and conducting the study/trial within the framework of a contractual relationship that is established through your participation in the study/trial. The legal basis for this is Article 6(1)(b) of the GDPR. In addition, data necessary to fulfill statutory documentation or retention obligations is processed on the basis of Article 6(1)(c) of the GDPR or pursuant to Article 6(1)(f) of the GDPR as part of a balancing of interests, to the extent that the data is necessary to safeguard our legitimate interest in documenting the conduct of the study or trial. Furthermore, your data may be processed to assert, exercise, or defend legal claims. The legal basis for this is Article 6(1)(f) of the GDPR. Furthermore, we process additional personal information about you to select the group of trial/study participants in accordance with the requirements of the trial/study design and to rule out health risks to participants—such as those arising from pre-existing conditions—in connection with their participation in the trial or study. This processing is carried out to safeguard our legitimate interests as set forth therein, following a balancing of interests pursuant to Article 6(1)(f) of the GDPR.

4. Duration of Storage

We store your data only for as long as is necessary for the respective purposes. As a general rule, we delete the collected data once the study or trial has ended. However, tax or commercial law retention requirements may necessitate storage for up to 10 years beyond the end of the study or trial. In other cases, personal data may be stored until the statutory limitation periods regarding our legal claims have expired.

Instead of completely deleting the data, we may also anonymize it so that it is no longer possible to identify the data subject.

5. Recipients/Categories of Recipients

Your data will be shared within our company only with those individuals and departments, and only to the extent necessary, for the proper fulfillment of the stated processing purposes.

If and to the extent that this is necessary for the specific processing purposes and permitted or required by law—in particular, if you have expressly consented to this—your data may be transferred or disclosed, in particular to the Institute for Automotive Engineering (“ika”) at RWTH Aachen University as well as to our customers within the framework of project collaboration. For certain processing activities, we engage the services of specialized service providers. These providers, for example, supply us with IT or other services (e.g., email services and server provision). We ensure compliance with data protection regulations through appropriate contractual provisions.

Otherwise, data may only be transferred in anonymized or aggregated form, which does not allow any conclusions to be drawn about your identity.

The data is processed exclusively in data centers within the European Union.

6. Rights as a Data Subject

Pursuant to Article 15 et seq. of the GDPR, you have the right, under the conditions defined therein, to request information about the personal data concerning you, as well as the right to have such data corrected, erased, or its processing restricted; the right to object to the processing; and the right to data portability.

You have the right to lodge a complaint with a data protection supervisory authority regarding our processing of personal data if you believe that the processing of your data violates the GDPR.

If the processing is based on your consent, you also have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out based on your consent prior to its withdrawal. However, we may still need to continue storing certain data to comply with legal requirements or in connection with legal proceedings (see Section 4). In addition, the supplementary information provided in the privacy consent form applies.