I.        What is personal data?

"Personal data" is information relating to an identified or somehow identifiable natural person. "Processing" in this context means any operation or activity that is performed upon personal data, such as collection, recording, transmission, disclosure, erasure, etc.

II.       Controller

The Controller, for the purposes, of the General Data Protection Regulation (EU) 2016/679 (GDPR) is:

Honda Motor Europe Ltd

Honda Motor Europe Ltd - Aalst Office

Wijngaardveld 1(Noord V)

B-9300 Aalst (Belgium)

Email: Pascal.De.Jonge@honda-eu.com

III.    What personal data do we collect, for what purposes and on what legal basis?

As part of our business operations, we test vehicles for research and development purposes and to ensure that the vehicles comply with legal requirements such as the EU’s Intelligent Speed Assistance Regulations. Certain personal data may be processed as part of the testing because we have a legitimate interest in pursuing these objectives and the recording of video and audio footage is necessary to do so. When we or our partner, IDIADA Automotive Technology SA, test our vehicles, we collect video footage of the vehicle environment, and video cameras may capture video, images and audio information relating to:

Individuals:

•       directly involved in the testing of vehicles;

•       who work within premises where testing is undertaken;

•       who are captured incidentally, for example other road users, pedestrians and cyclists;

Vehicles and their licence plates;

Land and buildings.

This information may be summarised in test reports, which are required by our certification team.

IV.   How we share your personal data?

A.      Transfers within the Honda Group of Companies

We share some of your personal data, if any, with other Honda companies within the Honda Group for internal administrative purposes.

In doing so, your personal data may also be processed by Honda companies located in countries outside the European Economic Area ("EEA"), especially Japan. Transfers from the EEA to Japan are made on the basis of the European Commission’s decision that Japan has an adequate data protection regime. To the extent that data is transferred to Honda companies located in countries that do not have a comparable level of data protection to that in the EEA, we base the processing on the so-called standard contractual clauses provided by the European Commission, which are designed to guarantee you enforceable rights. Before making any such transfer we undertake a risk assessment of the transfer, including a review of the laws and regulations in the importing jurisdiction. Where we determine that the standard contractual clauses do not fully mitigate the risks, we will adopt appropriate additional safeguards.

You may request a copy of the documentation we have in place to safeguard your personal data when it is transferred outside the EEA by using the contact information described in section VII below.

B.      Transfers to companies providing service under contract

Data may also be disclosed to service providers used by us to fulfil the aforementioned purposes if they meet special confidentiality requirements and have been contractually obligated to do so. These can be, for example, companies in the following categories provision, maintenance and care of IT systems.

In particular, we process your personal data on cloud-based servers of our email service provider Microsoft Corp. through our parent company Honda Motor Co, Ltd. outside the EEA when you email us. Again, we rely on the standard contractual clauses issued by the European Commission, alongside additional appropriate safeguards provided. For more information, including a copy of the documents used to protect your information, please contact us as described in the section VII. below.

C.      Transfers to suppliers

Where necessary, extracts from the video footage may be transferred to contracted Honda suppliers for component improvement. Again, your personal data may be processed in countries outside the EEA. Where data is transferred to countries that do not have a comparable level of data protection to that in the EEA, we base the processing on the so-called standard contractual clauses provided by the European Commission, which are designed to guarantee you enforceable rights.

D.     Transfers to government authorities or law enforcement

Transfers to government authorities and/or law enforcement officials if mandated by law or if required for the protection of our legitimate interests in compliance with applicable laws.

V.     Your Choices and Rights

With regard to the processing of your personal data by us, you may have the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR), the right to object (Art. 21 GDPR) and the right to data portability (Art. 20 GDPR).

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.

VI.   How long do we process your data?

We will retain your personal data only for as long as 6 years after the EU certification date (EU WVTA date). At the end of the retention period, we will take steps to delete your personal data or hold it in a form that no longer identifies you.

VII.  Updates to this Privacy Notice

This Privacy Notice may be updated periodically. We will update the date at the end of this Privacy Notice accordingly.

VIII.         Contact

If you have any questions about this data privacy statement or the processing of your personal data, please contact our data privacy officer.

You can reach our company data protection manager, if necessary also confidentially, at:

Email: Pascal.De.Jonge@honda-eu.com

You may also use these contact details to raise any complaints or concerns you have with the way in which we handle your personal data. While we hope for the opportunity to respond to any such complaint, you also have the right under GDPR to lodge a complaint with the relevant data protection supervisory authority.

Version: October 2022