Privacy notice

This notice applies, where relevant, to website visitors, customer and supplier representatives, drivers and engineers, applicants, people submitting privacy requests and other individuals affected by our activities. Not every section applies to everyone. Supplementary information is needed for additional or materially different processing.

SonicRide GmbH · Bockenheimer Landstrasse 17-19 · 60325 Frankfurt am Main · Deutschland
[email protected]

Commercial register: Amtsgericht Frankfurt am Main, HRB 140428. Managing Director: Shengnan Gao. Please use “Privacy / Datenschutz” in your email subject. Do not send identity documents or unnecessary sensitive material with your initial enquiry.

SonicRide acts as controller for its own decisions about website operation, business relationships, recruitment and administration. In engineering and testing, it may act as controller, processor or sub-processor depending on actual responsibilities and decisions about purposes and essential means, not merely contractual labels.

The relevant programme notice must identify the manufacturer, customer roles and privacy contacts. When acting for another controller, SonicRide assists with directing and handling requests under the applicable arrangements.

• Information you provide through correspondence, project enquiries, contracts, applications and privacy requests.
• Information lawfully provided by customers, suppliers, partners, recruitment agencies or referees, and appropriately used public professional sources.
• Access and technical records produced by website hosting and security systems.
• Records generated through business, operational, access and security activities. Road-recording sources are explained separately.

Where SonicRide is controller and obtains data indirectly, Article 14 information must be provided within the applicable timeframe unless a properly assessed exception applies. Publishing a website notice does not itself establish an exception.

Images or business activities may incidentally reveal health, religion, political opinions or other sensitive information. Ordinary images are not automatically Article 9 special-category data. Where Article 9 applies, an additional condition is needed alongside an Article 6 lawful basis. An image of a face is not automatically biometric processing for unique identification.

An accident, police intervention or apparent traffic offence is not automatically Article 10 data. Processing that does fall within Article 10 must meet its additional requirements and applicable national law. Recording on a public road does not in itself make processing lawful.

Legitimate interests require consideration of necessity, alternatives and individual rights. This notice does not replace a programme LIA, DPIA or national-law review.

At collection we should explain whether information is required by law, contract or to enter into a contract. Without reasonably necessary contact, enquiry or application information, we may be unable to respond fully or administer the relevant relationship. Individuals incidentally recorded on roads are not required to provide data directly to SonicRide.

Depending on purpose and necessity, recipients may include authorised personnel, customers or manufacturers, engineering and operational providers, hosting, IT, security, communications and recruitment providers, professional advisers and legally authorised bodies. This website is hosted by Cloudflare, whose infrastructure may process technical access and security data.

Specific recipients, roles and authorisations for programme recordings must be confirmed in programme documentation and notices. General recipient categories do not authorise unrestricted access or onward disclosure.

Overseas providers and programme delivery may involve processing outside the EEA. Transfers of personal data require an applicable Chapter V mechanism, such as an adequacy decision or EU Standard Contractual Clauses, and assessment of supplementary safeguards where needed. China is not currently covered by a European Commission adequacy decision.

Face or plate masking does not necessarily anonymise footage: location, actual capture times and context may still permit identification. The actual data and recipients must inform the assessment. Contact us for information about relevant transfers and safeguards.

Measures must be proportionate to risk and may include authorised access, authentication, encryption in storage and transit, physical-media handling, confidentiality, security logs, incident management and provider contracts. Actual implementation determines coverage and supporting evidence.

The scope of individual measures varies with the processing activity. Programme reviews must establish and verify masking, integrity, recovery and deletion arrangements.

Specific periods are determined by confirmed retention rules and actual processing arrangements. Expiring historical versions does not delete current objects. Account expiry is not the retention deadline for each batch.

This static website version includes no advertising trackers, behavioural analytics or optional third-party statistics scripts. Hosting, security and request delivery can still generate necessary technical records. Before adding optional technologies, we will provide appropriate information and obtain consent where required.

SonicRide does not use this website for solely automated decisions producing legal or similarly significant effects. SonicRide does not use vehicle footage for facial recognition. AI training is distinct from Article 22 decision-making; any programme purpose needs its own definition and assessment.

Subject to applicable conditions, rights include access, rectification, erasure, restriction, portability, objection to legitimate-interest processing and withdrawal of consent. Different rights have different conditions and exceptions.

Contact [email protected]. We request additional identity or representative-authority information only where reasonably necessary. We generally respond within one month. Article 12 may permit up to two additional months for complexity or request volume, with reasons notified in the initial month. Requests are normally free, except where the GDPR permits a fee or refusal.

Please provide an approximate date, time, location, vehicle description and relevant circumstances to help locate footage. Recordings are not normally indexed by name. Where a person cannot be identified using reasonably available information, Article 11 and other applicable GDPR provisions govern the response; locating or immediately deleting every clip cannot be guaranteed.

See the road-recording notice. Do not pursue or stop a test vehicle, or create a road-safety risk to submit a request.

You may contact us or complain directly to a competent EU/EEA supervisory authority, particularly where you normally live, work or believe an infringement occurred. You need not complain to SonicRide first.

For the company’s own processing in Frankfurt, the relevant authority is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (HBDI). Official contact and complaints information; [email protected]. See the EDPB directory for other European authorities.

This notice provides layered information for different business activities. Programme roles, data, recipients, transfers, controls and retention must still be supported by confirmed notices and actual arrangements. General website information does not mean that a DPIA, LIA, permission or transfer review is complete.

Material changes will be reflected in the date and, where applicable, programme information and vehicle signage. A QR code and readable short URL should lead to the accessible, applicable notice.