Privacy Policy

Last updated: 20 September 2026

This Privacy Policy explains how SafeAD GmbH ("SafeAD", "we", "us") processes personal data in connection with www.safead.de, when you contact us, apply for a position at SafeAD, use video content on our website or are incidentally recorded by one of our test vehicles.

1. Controller

SafeAD GmbH
Emmy-Noether-Str. 17
76131 Karlsruhe
Germany

Email: contact@safead.de
Telephone: +49 721 61932611

2. Data Protection Officer

We have appointed the following Data Protection Officer:

Dr. Tilman Kühner

Email: kuehner+datenschutz@safead.de

You may contact our Data Protection Officer at any time regarding questions about the processing of your personal data or the exercise of your data protection rights.

3. Accessing our website

When you access our website, technical information is automatically processed in order to deliver the website securely and reliably. This may include:

• IP address;
• date and time of access;
• requested page or resource;
• browser type and version;
• operating system;
• referring website; and
• technical status information and similar data required for operation and security.

We operate the public website on infrastructure controlled by SafeAD.

Purpose and legal basis

We process this information to provide the website, ensure the stability and security of our systems, identify and investigate technical problems, prevent misuse and attacks, and maintain website functionality.

The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR.

Storage period

Server log data that allows identification of individual users is generally stored for no longer than seven days.

If a security incident or suspected misuse occurs, relevant log data may be retained for longer where necessary to investigate and resolve the incident or to establish, exercise or defend legal claims.

4. Contacting SafeAD

You can contact us through our website contact form, by email or by telephone.

The current contact form allows you to provide your name, work email address, role, company name, subject and message.

When you contact us by email or telephone, we may also process technical communication metadata generated by the relevant systems, such as timestamps, routing information, your telephone number and call duration, where applicable.

We process this information in order to respond to your inquiry and communicate with you.

Legal basis

If you contact us in your own capacity in order to enter into or perform a contract with SafeAD, processing may be based on Art. 6(1)(b) GDPR.

In business-to-business communications where you act on behalf of an organisation, and for other general inquiries, processing is based on our legitimate interest in communicating with customers, partners, prospective customers and other interested parties pursuant to Art. 6(1)(f) GDPR.

Recipients

Your information is accessible within SafeAD only to persons who require it to process your inquiry.

Technical service providers may process information on our behalf where this is necessary for the operation or maintenance of our communication and IT systems.

Provision of data

Fields marked as required in the contact form are necessary to submit the form and allow us to respond to your inquiry.

Other fields are voluntary. If required information is not provided, we may not be able to process the inquiry through the contact form.

Storage period

We retain contact information for as long as necessary to process your inquiry and any subsequent business relationship.

Where correspondence or related documents are subject to statutory commercial, accounting or tax retention requirements, they may be retained for the applicable statutory period.

Depending on the type of record, such periods may be 6, 8 or 10 years.

Information may also be retained for the duration of applicable limitation periods where necessary for the establishment, exercise or defence of legal claims.

5. Cookies and similar technologies

Our website uses cookies and similar browser-based technologies.

We distinguish between strictly necessary, functional and statistics technologies, as reflected in the Cookie Preferences available on the website.

Strictly necessary technologies may include technologies used to remember your cookie choices and session cookies required for the application process.

Optional functional technologies may remember preferences such as whether a video was muted.

Statistics technologies are used in connection with video performance analytics, in particular Mux.

Where access to or storage of information on your device is strictly necessary to provide a function that you explicitly request, it is carried out in accordance with Section 25(2) TDDDG.

Optional functional and statistics technologies are used on the basis of your consent pursuant to Section 25(1) TDDDG and, where personal data is processed, Art. 6(1)(a) GDPR.

You can give, refuse or withdraw your consent through the Cookie Preferences on our website.

Further information, including information about storage criteria, is available in our Cookie Policy.

6. Video analytics – Mux

With your consent, we use Mux to obtain technical and statistical information about the playback and performance of videos on our website.

The service is provided by Mux, Inc., United States.

Mux may process information including:

• IP address, which Mux uses for purposes such as coarse geographic location and bot detection and then pseudonymizes by truncation;
• coarse geographic information and network information;
• browser, operating system and device information;
• information about the video and player;
• video playback and performance information; and
• randomly generated viewer and session identifiers.

Depending on the technical configuration, Mux may use a first-party cookie or similar anonymous identifier to associate playback events with a viewing session.

SafeAD does not use Mux data for advertising or cross-site advertising profiles.

Legal basis

Mux statistics are used on the basis of your consent.

The legal basis is Section 25(1) TDDDG for accessing or storing information on your device and Art. 6(1)(a) GDPR for processing personal data.

You can withdraw your consent at any time through the Cookie Preferences on our website.

Storage and international transfer

According to Mux, pseudonymized video view data is retained for up to 100 days and is then deleted from its systems.

Mux is established in the United States and processing may therefore involve a transfer of information to the United States.

Mux states that it participates in the EU-U.S. Data Privacy Framework.

Where personal data is transferred outside the European Economic Area, the requirements of Chapter V GDPR apply.

7. Job applications

If you apply for a position at SafeAD through our application portal, we process the information you provide for the purpose of conducting and managing the recruitment and selection process.

Depending on the information you provide, this may include:

• first and last name;
• email address;
• resume;
• position applied for;
• relevant professional work experience;
• highest degree obtained and academic grade information;
• information about a relevant project;
• information about how you learned about SafeAD;
• additional remarks provided voluntarily; and
• technical information and session data required to operate the application process.

Please provide only information that is relevant to your application.

Purpose and legal basis

We process applicant data to assess your application, communicate with you and make decisions regarding the establishment of an employment relationship.

The primary legal basis is Section 26(1) BDSG.

To the extent applicable, processing may also be based on Art. 6(1)(b) GDPR for steps taken at your request prior to entering into an employment relationship.

If an application contains special categories of personal data within the meaning of Art. 9 GDPR, we process such information only where this is permitted under Art. 9 GDPR in conjunction with Section 26(3) BDSG or another applicable legal basis.

Recipients

Applicant data is treated confidentially.

Access is limited to employees and management personnel involved in recruitment and the relevant selection process, as well as technical personnel where access is necessary for the operation and security of the application system.

Service providers acting on our behalf may also process data where required for technical operation.

Provision of data

Fields marked as required in the application portal are necessary for us to receive and assess your application.

Other information is voluntary.

If required information is not provided, we may not be able to process your application.

Storage period

If your application is unsuccessful, we generally delete your application data no later than six months after the conclusion of the application process, unless statutory retention obligations apply, longer storage is necessary for the establishment, exercise or defence of legal claims, or you have separately agreed to longer retention for a specific purpose.

If an employment relationship is established, relevant application information may become part of your personnel records and will subsequently be processed in accordance with the applicable employee privacy requirements.

The application portal uses technically necessary session cookies to provide the application process.

8. Sensor data recorded by our test vehicles

SafeAD develops and tests software for autonomous driving.

For these purposes, our test vehicles may record sensor data on public roads, including camera images and laser scan data.

Because these recordings take place in public environments, personal data may incidentally be captured as part of the surrounding traffic environment.

This can include images of road users, vehicles and other visible information, including licence plates where visible.

SafeAD does not use these recordings for the purpose of identifying or evaluating individuals.

Source, purpose and legal basis

The data is recorded directly from public-road environments by sensors installed on SafeAD test vehicles.

The recordings are used for the development, testing and improvement of SafeAD software for autonomous driving.

Where recordings contain personal data, processing is based on our legitimate interests pursuant to Art. 6(1)(f) GDPR.

Our legitimate interest is the research, development, testing and improvement of autonomous driving technology.

We take into account the interests and rights of individuals who may incidentally appear in recordings and apply technical and organisational measures to protect the data.

Storage, recipients and security

Sensor data is stored in a protected data centre in Germany and is protected against unauthorised access.

The recordings are used exclusively for SafeAD development and testing purposes.

Access within SafeAD is limited to persons who require it for these purposes.

Technical processors may have access only where required to provide infrastructure or support services and are bound by applicable data protection requirements.

Data is retained for as long as it is required for the stated development and testing purposes and is deleted or anonymised when it is no longer required, unless statutory obligations or the establishment, exercise or defence of legal claims require longer retention.

Requests relating to recordings

If you believe that you were recorded by one of our test vehicles and would like us to identify and, where applicable, delete a relevant recording, please contact contact@safead.de and provide the approximate location and time of the recording.

Further information is available on the Data page of our website.

9. Recipients and service providers

Within SafeAD, personal data is accessible only to persons who require access for the relevant purpose.

We may also use carefully selected technical service providers to support the operation, maintenance, security and functionality of our systems.

Where service providers process personal data on our behalf, they are bound by applicable data protection requirements and, where required, data processing agreements pursuant to Art. 28 GDPR.

We disclose personal data to other third parties only where this is necessary for the relevant processing purpose, we are legally required to do so, you have consented or another legal basis permits the disclosure.

10. International data transfers

Some service providers may process personal data outside the European Economic Area.

In particular, Mux, Inc. is established in the United States.

Where personal data is transferred to a country outside the European Economic Area, we ensure that the requirements of Chapter V GDPR are met.

Depending on the recipient, this may include an adequacy decision by the European Commission, participation in the EU-U.S. Data Privacy Framework where applicable, Standard Contractual Clauses approved by the European Commission or another legally recognised transfer mechanism.

11. Your rights

Subject to the requirements of the GDPR, you may have the following rights regarding your personal data:

• right of access pursuant to Art. 15 GDPR;
• right to rectification pursuant to Art. 16 GDPR;
• right to erasure pursuant to Art. 17 GDPR;
• right to restriction of processing pursuant to Art. 18 GDPR;
• right to data portability pursuant to Art. 20 GDPR;
• right to object pursuant to Art. 21 GDPR; and
• right to withdraw consent at any time with effect for the future where processing is based on your consent.

To exercise your rights, you may contact SafeAD or our Data Protection Officer using the contact details above.

We may need to verify your identity where necessary to protect your personal data.

12. Right to object

Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.

If you object, we will no longer process the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.

The supervisory authority responsible for SafeAD's main establishment is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW)

Heilbronner Straße 35
70191 Stuttgart
Germany

Email: poststelle@lfdi.bwl.de

You may also lodge a complaint with another competent supervisory authority, in particular in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

14. Changes to this Privacy Policy

We may update this Privacy Policy as needed to reflect changes to our processing activities, services, technologies or legal requirements.

The date of the latest version is shown at the top of this page.

‍