HERE Global B.V., including its affiliates (“HERE”), is committed to respecting your privacy and complying with applicable data protection and privacy laws. HERE Global B.V. is the controller of your personal data for the processing described in this Notice. For more information about our privacy approach, please visit our HERE Privacy Policy.  

Introduction of HERE True Service 

HERE True vehicles collect advanced streetlevel imagery (SLI) and mapping data on planned schedules published on our website. The roofmounted equipment includes: 

 - Panoramic cameras: capture streetscene photographs.  

 - Laser Imaging Detection and Ranging (LiDAR - 360° laser, scanner and GPS receiver): records 3D images and measurements of surroundings (buildings, surfaces).  

 - Positioning sensors: log the vehicle’s precise position and orientation. 

 HERE True drivers follow designated routes. Drivers cannot access the data they collect. 

Purpose description 

We use collected data solely internally to create and improve maps and navigation services. Any appearance of personal data (such as people or license plates) is incidental and unavoidable when filming public streets.  

Legal basis 

The legal basis for processing is HERE’s legitimate business interest. We have conducted a thorough Legitimate Interest Assessment, carefully weighing our interests against the potential impact on data subjects. This evaluation concluded that the rights of all individuals concerned are adequately safeguarded. 

Source of information 

Personal data is collected directly in public areas during our drives, and HERE consistently provides clear and transparent information about imagery collection and privacy to the public, both before and during drives.  

The drive schedule is available on the dedicated website. Driving plans may also be communicated through local press releases, newspaper announcements, radio communications, or other appropriate channels. 

Personal data involved in the processing activity 

While capturing panoramic imagery during the drives, collection may incidentally include personal data such as images of individuals and vehicle license plates, together with precise location information. All such collections are anonymized by irreversibly blurring faces and license plates before further processing. 

The HERE True project is designed to avoid areas where accidental processing of specialcategory data may occur; however, this cannot be entirely excluded. Measures are implemented to avoid such areas where feasible (e.g., private roads, militarysensitive areas, hospital yards, religious centers). 

Categories of data recipients to whom we share your personal data  

HERE may provide third parties with information extracted from the collected and blurred imagery, such as extracted road features, or colorized LiDAR plots. No raw or unblurred imagery of faces or vehicle license plates is published or shared. 

Upon request, personal data may be provided to public authorities (e.g., to courts, police, or other law enforcement agencies) to the extent necessary and permitted by law.  

Retention period of the processing activity 

We aim to collect only the personal data necessary for the stated purposes and retain it no longer than needed for those purposes. The retention period (and the criteria used to determine it) depends on the nature of the data and the purpose for which it was collected. The processing of the raw data is limited to the maximum period of two months.  

The processing of the raw (unblurred) data is limited to a maximum period of two months.  

International transfer 

Our products and services may be provided using resources and servers located in various countries around the world. Therefore, your personal data may be transferred across international borders outside the country where the data was collected, including to countries outside the European Economic Area (EEA) or the United Kingdom that do not have laws providing specific protection for personal data or that have different legal rules on data protection, for example, the United States of America. In such cases, we ensure that there is a legal basis for such a transfer and that adequate protection for your personal data is provided as required by applicable law, for example, by using standard contractual clauses approved by the European Commission or relevant authorities (where necessary) and by requiring the use of other appropriate technical and organizational information security measures. You may contact HERE Privacy Office at privacy@HERE.com to obtain additional information about the safeguards we take into consideration with these transfers.  

Automated decision-making based on personal data 

During this personal data processing, automated decision-making based on personal data does not occur. 

Profiling based on personal data 

During this personal data processing, there is no profiling based on the personal data collected.  

Data subject rights 

You have certain rights under GDPR and local laws, including:  

 - Access  

 - Rectification  

 - Erasure  

 - Restriction  

 - Objection  

 - Data portability  

 - Withdrawal of consent (without affecting prior processing)  

To exercise your rights, please submit a request via the following link: https://legal.here.com/here-data-subject-request.  

Exercising your rights will not result in any adverse treatment. 

Personal data security 

We prioritize privacy and security in our products and services by assigning dedicated responsibilities and enforcing internal policies in the highest possible scope corresponding to the state-of-the-art technical level. Appropriate technical and organizational measures include: 

 - Technical safeguards: Data collected by HERE True vehicles is encrypted and stored securely, with access restricted to authorized personnel only. In-vehicle systems are protected against unauthorized access using industry-standard security technologies such as firewalls, encryption, and access controls. Data transfers and remote maintenance are conducted over secure, encrypted channels. 

 - Organizational and contractual safeguards: Internal policies and data processing agreements are in place to ensure compliance with applicable data protection laws. Confidentiality obligations are imposed on all individuals with access to personal data, and access is limited strictly on a need-to-know basis. 

 - Privacy enhancing technologies: Automated processes are used to permanently remove identifiable information (such as faces and license plates) from imagery before further processing. Only anonymized data is retained for long-term use. 

 - Procedural safeguards: Data is collected only in designated public areas, and appropriate notifications or approvals are obtained from relevant data protection authorities as required by applicable laws. Secure procedures are followed for the transfer and storage of personal data. 

 - Continuous improvement: Security and privacy measures are regularly reviewed and updated to address emerging risks and improve effectiveness. 

Changes of Privacy Notice 

HERE may update this Notice from time to time.  

Material changes will be communicated through a notice posted at the top of this document and on our website for at least 30 days.