Protection of personal data
The purpose of this notice is to inform clients of the way in which APRR and AREA (APRR Group) use and protect their personal data and the reasons for which they process such data. APRR and AREA attach great importance to the protection of privacy and therefore undertake to process personal data in accordance with the French Data Protection Act 78-17 of 6 January 1978, as amended, and the General Data Protection Regulation (RGPD) No. 2006/679.
Preamble
What is personal data?
This is any information relating to a natural person who is identified or can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to that person.
How is personal data collected?
- Personal data may be collected directly from the client, in particular when subscribing to an electronic toll collection contract, a service, a newsletter, a contact, during a request, etc.
- Personal data may also be collected indirectly during journeys made on the APRR and AREA motorway network, thanks to technical devices linked to IT and video surveillance.
Who is the data controller?
Each company, APRR or AREA, is individually responsible for its own processing: APRR SA with capital of €33,911,466, registered in the DIJON trade register under number 016 250 029 RCS Dijon, with its registered office at SAINT APOLLINAIRE (21850) at 36 rue du Docteur Schmitt AREA SA with capital of €82,899,809, registered in the LYON trade register under number RCS LYON B 702 027 871, with its registered office at JONAGE 69330 au 22D avenue Lionel Terray.
Protection of personal data
APRR and AREA collect and process the personal data strictly necessary to provide clients with personalised, high-quality services.
Data processed and associated purposes
I. Subscription to an electronic toll collection system, online management of the account and badge by the customer
The following data are collected through forms filled in by the customer and attached documents: Identity data and date of birth of the subscriber, data relating to journeys in order to establish the amount of the journey made (time stamp and network entry and exit stations), vehicle registration data and characteristics (linked to certain subscription contracts) and bank data enabling invoicing.
II. Determination, collection of tolls and management of invoicing
a) Determination of the toll price according to the category of the vehicle :
Data processed :
- To certify the category of a vehicle: Videos, from cameras installed in toll lanes, allowing the constitution and management of a list of data including the vehicle registration number, the country of registration, the toll category of the vehicle and the date of the last passage of the vehicle in the toll lane.
- To check the category of a vehicle when passing through a toll lane: Videos from video surveillance cameras located in toll lanes in case of a technical alert on one of the components allowing the determination of the category or in case of a discrepancy between the category determined by the toll equipment and the one in the data list.
- In case of a technical alert on one of the components allowing the determination of the category or in case of a discrepancy between the category determined by the toll equipment and the one in the data list.
b) Determination of the route for the application of the correct toll rate :
Data processed:
At network entry: A photo of the license plate, the license number (anonymised), country of registration, elements related to the toll transaction. At the exit of the network: A photo of the number plate, the video of the vehicle passage, the number plate, the country of registration, the elements related to the toll transaction.
c) Toll collection
Data processed :
- Data relating to journeys: time and station of entry and exit from the network, category of vehicle, price of the transaction
- Data relating to subscribers: identity, subscriber number, information held on payment cards or badges issued by the issuers: number, expiry date and for certain types of subscriptions: date and place of birth, vehicle registration number
- Data required for customer assistance (at the customer's request or technical alert): Videos from video surveillance
d) Billing management
- Data processed relating to means of payment: Identification of the issuer, number of the medium, expiry date.
- Data processed relating to electronic toll subscribers: Videos, from video surveillance cameras installed in toll lanes, allowing the application and control of commercial conditions.
III. Operation and maintenance of a free-flow toll collection system
APRR, as the operator of ALIAE, informs you that the following processing operations are carried out on behalf of ALIAE and the free flow system on the A79. APRR is responsible for this processing.
The data collected and processed are from the Free Flow equipment gantries which collect all the data necessary to determine and collect the toll for any vehicle passing under a gantry.
a) Maintenance in operational condition
The data is collected by free flow equipment called "gantries", without any impact on the toll, in order to measure the performance of the equipment and or to compare it with the data of a toll barrier located near the gantry(s).
- Data processed for any vehicle passing under a gantry: background photo, registration number and country (with associated photo), vehicle ID and tag data, vehicle characteristics and category, time stamp and location of gantry.
- Data processed at the toll plaza: Location of the toll lane, context video of the toll lane showing the vehicle and other data identical to that collected at the gantry.
b) Determination of the toll amount
The data collected and processed concerns the processing carried out by APRR to determine the toll in the free flow section.
- Data relating to the identification of the vehicle: the registration number and country (with associated photo), category and characteristics of the vehicle
- Journey data: Time stamp of the passage under the gantry and location of the gantry;
- Subscriber data: identifier of the telebadge(s) present in the vehicle; data contained in the detected telebadges.
c) Determination of the ecological class of vehicles in order to apply the appropriate toll rate
The data collected and processed concerns the processing carried out by APRR for the correct pricing of tolls to customers according to the ecological class of the vehicle used. A list is compiled of registrations with certified emissions
Vehicle identification data: registration number, country, vehicle energy or French Euro pollution class (data provided by the Vehicle Registration System for French vehicles, by the customer for foreign vehicles)
d) Payment of the toll price in free flow on the payment site
The data collected and processed concerns all processing carried out by APRR to ensure the collection of journeys made on the free-flow section.
On the aliae.com payment site, in order to identify the journey, the vehicle registration number or your account is requested.
- Data relating to the identification of the vehicle: The registration number and the class of the vehicle.
- Data relating to journeys: Time stamp of the passage under the gate, data of the journeys not paid (entry, exit, amount to be paid, class).
- Data processed relating to means of payment: bank card or private card numbers.
- Data relating to the creation of a customer account (not electronic toll): E-mail address associated with the number plate.to one or more license plate(s).
- Passing alert data: e-mail address associated with one or more license plate(s).
IV. Ticketless entry at the Chambéry entrance ramp
- Data processed for each vehicle passing under the gantry: context photo, registration number and country (with associated photo), ID and passport data, vehicle characteristics and category, time stamp and location of the gantry.
- Data processed at the toll plaza: Location of the toll lane, context video of the toll lane showing the vehicle and data identical to that collected at the gantry.
V. Customer Relationship Management
APRR and AREA collect and process personal data whenever they have contact with a client.
The data collected is necessary to provide the client with an appropriate response to any request, claim or query.
The data processed is as follows: Client's identity, telephone number, postal address, e-mail, subject of the request.
In order to improve the quality of customer service, satisfaction surveys may be carried out, and telephone calls may be monitored from time to time.
VI. Management of exception lists for electronic toll subscribers
a) Prevention of non-payment and management of re-subscription:
Customer identity, date of birth, postal address, email, telephone number, subscriber number, electronic toll tag number, bank details, date of subscription, information related to the rejection of the payment request (amount, reason provided by the bank, corresponding invoice), number of electronic toll tags, average amount of consumption, history of unpaid bills
b) Management of payment fraud (e.g. use of false IBANs when subscribing to an electronic toll subscription):
Data processed:
Identity of the bank account holder, bank card number or IBAN, e-mail and postal address, telephone number, date of birth.
VII. Notification of non-payment of tolls
Categories of data processed :
- Photo of the number plate and contextual video from the cameras located in the toll lanes
- Vehicle registration number and vehicle brand
- Mobile phone number
- Transaction data (time stamp, entry and exit station, lane number, tariff)
- NOC number
VIII. Combating toll violations
a) Combating toll fraud :
Categories of data processed :
- Videos and images from video surveillance cameras installed in toll lanes
- Data relating to subscriber and non-subscriber customers: identity, registration number and information relating to means of payment
- Data relating to journeys and route anomalies
- Data on vehicle characteristics
b) Toll non-payment tickets :
Categories of data processed :
- Videos and images from video surveillance cameras installed in toll lanes
- Data related to the ticket :
- Time stamp of the passage in the lane and of the ticket, location, toll station, lane, amount of the toll
- Vehicle data: Vehicle characteristics, toll class, registration number, country
- Driver and owner data: Identity, address
- Data allowing the Vehicle Registration System (SIV) to be queried: vehicle characteristics and registration number, station, lane, time of the offence, number of the ticketing officer
- Data from the SIV: Identity or company name, surname or married name, SIREN number, address, status of owner of the registration certificate, vehicle characteristics.
In the event of a protest, loan or hire of the vehicle: surname, first name, sex, date and place of birth, address and driving licence number of the person who was driving or likely to drive the vehicle, electronic toll customer number.
IX. Raising awareness of exceeding the speed limit
As part of its efforts to raise awareness among users of the need to exceed the speed limit, APRR processes vehicle registration data and time stamps from the number plate reading.
X. User registration for commercial offers and newsletter
Registration allows users to find out about new services and commercial offers, events and tips for safe driving. The sending of the newsletter and commercial offers is subject to the express consent of the users. Data processed: e-mail address.
Legal basis for the processing of personal data
APRR and AREA are authorised to process personal data in the context of
- The performance of the electronic toll subscription contract, in all its aspects
- Their legitimate interests and for the performance of a public service mission for the determination, collection of tolls, management of invoicing, operation and maintenance in operational condition of a free-flow toll collection system, customer relations, management of exception lists relating to electronic toll subscribers, the fight against toll fraud, as well as for raising users' awareness of the need to exceed the maximum authorised speed limit and the recording of non-payment of tolls and payment notices.
- Consent for registration to the services offered: sending newsletters and commercial offers create a free-flow account and send the free-flow passage alert.
Duration of storage of processed data
In application of the principles defined by the regulations, APRR and AREA only keep personal data for as long as is necessary to achieve the purpose for which it was collected.
Thus, the following retention periods are observed:
I. Subscription to an electronic toll collection system, online management of the account and badge by the customer
5 years after the final closure of the subscription contract, in accordance with the regulations on legal requirements.
II. Determination, collection of tolls and management of invoicing
a) Determination of the toll price according to the vehicle class :
List of data to confirm the class of a vehicle: Video: 28 days maximum, other data: 13 months from the last passage of the vehicle.
Verification of vehicle category when passing through the toll lane: Video: 28 days maximum.
b) Determination of the route for the application of the correct toll rate:
In case of consistency between the network input data presented by the customer and the system data, the processed data is deleted a few minutes after the vehicle has passed through the network exit. In case of inconsistency between the network entry data presented by the customer and the system data, the processed data are kept for a maximum of 3 months (the (anonymised) registration number, collected at the network entry, is kept for a maximum of the validity period of the toll ticket, the video sequence, collected at the network exit, is kept for a maximum of 1 month)
c) Toll collection :
Trip data: 5 years or 10 years if a tax receipt is issued.
d) Billing management :
10 years in accordance with the regulations.
Videos related to the commercial conditions of electronic toll subscribers are kept for a maximum of 28 days.
III. Entry without a ticket at the Chambéry entrance ramp
The data stored during the passage through the portal is kept for a maximum of 4 days.
IV. Operation and maintenance of a free-flow toll collection system
a) Maintenance in operational condition
The videos of the toll lane context are kept for a maximum of 28 days, the other collected data are kept for a maximum of 3 months.
b) Determination of the toll amount in free flow
The data is kept for a maximum of 12 months.
c) Determination of the ecological class of vehicles in order to apply the appropriate toll rate
The data relating to the ecological class is kept for a maximum of 12 months after the last passage for French vehicles (data provided by the Vehicle Registration System), 36 months for foreign vehicles (data provided by the customer).
d) Payment of the toll price in free flow on the payment site
Payment data is kept for up to 13 months after payment.
Data relating to the creation of a customer account (non-electronic toll) will be deleted after 3 years if no use is made.
Passage alert data will be deleted after 2 years if no passages are made.
V. Customer Relationship Management
The data of non-subscribers is kept for 2 years from the last solicitation.
VI. Management of exception lists for electronic toll subscribers
a) Prevention of non-payment and management of re-subscription :
The data is kept in the opposition list until the unpaid amount is settled and for 5 years in the absence of settlement.
In the absence of full settlement of outstanding debts: re-subscription is not allowed for a period of 5 years
b) Management of payment fraud:
When the subscription request is not accepted due to fraud, the data is automatically deleted 18 months after collection.
VII. Notification of non-payment of tolls
Data relating to findings of non-payment of tolls are kept for 3 months after they have been established.
VIII. Combating toll violations
Data relating to toll fraud are kept for a maximum of 18 months.
Data relating to non-payment of tolls are kept for a maximum of 1 year, although the data are kept until the end of any legal proceedings.
IX. Raising awareness of exceeding the speed limit
The registration number is deleted as soon as the security message is displayed,
The other (anonymous) data is archived for 3 months.
X. User registration for commercial offers and newsletter
The data is kept for as long as the person subscribes to the proposed service.
Recipients of the processed data
I. Subscription to an electronic toll collection system, management of the account and the badge by the customer
The data is accessible to the authorised internal departments of APRR and AREA. Their subcontractors are recipients of the data under contracts that comply with the regulations on the protection of personal data.
II. Determination, collection of tolls and management of invoicing
a) Determination of the toll price according to the category of the vehicle: The data are accessible only to the authorized internal services
b) Determination of the route for the application of the correct toll rate: The data is accessible only to the authorised internal services
c) Toll collection: The data is sent to subcontractors within the framework of contracts that comply with the regulations on the protection of personal data
d) Billing management: Depending on the category of data, the data is accessible to banks, accreditation bodies, electronic toll subscription issuers, other motorway concession companies
III. Operation and maintenance of a free-flow toll collection system
The data is accessible to APRR's authorised internal departments and to those of the subcontractor(s) within the framework of contracts that comply with the regulations on the protection of personal data
IV. Ticketless entry at the Chambéry entrance ramp
The data is accessible to APRR's authorised internal departments as well as to those of the subcontractor(s) under contracts that comply with the regulations on the protection of personal data.
V. Customer Relationship Management
Personal data is processed by authorised APRR or AREA internal departments
VI. Management of exception lists for electronic toll subscribers
a) Prevention of non-payment and management of subscriptions:
Personal data is processed by authorised APRR or AREA internal departments
b) Management of payment fraud:
Personal data is processed by the authorised internal departments of APRR or AREA
VII. Notification of non-payment of tolls
Personal data is accessible only to authorised internal APRR departments.
VIII. Combating toll fraud
Personal data is accessible only to authorised internal services, with the exception of data relating to non-payment of tolls, which is communicated to the duly authorised managers of the SIV and to the officer of the Public Prosecutor's Office in the event of non-payment of the payment notice.
IX. Raising awareness of exceeding the speed limit
Personal data are processed exclusively by authorised APRR internal departments
X. User registration for commercial offers and newsletter
The data is accessible to the authorised internal departments of APRR and AREA. Their subcontractors are recipients of the data under contracts that comply with the regulations on the protection of personal data.
Security measures applied to personal data
Personal data is subject to all the technical and organisational measures necessary to ensure its confidentiality and security against any data breach, destruction, loss, alteration, disclosure, reproduction or any unauthorised access.
The subcontractors of APRR and AREA are subject to the same confidentiality and security obligations.
Location of personal data
Data is not transferred outside the European Union.
Automated decision making
Data processing is not subject to automated decision-making.
Rights of persons whose personal data are processed
In accordance with the regulations, all data subjects have the following rights: Right of access, rectification, deletion, opposition on legitimate grounds, limitation and portability of personal data. All these rights may be exercised with the APRR Group's Data Protection Officer by contacting
- By electronic means via this form
- By post to the following address : Groupe APRR, Délégué à la protection des données, 36 rue Dr Schmitt 21850 St Apollinaire
Any person concerned by the processing of his or her personal data may, after contacting the data controller and if he or she believes that his or her rights have not been respected, submit a complaint to the CNIL.