Protection des données personnelles
The purpose of this notice is to inform our clients of how ALIAE and APRR use and protect their personal data and the reasons for which they process these data.
ALIAE and APRR attach great importance to the protection of privacy and therefore undertake to process personal data in accordance with the French Data Protection Act No. 78-17 of 6 January 1978, as amended, and the General Data Protection Regulation (GDPR) No. 2006/679.
Preamble
What are personal data?
This is any information concerning a directly or indirectly identified or identifiable natural person by reference to an identification number or to one or more elements that are specific to him/her.
How are personal data collected?
Personal data may be collected directly from the customer, in particular when subscribing to an electronic toll (télépéage) collection agreement, a service, a newsletter, a contact, during a solicitation, etc.
Personal data may also be collected indirectly while traveling on the ALIAE motorway network, using technical devices connected with information services and video surveillance (CCTV). ALIAE is one of the first motorways in France to implement Free Flow (Flux Libre), a technology based on video which will eventually allow toll collection without a toll barrier.
Who is the data controller?
ALIAE, as concessionaire of the motorway network, and APRR, as operator under an operating contract, are each individually responsible for their own processing:
• ALIAE SAS with a share capital of €119,017,000, registered in the Cusset trade register under number 844 440 370 RCS Cusset, with its registered office located at 4 la Folie, TOULON-SUR-ALLIER (03400);
• APRR SA with a share capital of €33,911,466, registered in the Dijon trade register under number 016 250 029 RCS Dijon, with its registered office located at 36 rue du Docteur Schmitt, SAINT APOLLINAIRE (21850).
Protection of personal data
ALIAE and APRR collect and process the personal data strictly necessary to offer customers personalised, high-quality services.
Data processed and associated purposes
I. Subscription to an electronic toll (télépéage) collection system, online management of the account and the electronic tag by the customer:
APRR is responsible (the data controller) for this processing.
The following data are collected through forms completed by the client and from attached documents: Identity data and date of birth of the subscriber, data relating to travel on the motorway in order to establish the cost of the trip (time stamp and network entry and exit stations), vehicle registration data and characteristics (linked to certain subscription contracts) and bank data for invoicing purposes.
II. Determining and collecting the toll and management of billing:
APRR is responsible (the data controller) for the following processing operations:
a) Determining the price of the toll according to the category of vehicle
The data processed;
• To check the category of the vehicle: Videos from cameras located in toll lanes, allowing the creation and management of a list of data including the vehicle licence plate number, the country of registration, the toll category of the vehicle and the date of the last passage of the vehicle through the toll lane.
• To check the category of a vehicle when passing through a toll lane: Videos from CCTV cameras in toll lanes, in the event of a technical alert concerning one of the components for determining the category or if there is a discrepancy between the category determined by the toll equipment and the category in the data list.
b) Determining the route for the application of the correct toll rate:
The data processed:
• At the entrance to the network: A photo of the license plate, the licence plate number (anonymised), country of registration, elements relating to the toll transaction.
• At the exit from the network: A photo of the number plate, the video of the vehicle passing through, the licence plate number, country of registration, the elements relating to the toll transaction.
c) Toll collection
The data processed:
• Data relating to the travel: Time and station of entry and exit from the network, category of vehicle, price of the transaction.
• Subscriber data: identity, subscriber number, information held on payment cards or electronic tags provided by the issuers: Number, expiration date and for some types of subscriptions: date and place of birth, vehicle licence plate number.
• Data needed to assist the customer (at his/her request or technical alert): Videos from CCTV.
d) Invoicing management
The data processed:
• Data processed relating to means of payment: Identification of the issuer, tag number, expiration date.
• Data processed relating to electronic toll (télépage) subscribers: Videos from CCTV cameras in toll lanes, allowing the application and control of the commercial terms.
III. Operation and maintenance of a free-flow toll collection system (péage en flux libre) in operating condition:
APRR, as the operator of ALIAE, informs you that the following processing operations are carried out on behalf of ALIAE and the free flow system (système flux libre) on the A79. APRR is responsible (the data controller) for this processing.
The data collected and processed are from the gates of the free flow (flux libre) equipment which collect all the data necessary to determine and collect the toll for any vehicle passing under a gate.
a) Maintenance in operating condition
The data are collected by the free-flow equipment called "gates", which have no impact on the toll, in order to measure the performance of the equipment and/or to compare it with data from a toll barrier located near the gate(s).
Data processed for all vehicles passing under a gate: Contextual photo, licence plate number and country (with associated photo), electronic tag ID and data, the characteristics and category of the vehicle, time stamp and gate location.
Data processed at the toll station: Location of the toll lane, contextual video of the toll lane showing the vehicle and other data identical to the information collected under the gate.
b) Determining the amount of the free-flow toll (péage en flux libre)
The data collected and processed concern the processing carried out by APRR to determine the toll in the free-flow section (section flux libre).
Data relating to the identification of the vehicle: Licence plate number and country (with associated photo), category and characteristics of the vehicle
Data relating to the travel: Time stamp of the passage under the gate and location of the gate;
Subscriber customer data: identifier of the electronic tag(s) in the vehicle; data contained in the electronic tags detected.
c) Determination of the ecological class of vehicles in order to apply the appropriate toll rate
The data collected and processed concerns the processing carried out by APRR for the correct pricing of tolls to customers according to the ecological class of their vehicle. A list is compiled of vehicle plate numbers with certified emissions.
Data relating to the identification of the vehicle: Vehicle plate number, country, vehicle energy or the French Euro pollution class (data provided by the Vehicle Registration System (SIV) for French vehicles, and by the client for foreign vehicles).
d) Payment of the free-flow tolls (péages en flux libre) on the payment site
The data collected and processed concern all the processing carried out by APRR to ensure the collection for trips made on the free-flow section.
On the aliae.com payment site, in order to identify the trip, you are asked for your vehicle plate number or your account.
Data relating to the identification of the vehicle: The registration number and the class of the vehicle.
Data relating to the travel: Time stamp of the passage through the gate, data for the unpaid trips (entry, exit, amount to be paid, vehicle class).
Data processed relating to means of payment: bank card or private card numbers.
Data relating to the creation of a customer account (without an electronic toll tag): Email address associated with the number plate to one or more license plate(s).
Passing alert data: E-mail address associated with one or more license plate(s).
IV. Entry without a ticket at the Montmarault entrance ramp:
This device replaces a conventional toll barrier at the entrance to the network. Exit data are collected at the Deux Chaises toll barrier.
APRR is responsible (the data controller) for this processing.
Data processed for all vehicles passing under the gate: Contextual photo, licence plate number and country (with associated photo), electronic tag ID and data, the characteristics and category of the vehicle, time stamp and gate location.
Data processed at the toll station: Location of the toll lane, context video of the toll lane showing the vehicle and the data identical to that collected under the gate.
V. Customer Relationship Management:
ALIAE and APRR collect and process personal data at the time of any contact with the customer. ALIAE and APRR are each responsible for this processing (the data controllers) depending on the contact points used by the customer.
In order to improve the quality of customer service, satisfaction surveys may be carried out and telephone calls may be listened to on an ad hoc basis.
The data collected are necessary to provide the customer with an appropriate response to any request, complaint or query.
The data processed are the following: Customer's identity, telephone number, postal address, email, purpose of the request.
VI. Management of lists of exceptions for electronic toll (télépéage) subscribers:
APRR is responsible (the data controller) for the following processing operations:
a) Prevention of non-payment and management of re-subscription:
The data processed:
Customer's identity, date of birth, postal address, email, telephone number, subscriber number, electronic tag number, bank details, subscription date, information related to the rejection of the payment request (amount, reason provided by the bank, corresponding invoice), number of electronic tags, average spend, history of unpaid tolls.
b) Management of payment fraud (e.g. use of false IBANs (bank identifiers) when subscribing to electronic toll collection (télépéage)):
The data processed:
Identity of the bank account holder, bank card number or IBAN, email and postal address, telephone number, date of birth.
VII. Notice of non-payment of tolls:
Categories of data processed:
• Photo of number plate and contextual video from toll lane cameras
• The registration number and the make of the vehicle
• Mobile telephone number
• Transaction data (time stamp, station of entry and exit, lane number, rate)
• CNP (Notice of Non-Payment) number
VIII. Combating toll violations:
APRR is responsible (the data controller) for the following processing operations:
a) Combating toll fraud:
Categories of data processed:
• Videos and images from CCTV cameras installed in toll lanes
• Data concerning subscribers and non-subscribers: Identity, licence plate number and payment information
• Data concerning trips and route anomalies
• Data relating to the characteristics of the vehicle
b) Tickets for non-payment of tolls:
Categories of data processed:
• Videos and images from CCTV cameras installed in toll lanes
• Data relating to the ticket: Time record of the passage and location of the violation, toll station, lane, amount of the toll
• Data relating to the vehicle: Characteristics of the vehicle, toll class, licence plate number, country
• Driver and owner data: Identity, address
• Data allowing the Vehicle Registration System (SIV) to be queried: vehicle characteristics and licence plate number, station, lane, date and time of the violation, number of the ticketing officer
• Data from the SIV: Identity or company name, usual name or married name, SIREN number, address, capacity of the owner of the vehicle registration certificate, vehicle characteristics.
• In the event of a protest, the loan or rental of the vehicle: surname, first name, sex, date and place of birth, address and driving licence number of the person who drove or was likely driving the vehicle, electronic toll (télépéage) customer number.
IX. Registration of users for commercial offers and the newsletter:
APRR and ALIAE are each responsible (the data controllers) for this processing depending on the services offered.
Registration allows users to find out about new services and commercial offers, events and tips for safe driving. The sending of the newsletter and commercial offers is subject to the express consent of the users. Data processed: email address.
X. Settlement of notices of non-payment and payment notices on the site https://paiement.aliae.com:
APRR is responsible (the data controller) for this processing.
Data processed: date and number of the notice of non-payment or the payment notice, file number, vehicle plate number, make of vehicle, journey and amount, means of payment
Legal basis for the processing of the personal data
In particular, APRR and ALIAE are authorised to process personal data for the following purposes:
• The performance of the electronic toll (télépéage) subscription agreement, in all its aspects
• For their legitimate interests and for the performance of a public service for the determination, collection of tolls, management of invoicing, operation and the maintenance in operational condition of a free-flow toll collection system, ticketless entry, client relations, management of exception lists relating to electronic toll subscribers, combating toll fraud, recording of non-payment of tolls and payment notices, as well as their settlement on the website https://paiement.aliae.com
• Consent for registration to the services offered: sending newsletters, commercial offers and free flow account creation and sending the free flow passage alert.
Mandatory or optional character of the data
Certain data, as indicated in the forms, are mandatory. If the subscriber does not wish to communicate this information, APRR and ALIAE are not able to provide access to the services offered.
Duration of the retention period of the data processed
In application of the principles defined by the regulations, APRR and ALIAE only retain personal data for the time necessary to achieve the objective pursued at the time the data are collected.
Thus, the following retention periods are observed:
I. Subscription to an electronic toll (télépéage) collection system, online management of the account and the electronic tag by the customer:
5 years after the final closure of the subscription agreement, in accordance with legal regulations on time limitations.
II. Determining and collecting the toll and management of billing:
a) Determining the vehicle class for the application of the correct toll rate:
• List of data to confirm the category of a vehicle: Video: 28 days maximum, other data: 13 months from the last passage of the vehicle.
• Checking the vehicle category when passing through the toll lane: Videos: 28 days maximum.
b) Determining the route for the application of the correct toll rate:
If network input data presented by the customer and the system data are consistent, the processed data are deleted a few minutes after the vehicle has passed the network exit.
In the event of inconsistency between the network entry data presented by the customer and the system data, the processed data are kept for a maximum of 3 months (the (anonymised) licence plate number collected at the network entry is kept for a maximum of the validity period of the toll ticket, and the video sequence collected at the network exit is kept for a maximum of 1 month).
c) Toll collection:
Data relating to the travel: 5 years or 10 years if a tax receipt is issued.
d) Invoicing management:
10 years in accordance with the regulations.
Videos related to the commercial conditions for the electronic toll (télépéage) subscribers are kept for a maximum of 28 days.
III. Operation and maintenance of a free-flow toll collection system (péage en flux libre) in operating condition:
a) Maintenance in operating condition
The contextual videos of the toll lane are kept for a maximum of 28 days, the other collected data are kept for a maximum of 3 months.
b) Determining the amount of the free-flow toll (péage en flux libre)
The data is kept for a maximum of 12 months.
c) Determination of the ecological class of vehicles in order to apply the appropriate toll rate.
The data relating to the ecological class are kept for a maximum of 12 months after the last passage for French vehicles (data provided by the Vehicle Registration System (SIV)), and 36 months for foreign vehicles (data provided by the client).
d) Payment of the free-flow tolls (péages en flux libre) on the payment site
Payment data are stored for up to 3 months after payment.
Data relating to the creation of a customer account (not electronic toll) will be deleted after 3 years if no passage is made.
The data relating to the passage alert will be deleted after 2 years if no passage is made.
IV. Entry without a ticket at the Montmarault entrance ramp:
The data stored during the passage through the gate are retained for a maximum of 4 days.
The data stored at the time of the exit toll are kept in accordance with the processing for "Determination, collection of tolls and management of billing".
V. Customer Relationship Management:
The data of non-subscribers is retained for 2 years from the last solicitation.
VI. Management of lists of exceptions for electronic toll (télépéage) subscribers:
a) Prevention of non-payment and management of re-subscription:
The data are retained in the opposition list until the outstanding debt is settled and for 5 years if it is not settled.
In the absence of full settlement of outstanding debts: re-subscription is not permitted for a period of 5 years
b) Management of payment fraud:
If the subscription request is not accepted due to fraud, the data are automatically deleted 18 months after collection.
VII. Notice of non-payment of tolls:
The data relating to the notices of non-payment of tolls are stored for 3 months after they have been established.
VIII. Combating toll violations:
Data on toll fraud are retained for a maximum of 6 years.
Data relating to non-payment of tolls are kept for a maximum of 1 year, however, the data are kept until the end of a litigation procedure.
VIII. Registration of users for commercial offers and the newsletter:
The data are kept for as long as the person subscribes to the proposed service.
IX. Settlement of notices of non-payment and payment notices on the site https://paiement.aliae.com
See the retention periods specified with regard to the processing of notices of non-payment and payment notices.
Recipients of the processed data
I. Subscription to an electronic toll (télépéage) collection system, online management of the account and the electronic tag by the customer:
The data are accessible to authorised internal services of APRR. Its data processors receive data within the framework of contracts that comply with the regulations on the protection of personal data.
II. Determining and collecting the toll and management of billing:
a) Determining the price of the toll according to the category of vehicle: The data are accessible exclusively to the authorised internal services of APRR.
b) Determining the route for the application of the correct toll rate: The data are accessible exclusively to the authorised internal services of APRR.
c) Toll collection: The data processors receive data within the framework of contracts that comply with the regulations on the protection of personal data.
d) Invoicing management: Depending on the category of the data, the data are accessible to banks, accreditation bodies, electronic toll (télépéage) subscription issuers and other motorway concession companies.
III. Development, validation and maintaining a free-flow toll collection system (péage en flux libre) in operating condition
The data are accessible to the authorised internal services of APRR and to those of the data processor(s) under contracts that comply with the regulations on the protection of personal data.
IV. Entry without a ticket at the Montmarault entrance ramp:
The data are accessible to the authorised internal services of APRR and to those of the data processor(s) under contracts that comply with the regulations on the protection of personal data.
V. Customer Relationship Management:
The personal data are processed by authorised internal services of APRR or ALIAE.
VI. Management of lists of exceptions for electronic toll (télépéage) subscribers:
a) Prevention of non-payment and management of re-subscription:
The personal data are processed by authorised internal services of APRR.
b) Management of payment fraud:
The personal data are processed by authorised internal services of APRR.
VII. Notice of non-payment of tolls:
The personal data are accessible exclusively to the authorised internal services of APRR.
VIII. Combating toll fraud:
Personal data are accessible only to authorised internal services, with the exception of data relating to non-payment of tolls, which is communicated to the duly authorised managers of the SIV (Vehicle Registration System) and to the public prosecutor in the event of non-payment of the payment notice.
IX. Registration of users for commercial offers and the newsletter:
The data are accessible to the authorised internal services of APRR and ALIAE. Their data processors receive data within the framework of contracts that comply with the regulations on the protection of personal data.
X. Settlement of notices of non-payment and payment notices on the site https://paiement.aliae.com
The data are accessible exclusively to the authorised internal services of APRR.
Security measures applied to personal data
The personal data are subject to all the technical and organisational measures necessary to ensure confidentiality and security against any data breach, destruction, loss, alteration, disclosure, reproduction or against any unauthorised access.
The data processors for APRR and ALIAE are subject to the same confidentiality and security obligations.
Location of the personal data
The data are not transferred outside of the European Union.
Automated decision making
The data processing is not subject to automated decision-making.
Rights of persons whose personal data are processed (data subjects):
In accordance with the regulations, every data subject has the following rights:
Right of access, rectification, erasure, opposition on legitimate grounds, limitation and portability of personal data.
All these rights may be exercised by contacting the Data Protection Officer:
• Electronically via form available here.
• or by post at the following address: APRR Group, Délégué à la protection des données (Data Protection Officer), 36 rue Dr Schmitt 21850 St Apollinaire.
Any person concerned by the processing of his or her personal data (a data subject), after having contacted the data controller and if he or she considers that his or her rights have not been respected, may submit a complaint to the CNIL.