Privacy

1. Who are the parties to this privacy policy?

The data controller
For all processing operations relating to the Heavy Goods Vehicle Eco-contribution (ECPL), the controller, within the meaning of Article 4(7) of the GDPR, is the Grand Est Region (RGE), whose contact details are as follows: Région Grand Est, 1 place Adrien Zeller, BP 91006, 67070 Strasbourg.
 

The processor ECO PASS EST SAS acts exclusively as a processor, within the meaning of Article 4(8) of the GDPR. In this capacity, ECO PASS EST SAS:

• Provides operational management of the taxation system
• Manages the website and online services
• Processes data solely for the purposes authorised by the RGE
• Guarantees the security and confidentiality of data
• Strictly complies with the obligations laid down in Article 28 of the GDPR

The contact details of ECO PASS EST SAS are as follows: ECO PASS EST SAS, 3 boulevard Saint-Symphorien, 57050 Longeville-lès-Metz

The Data Protection Officer: To exercise any of your rights, you can contact the Data Protection Officer (DPO) of ECO PASS EST SAS by: Post: Data Protection Officer - ECO PASS EST SAS, 3 boulevard Saint-Symphorien, 57050 Longeville-lès-Metz

 

2. Purposes of processing

Personal data are processed solely for the following purposes:

• implementing, managing and enforcing the ECPL;
• the technical operation and security of the website;
• identifying liable parties;
• managing on-board equipment;
• invoicing and collecting the tax;
• detecting and recording offences;
• managing relations with users;
• handling requests sent via the contact forms;
• producing strictly anonymised visitor statistics;
• assisting the controller in implementing the tax, in accordance with the tasks entrusted to ECO PASS EST SAS.

Any use for commercial or advertising purposes, or for purposes unrelated to those listed above, is excluded.

 

3. What data are processed?

Depending on the case, the following may be processed:

• Surname, first name, date and place of birth of liable parties,
• Postal address, e-mail address, telephone number of liable parties,
• Registration plate number (image and video), vehicle registration certificate,
• On-board equipment identifier (On-Board Equipment ID)
• Personal account identifier
• Geolocation information (GNSS position)
• Economic and financial information: means of payment, bank details of liable parties, etc.
• Connection data (IP addresses, …)
• Internet-related data (cookies, …) The list of personal data that may be processed may be adapted to take account of legal, regulatory or contractual changes.
   

4. Mandatory nature of data

Data marked as mandatory are required for the request concerned to be processed. If they are not provided, the request cannot be processed. Other data are optional.

 

5. Recipients of data

Your personal data are processed in strict confidence and are accessible only to the following:

• the Grand Est Region (RGE);
• authorised staff of ECO PASS EST SAS;
• the central information system, in exchanges with third parties (accredited European Electronic Toll Service providers, the enforcement body, the National Agency for the Automated Processing of Offences (Agence Nationale de Traitement Automatisé des Infractions), the Directorate General of Public Finances (Direction Générale des Finances Publiques))
• where applicable, further sub-processors that are duly authorised and bound by contract in accordance with Article 28 of the GDPR

 

6. Transfers of your data outside the European Union

As a rule, your data are hosted and processed within the European Union. Should a transfer to a third country be necessary for technical reasons, we put appropriate safeguards in place in accordance with the GDPR, in particular:

• Use of the European Commission's standard contractual clauses
• Verification that an adequacy decision of the European Commission exists
• Prior authorisation from the RGE Any transfer is made only where necessary and in accordance with Chapter V of the GDPR.

 

7. Retention period

Your data are kept for no longer than is necessary for the purposes for which they are processed, and are then archived or deleted in accordance with the applicable legal obligations. Legal exceptions: only the data strictly necessary to comply with our legal obligations (accounting, tax, etc.) are retained, for the period required by law. Data used for statistical purposes are anonymised beforehand.

 

8. Cookies and trackers

What is a cookie? A cookie is a small text file placed on your computer or mobile device when you visit our website. Cookies allow the website to remember your actions and preferences.

Which cookies do we use?

• strictly necessary cookies (no consent required): these cookies are essential for the website to function: authentication, session security, remembering your basket, etc. They cannot be disabled.
• audience measurement cookies (consent required): these cookies allow us to measure traffic on our website and improve your experience. You can refuse them.

How can you manage cookies? On your first visit, an information banner allows you to accept or refuse non-essential cookies.

At any time, you can:

• Change your preferences via the “Cookie management” link at the bottom of the page
• Configure your browser to block cookies (please note: this may limit some features of the website) To find out more about cookies: www.cnil.fr/fr/cookies-les-outils-pour-les-maitriser

 

9. Data security

ECO PASS EST SAS implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of data, in accordance with Articles 28 and 32 of the GDPR.

 

10. What are your rights?

You have rights regarding your personal data. Here is a practical guide to exercising them:

Your right	What it means for you
Right of access	You can obtain a copy of all the data we hold about you, together with information on how they are used.
Right to rectification	You can have inaccurate or incomplete data corrected (for example: change of address, correction of an error on your vehicle registration certificate).
Right to erasure	You can request the erasure of your data when they are no longer necessary or if you withdraw your consent. Please note: this right does not apply if we must retain your data to comply with a legal obligation.
Right to restriction	You can request the restriction of processing in certain situations (for example: you dispute the accuracy of your data while it is being verified).
Right to data portability	You can retrieve your data in a structured, readable format (for example: Excel file, CSV) in order to transfer them to another provider.
Right to object	You can object to the processing of your data on grounds relating to your particular situation. Please note: this right does not apply where processing is necessary to comply with a legal obligation.
Right not to be subject to an automated decision	You have the right not to be subject to a decision based solely on automated processing of data which significantly affects you or has legal effects and which is taken without human intervention. You cannot exercise this right in the following three situations: a) where automated decision-making is authorised by law (for example, to prevent tax fraud); b) where automated decision-making is based on your explicit consent; or c) where automated decision-making is necessary for entering into or performing a contract. However, in the cases referred to in points a) and c), you have the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.

To exercise your rights, you can contact the Data Protection Officer (DPO) of ECO PASS EST SAS by post: Data Protection Officer - ECO PASS EST SAS, 3 boulevard Saint-Symphorien, 57050 Longeville-lès-Metz

 

11. Right to lodge a complaint with the CNIL

You may also lodge a complaint with the supervisory authority in France, namely the Commission nationale de l'informatique et des libertés (CNIL: 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07 - Telephone: 01 53 73 22 22 - www.cnil.fr).

12. Changes to this privacy policy

This policy may be amended at any time to take account of legal, regulatory or contractual changes. The version published on the website is the version in force.