In compliance with the obligations set forth by EU legislation (European Data Protection Regulation No. 679/2016, GDPR) and national legislation (Legislative Decree No. 196 of 30 June 2003, Personal Data Protection Code including subsequent amendments).

Dear User,

We hereby inform you that, pursuant to Articles 13 and 14 of EU Regulation 679/2016 on personal data protection (hereinafter referred to as the “GDPR”), the information and data collected by Società di Progetto Autovia Padana S.p.A. (hereinafter also referred to as the “Company” and/or the “Data Controller”) will be processed in accordance with the aforementioned GDPR and Legislative Decree No. 196/2003 (Privacy Code), as last amended.

This privacy notice is intended for all users who interact with the Company, whether directly or through its official website.

1. Types of Data collected

The Company collects certain personal data including (but not limited to) name, surname, date of birth, address, gender, nationality, e-mail address, and other data (hereinafter referred to as “Personal Data”) that may be necessary for the management of the motorway service and other services generally provided through the Company’s website (hereinafter referred to as the “Service” or the “Services”).This may also include photographic images of vehicle number plates (captured by cameras located at toll stations), relevant in cases of anomalies detected in lanes in relation to the toll payment due.

Please note that the images taken by the cameras do not permit the identification of the persons on board the vehicles in any way.

Personal Data may be submitted voluntarily by the user while browsing the Company’s website or may also be collected during the use of the Service if conditions exist that necessitate their collection (e.g., correct toll allocation, complaints, accidents, etc.).

The Company’s cookie policy can be found at the following link: https://www.autoviapadana.it/cookies/.

The user is responsible for the accuracy and truthfulness of Personal Data, including that of third parties, provided to the Company, relieving the Data Controller from any liability arising from inaccuracies in the data provided.

2. Purpose of processing

The processing of Personal Data collected is intended for the proper management of the Service, with specific reference to the obligations arising from the user’s use of the Service and those related to the functions carried out by the Company in an institutional capacity, including:

• calculation and toll allocation, including the management of relationships with accredited electronic toll service providers;
• toll payment, including the use of the online payment platform;
• communications with users regarding the use of the Service and infrastructure, as well as toll transactions and any related requests (payment and refund of toll credit), issued by the Company in its capacity as the Concessionaire for the Piacenza – Cremona – Brescia routes, the Fiorenzuola d’Arda branch, and the Ospitaletto – Montichiari Junction;
• activities for the prevention and detection of infringements relating to the obligation to pay tolls pursuant to Article 176 of Italian Legislative Decree 285/1992, as amended;
• communications with the user regarding safety resulting from the use of the Service and the infrastructure managed by the Company;
• compliance with the administrative, tax, and legal obligations applicable to the Company;
• proper execution of the obligations arising from the Service provided to the user, including through the website;
• collection of information for the management of the contractual relationship with the electronic toll service providers;
• interventions on the website.

3. Legal bases for processing

The legal basis for processing is:

• legal obligation: the requirement to comply with legal obligations in its role as a motorway concessionaire (technical-administrative management and toll collection; requests from competent authorities; user requests; legal publications); pursuant to Article 6(1)(c) of the GDPR Regulation;
• reasons of public interest: need to properly implement the motorway service, prevention of motorway toll evasion, pursuant to Article 6(1)(e) of the GDPR Regulation;
• legitimate interest: the need to pursue a legitimate interest of the Company pursuant to Article 6(1)(f) of the GDPR.

4. Processing methods

Personal Data may be processed in a hard-copy, computerised and digital format and entered in the relevant databases that may be accessed and therefore become known by operators, who may carry out consultation, use, processing, comparison and any other appropriate operation, including automated operations, in compliance with the provisions of the law necessary to guarantee, among other things, the confidentiality and security of the data as well as their accuracy, updating and relevance to the stated purposes, in accordance with the applicable data protection legislation (including the GDPR and the Privacy Code).

5. Nature of data provision

The provision of data is:

1. Mandatory for achieving the purposes related to the obligations set forth by laws, regulations, or EU regulations, including the proper collection of the toll.
2. Optional, although sometimes necessary for the correct establishment and/or continuation of the relationship with our Company, and for the correct navigation of the site.

Any refusal to provide the data or incomplete data may prevent the Data Controller from carrying out its institutional duties and fully delivering the services, as well as from complying with legal obligations.

6. Scope of data communication

Your Data may be shared, where necessary for the provision of Services, with the designated and authorised personnel of our Company, with entities required to process such data on behalf of the Company for the same purposes stated above, who are appointed as “Data Processors” pursuant to Article 28 of the GDPR, with interconnected concessionary companies, with providers of the European or national electronic toll service in relation to the data of their respective customers, with third party companies, including those providing debt collection services on behalf of the Company and/or access control and/or surveillance services, and with companies providing IT and plant engineering services in relation to the activities carried out, with whom the Company has entered into special agreements on data processing, as well as to comply with requests from competent Authorities and for the protection of the Company.

The full list of entities designated as Data Processors pursuant to Article 28 of the GDPR can be requested from the Company by sending a formal request to the following email address: privacy@autoviapadana.it

The aforementioned areas of communication do not require your authorisation, as they are functional to the provision of the motorway services, to defend a right in court or to pursue a legitimate interest of the Data Controller. For any further communication requiring your prior consent, we will proceed accordingly.

All the aforementioned Personal Data shall not be disclosed or communicated to unauthorised third parties.

Personal data shall be managed and stored on servers located in Italy or within the European Union and will not be transferred outside the European Union.

7. Data retention period

The Personal Data collected, also taking into account any choices made by the data subjects regarding cancellation or revocation during the course of processing, will be processed for a period corresponding to the needs for which it was collected, in compliance with the applicable legal or regulatory provisions or for a period deemed appropriate to ensure the right of defence in the event of litigation or for tax obligations, in compliance with the principle of data minimisation set out in Article 5, paragraph 1, letter c) of the GDPR.

8. Data Controller – DPO – DATA PROCESSOR

The Data Controller is Società di Progetto Autovia Padana S.p.A., with registered office in Tortona, Strada Provinciale della Lomellina 3/13 – 15057, and can be contacted at the address: privacy@autoviapadana.it

The Data Controller has also appointed a Data Protection Officer (“DPO”), who can be contacted at the following email address: dpo@autoviapadana.it

The Data Processor responsible for debt collection activities on behalf of the Company is NIVI S.p.A.

9. Rights of the data subject

You may exercise your rights at any time as outlined by Article 13, letter b) and Articles 15, 16, 17, 18, and 20 of the GDPR by reaching out to the contact details provided in this privacy policy.

Specifically, as Data Subject, you have the right to know which personal data is being used, where it came from, to check its accuracy or to request that it be supplemented or updated, or corrected or restricted. You also have the right to request the deletion, transformation into anonymous form or blocking of data processed in breach of the law, as well as to object in any case, for legitimate reasons, to its processing and to modify or revoke previously given consents, without prejudice to the lawfulness of the processing based on the consent given before the revocation. Furthermore, we inform you that you have the right to object to the processing of your data at any time, in accordance with Article 21 of the GDPR, by sending an email to privacy@autoviapadana.it

Finally, we inform you that you are entitled to lodge a complaint with the Data Protection Authority, whose contact details you will find at the following link https://www.garanteprivacy.it/

Società di Progetto Autovia Padana S.p.A.

Last updated: November 2024