In compliance with the obligations set forth by EU legislation (European Data Protection Regulation No. 679/2016, GDPR) and national legislation (Legislative Decree No. 196 of 30 June 2003, Personal Data Protection Code including subsequent amendments).

Dear User,

Pursuant to Articles 13 and 14 of EU Regulation 2016/679 on the protection of personal data (hereinafter the “GDPR”), we wish to inform you that the information and data acquired by AUTOSTRADA ASTI-CUNEO S.p.A. (hereinafter referred to as the “Company” and/or the “Data Controller”) will be processed in accordance with the aforementioned Regulation and Legislative Decree 196/2003 (Privacy Code), as most recently amended.

This privacy notice is intended for all persons who interact with the Company, whether directly or through its official website.

1. Types of Data collected

The Company collectively collects certain personal data (hereinafter, “Personal Data”), such as, but not limited to, name, surname, date of birth, address, gender, nationality, e-mail address, images of the vehicle and licence plates (using cameras or video cameras located on the relevant section of the motorway, at toll stations and on free flow portals) and other data that may be required to manage the motorway service.

It should be noted that the images taken do not in any case allow for the identification of the vehicle occupants.

Personal Data may be entered voluntarily by the user when browsing the Company’s website, and the online payment platform accessible from the Company’s website, or may also be acquired during the use of the motorway service if the conditions requiring its collection occur (e.g. complaints, accidents, correct allocation of tolls).

It should be noted that the free flow toll collection system, present on the relevant section of the motorway, necessarily presupposes the acquisition of images of vehicles in transit under the appropriately signposted free flow portals that also enable licence plate recognition for the purposes of its operation).

The Company’s cookie policy can be found at the following link: https://www.asticuneo.it/cookies/

The user is responsible for the accuracy and truthfulness of Personal Data, including that of third parties, provided on the Company’s website, relieving the Data Controller from any liability arising from inaccuracies in the data provided.

2. Purpose of processing

The processing of Personal Data is aimed at ensuring the correct management of the motorway service, with specific reference to the obligations arising from the user’s use of the service and those concerning the functions performed institutionally by the Company such as:

• the correct execution of obligations related to calculation and toll allocation, including the management of relationships with accredited electronic toll service providers;
• toll payment, including the use of the online payment platform;
• activities for the prevention and detection of infringements relating to the obligation to pay tolls pursuant to Article 176 of Italian Legislative Decree 285/1992, as amended;
• communications with the user concerning the use of the service and infrastructure as well as toll transactions and any related requests (payment and recovery of toll credit), exercised by the Company, in its capacity as motorway concessionaire;
• communications with the user regarding safety resulting from the use of the Service and the infrastructure managed by the Company;
• compliance with administrative, tax, and legal obligations applicable to the Company;
• proper execution of the obligations arising from the Service provided to the user, including through the website;
• collection of information for the management of the contractual relationship with the electronic toll service providers;
• at the user’s request, send a reminder and notification e-mail.

3. Legal bases for processing

The legal basis for processing is:

• Legal obligation: need to follow up/execute legal obligations as a motorway concession holder (technical-administrative management and toll collection; requests from competent authorities; user requests; legal publications); pursuant to Art. 6(1)(c) of the Regulation;
• Reasons of public interest: need to properly implement the motorway service, prevention of motorway toll evasion, pursuant to Art. 6(1)(e) of the Regulation;
• Legitimate interest: the need to pursue a legitimate interest of the Company pursuant to Article 6(1)(f) of the GDPR.
• Upon the data subject’s express consent for processing their data to receive reminder emails and notifications of transit, in accordance with Article 6, paragraph 1, letter a) of the GDPR Regulation.

4. Processing methods

Personal Data may be processed in a hard-copy, computerised and digital format and entered in the relevant databases that may be accessed and therefore become known to operators, who may carry out consultation, use, processing, comparison and any other appropriate operation, including automated operations, in compliance with the provisions of the law necessary to guarantee, among other things, the confidentiality and security of the data as well as their accuracy, updating and relevance to the stated purposes, in accordance with the applicable data protection legislation.

5. Nature of data provision

The provision of data is:

1. compulsory to achieve the purposes related to the obligations provided for by laws, regulations or Community legislation, including the regular collection of tolls, including the proper functioning of the free flow collection system;
2. optional, although sometimes necessary for the correct establishment and/or continuation of the relationship with the Company, and for the correct navigation of the site;
3. optional to receive reminders and notifications of completed transit

Any refusal to provide the data or incomplete data may prevent the Data Controller from carrying out its institutional duties and fully delivering the services, as well as from complying with legal obligations.

Please note that the user’s consent to data processing is not required if it relates to the correct use of the motorway service and the consequent payment of the toll.

6. Scope of Data Communication and Place of Processing

Your Personal Data may be communicated, where necessary for the provision of services including the proper management of the toll, to duly authorised and appointed personnel of our Company, to parties required to process such data on behalf of the Company for the same purposes as above, who are, for this purpose, appointed “data processors” pursuant to Art. 28 of the GDPR Regulation, to interconnected concessionary companies (where there is an interconnection), to providers of the European or national electronic toll service in relation to the data of their respective customers (including, unless there are requests for exclusion, transit data, recorded only by reading the licence plate, in the free flow system) to third party companies, including those providing debt collection services on behalf of the Company and/or access control and/or surveillance services, to companies providing IT and plant engineering services in relation to the activities carried out, with whom the Company has entered into special agreements on data processing, as well as to comply with requests from competent Authorities or for the protection of the Company.

The complete lists of persons appointed as “Data Processors” are available from the Company in accordance with Article 28 of the GDPR and can be consulted by sending an e-mail to privacy@asticuneo.it.

The aforementioned areas of communication do not require your authorisation, as they are functional to the provision of the motorway service, to defend a right in court or to pursue a legitimate interest of the Data Controller. For any further communication requiring your prior consent, we will proceed accordingly.

All the aforementioned personal data shall not be disclosed or communicated to unauthorised third parties.

Personal data shall be managed and stored on servers located in Italy or within the European Union and will not be transferred outside the European Union.

7. Data retention period

The Personal Data collected, also taking into account any choices made by the data subjects regarding cancellation or revocation during the course of processing, will be processed for a period corresponding to the needs for which it was collected, in compliance with the applicable legal or regulatory provisions and/or for a period deemed appropriate to ensure the right of defence in the event of litigation or tax compliance, in compliance with the principle of minimisation pursuant to Article 5.1.c) of the Regulation.

8. Controller – DPO

The Data Controller, for all the processing purposes expressed in this information notice, is AUTOSTRADA ASTI-CUNEO S.p.A. with secondary offices in Turin, Via Bonzanigo 22 – 10144, which can be contacted by writing to the address privacy@asticuneo.it.

The Data Controller has also appointed a Data Protection Officer, who can be contacted at the following email address: dpo@asticuneo.it

The Data Processors responsible for debt collection activities on behalf of the Company are NIVI S.p.A. and RO.S.S. S.r.l.

9. Rights of the data subject

You may exercise your rights under Art. 13(2)(b) and Articles 15, 16, 17 18 and 20 of the Regulation at any time by contacting the Data Controller at the contact details provided in this notice.

Specifically, as Data Subject, you have the right to know which personal data is being used, where it came from, to check its accuracy or to request that it be supplemented or updated, or corrected or restricted. You also have the right to request the deletion, transformation into anonymous form or blocking of data processed in breach of the law, as well as to object in any case, for legitimate reasons, to its processing and to modify or revoke previously given consents, without prejudice to the lawfulness of the processing based on the consent given before the revocation.

Furthermore, we inform you that you are entitled to lodge a complaint with the Data Protection Authority, whose contact details you will find at the following link www.garanteprivacy.it

Turin, 14 February 2025