Data protection policy

Special Conditions - Protection of Personal Data

These Special Conditions supplement the General Conditions of Use (“GCU”) of the Site, accessible here: xxxx {html link to the “GCU” page}

The Publisher is responsible for the processing of personal data carried out by the Site. You will find the Publisher's contact details here: xxxx {html link to the "legal notices" page}

When we act as a public service concessionaire for the provision of our transport services, we may act as a subcontractor of the grantor (the “Grantor”), here: xxxx {html link to the grantor/organising authority’s website page} which is in this case the data controller.

These Special Conditions are intended to inform you about the purposes and conditions under which we are required to process data concerning you as well as to identify and allow you to exercise the rights that you hold over this data.

When you access the Site or as part of the provision of our services, we may collect and process personal information about you to meet the objectives indicated in the following table:

Purposes for which data may be processed Categories of data processed * Main legal basis for processing

Account creation; account access management (online)
  • identification data (name, first name, date of birth, username, password, technical identifiers, email address, telephone number);
  • connection logs
 Performance of a Contract (Terms of Use)

Complaint management, lost and found management, information request management
  • identification data (name, first name, title, telephone number, email)
  • personal data (nature of the request, details of the request, response provided, date of exchanges, resolution indicators)
 Your consent

Audience management and traffic or usage measurement; improvements to our tools and services
  • technical data (IP addresses, technical identifiers, geolocation)
  • rowsing data (pages visited, services used)
 Your consent

Management of information and disruptions in public transport
  • identification data (name, first name, email address, telephone number)
  • data relating to favorites (lines, stops, places, routes, mode of transport, network)
 Your consent

Newsletter management, participation in promotional activities, measurement of user satisfaction
  • identification data and preferences
  • communication data (nature of communication, date of event, monitoring indicators)
 Your consent

Measuring and improving the quality of our services and those of suppliers
  • identification and contact data,
  • connection or usage data for the services concerned,
  • evaluations
 Legitimate interest of the data controller

Management of purchases of transport tickets and other products or services
  • identification data,
  • data relating to the nature of purchases,>
  • payment data
 Performance of a contract with you
Validation of transport tickets
  • identification data,
  • location data, timestamp
  • technical data>
 Legitimate interest of the data controller

Fraud management, fine management
  • identification data,
  • location data, timestamp
  • Fine number, date of birth, nature of offences, amount, deadlines, procedural steps,
  • payment method data
 Legitimate interest of the data controller

Ensuring the security of information systems
  • identification data,
  • technical and usage data
 Legitimate interest of the data controller

Recruitment management
  • identification data,
  • CV (contact details, training, professional experience, etc.)
 Your consent

Attendance measurements>
  • communication medium data (MAC address)
  • données de localisation, horodatage
 location data, timestamp

(*) the types of data indicated in parentheses allow you to identify examples of data processed during the processing considered; these examples are not exhaustive.

When you access or use certain services, we may provide you with additional or specific information relating to the data processing implemented for these services.

Some data concerning you may be provided to us by our Licensor or by partners.

Unless we obtain your specific consent, we will not communicate or make available to third parties any data concerning you for the purposes of commercial or promotional prospecting for third-party products or services.

Where processing is based on your consent, you are reminded that your consent may be withdrawn at any time.

No decision with legal effects against you is taken by exclusively automated processing.

Some data collected is required to be able to access our Services and those of our

partners. In this case, the required fields or information are indicated to you for this purpose. If you choose not to provide certain required personal data, we may not be able to provide you with the services you have requested or to fulfill the purposes for which we process personal data.

Additionally, we may publish, disclose and use aggregated information (information about all users or specific groups or categories of users combined in such a way that an individual user can no longer be identified or referenced) or non-personal information for industry and market analysis, demographic profiling, promotional and advertising purposes and other business purposes.

Retention periods

Your data is only kept for the period necessary to fulfill the purposes for which it was collected.

Please be advised that the general principles of data retention are:

  • data relating to the management of your requests and complaints may be kept until the end of two calendar years from their collection;
  • data relating to purchasing management may be retained for five calendar years from the date of their collection;
  • data relating to cookie management may be retained for a period of 6 months from their collection;
  • data relating to recruitment management may be retained for a period of two calendar years ending from the date of their collection;

Certain specific data processing operations that we implement may have different retention periods, in particular if their retention is made necessary by a legal obligation or to allow us to exercise our rights.

If you would like to obtain more details on the retention rules specific to a given processing operation, you can contact our Data Protection Department and/or the Data Protection Officer (contact details below).

Security and data transfers

In accordance with current regulations, we take the necessary measures to ensure that personal information is protected in terms of its security, integrity and confidentiality.

Any transfers of data are carried out in accordance with the regulations, and are governed in particular by the standard contractual clauses established by the European Commission.

We may communicate, for the purposes specified above, information concerning you to other companies of the Transdev Group and to our subcontractors and service providers; some of these companies may be located outside the European Union and outside countries recognized by the European Union as having laws guaranteeing adequate protection of personal data.

Information concerning you may be communicated to any person or public or private entity, in particular administrations or professional bodies, when this communication is provided for by law or regulation.

We may also process information about you for the purposes of managing and monitoring compliance with our internal policies and procedures, auditing or to administer, manage or defend against claims or legal actions.

In the event that we are involved in a merger, acquisition, sale of assets or bankruptcy proceedings, we may be required to transfer or share all or part of our assets, including personal data.

In the event of termination of the public service concession, or during the term in the event of an audit, data concerning you will be communicated to the grantor of the transport service designated in the preamble.

Exercise of rights

In accordance with the regulations, you can exercise your rights of consultation, rectification, opposition, deletion, limitation of processing and portability, under the conditions of the applicable regulations, on your personal data that we may hold, by sending a request stating your surname, first name, address and attaching a copy of proof of identity, by the means of your choice:

  • By post to: xxxxx
  • By email to: xxxx@xxxx.com

If necessary, you can also send your request to the Transdev Group Data Protection Officer (Group DPO) at the following address dataprivacy@transdev.com.

For any request relating to data processing implemented within the framework of video protection, please specify the line number, stops and time slot.

You can also send the Data Protection Department your instructions regarding the fate of your personal data in the event of death, and in particular the manner in which you wish the aforementioned rights to be exercised.

In general, the Data Protection Officer and the Data Protection Department remain at your disposal for any additional information or complaint relating to the processing of personal data that we implement. We undertake to respond to you as soon as possible, in accordance with the deadlines imposed by the applicable regulations.

Please be informed that the supervisory authority in France for data processing is the National Commission for Information Technology and Civil Liberties, www.cnil.fr, from which you can request any information or submit a possible complaint.

Updates and modifications to the Specific Conditions

We reserve the right to modify these Special Conditions on our processing of personal data at any time. Their effective date is mentioned at the beginning of the text. Please refer to them periodically and in particular each time you provide us with personal information.