Information note on personal data protection - P+R management
0 results for «»
Personal data protection
Introduction
CFL care about their customers.
Thus, the protection of your personal data naturally constitutes a priority for the CFL, or any entity of the CFL group who has to process your personal data for the purpose of its activities.
This note provides you with the necessary information and explains to you how we collect, use, share, store and protect your personal details. It also informs you on your rights and on how to exercise them.
CFL offer their customers a P+R parking service. In this context, CFL processes your personal data and also offers an application to users of these car parks.
The use of the car parks and the use of this application involve the processing of your data by CFL for the purposes of managing the car parks and the free parking.
Thus, the protection of your personal data naturally constitutes a priority for the CFL, or any entity of the CFL group who has to process your personal data for the purpose of its activities.
This note provides you with the necessary information and explains to you how we collect, use, share, store and protect your personal details. It also informs you on your rights and on how to exercise them.
CFL offer their customers a P+R parking service. In this context, CFL processes your personal data and also offers an application to users of these car parks.
The use of the car parks and the use of this application involve the processing of your data by CFL for the purposes of managing the car parks and the free parking.
1. Who is the controller?
The controller regarding your personal data processed by us is the Société Nationale des Chemins de Fer Luxembourgeois (the CFL), established and having its registered office in L‑1616 Luxembourg, 9, place de la Gare, and registered with the Trade and Companies Register of Luxembourg under number B59025.
As such, we are liable for the way we collect, use, share, store and protect your personal data.
As such, we are liable for the way we collect, use, share, store and protect your personal data.
2. Which categories of personal data are processed and for what purposes?
To provide a P+R parking service, we collect and process the following personal data:
To find the parking lot closest to you, the P+R app allows you to geolocate yourself and thus display the parking lots near your location.
CFL offers free parking if you use soft mobility solutions (public transport, bicycle, walking, etc.). To determine if you are eligible for free parking, CFL need to identify if you have left the predefined zone. To do this, we use the geolocation of your mobile device
Sharing this information allows CFL to verify that you qualify for the free service. In fact, the free service is conditional on the customer using alternative means of travel.
Specifically, CFL collect GPS points proving that you have entered the P+R, left the defined area. However, CFL are not able to trace your route.
If you refuse to process the geolocation, you will not be able to benefit from free parking.
If the application is not used, CFL will process at least the following data:
The purposes are as follows:
- surname, first name,
- e-mail address,
- address,
- phone number,
- your vehicle’s license plate number,
- device ID,
- parking history (date, time of entry and exit),
- financial data (credit card number : CFL only hold the last 4 digits, the other data being processed by the payment service provider),
- geolocation (date, time, GPS points).
- the GPS point of the device then it enters P+R,
- the GPS point when the User is outside of the zone,
- the last GPS point when not leaving the zone.
To find the parking lot closest to you, the P+R app allows you to geolocate yourself and thus display the parking lots near your location.
CFL offers free parking if you use soft mobility solutions (public transport, bicycle, walking, etc.). To determine if you are eligible for free parking, CFL need to identify if you have left the predefined zone. To do this, we use the geolocation of your mobile device
Sharing this information allows CFL to verify that you qualify for the free service. In fact, the free service is conditional on the customer using alternative means of travel.
Specifically, CFL collect GPS points proving that you have entered the P+R, left the defined area. However, CFL are not able to trace your route.
If you refuse to process the geolocation, you will not be able to benefit from free parking.
If the application is not used, CFL will process at least the following data:
- name of user,
- name of the cardholder,
- license plate number with photo ans number,
- date, time of entry and exit o the parking.
The purposes are as follows:
- management of CFL parkings :
- management of user accounts,
- commercial management (tickets, subscriptions, payment, invoicing) of customers,
- management of complaints and disputes,
- debt collection,
- statistics.
3. How do we collect, process and use your data?
We collect and use the personal data you provide us with when using our services.
For each purpose described above, the collection and processing are:
For each purpose described above, the collection and processing are:
- performed in compliance with applicable laws and regulations regarding the protection of personal data,
- legally justified by the fact that it is necessary to process your personal data for the performance of a contract to which you are a party or to take steps at your request prior to entering a contract, or by an interest that is recognised as legitimate.
4. How long do we keep your data?
We keep your personal data for as long as it is needed to provide the service.
Geolocation data are kept for a period of 6 months for the purpose of proof of the billing of the services performed for you, in particular for the purpose of proof of the gratuity.
At the end of each service performed via the application (subscription, one-time payment etc...), the data will be kept for a period of 10 years so that we can fulfill our obligations resulting from the statute of limitations.
The data related to the payment made at the cash desk are kept for 60 days.
Geolocation data are kept for a period of 6 months for the purpose of proof of the billing of the services performed for you, in particular for the purpose of proof of the gratuity.
At the end of each service performed via the application (subscription, one-time payment etc...), the data will be kept for a period of 10 years so that we can fulfill our obligations resulting from the statute of limitations.
The data related to the payment made at the cash desk are kept for 60 days.
5. Who can access your data?
We make sure to take any appropriate technical and organisational measures to ensure the security of your personal data, in particular their confidentiality, integrity, and availability.
The data will be shared with some of our internal departments in strict compliance with the missions these departments have been entrusted with:
Some IT providers may have access to specific personal data in the framework of maintenance tasks carried out upon the request of the competent services of the CFL
We contractually impose on our service providers to safeguard the security and the confidentiality of your personal data by means of appropriate technical and organisational measures such as standard contractual clauses, in accordance with European regulations and ensure that these guarantees are respected.
CFL also use a payment service provider (Wordline) which allows you to make payments by bank card without CFL having access to your bank details apart from the last 4 digits of your bank card.
The data will be shared with some of our internal departments in strict compliance with the missions these departments have been entrusted with:
- Directorate for Travel Activities (Direction Activités Voyageurs),
- Directorate for Administration and Finance (Direction Administratif et Financier),
- Unit Legal affairs and Insurances (Division Juridique et Assurances).
Some IT providers may have access to specific personal data in the framework of maintenance tasks carried out upon the request of the competent services of the CFL
We contractually impose on our service providers to safeguard the security and the confidentiality of your personal data by means of appropriate technical and organisational measures such as standard contractual clauses, in accordance with European regulations and ensure that these guarantees are respected.
CFL also use a payment service provider (Wordline) which allows you to make payments by bank card without CFL having access to your bank details apart from the last 4 digits of your bank card.
6. What are your rights regarding your personal data?
Under the conditions foreseen by regulation, you can:
- access to the personal data we hold on you,
- have the data rectified if they are inaccurate or incomplete,
- have the data erased, in some cases, such as, for example, each time your data are not necessary for the intended purpose, and we do not have the contractual or legal obligation to keep them,
- ask for the restriction of the processing of your personal data, such as the restriction of the processing of an item whose accuracy you deny and for the time we need to verify your request,
- ask for the portability of your personal data in order to have your personal data transmitted to you in a structured, commonly used and readable format, or to have it transmitted to another controller,
- withdraw your consent to the processing of your personal data at any time (unless the processing is based on a legal ground other than your consent), without affecting the lawfulness of the processing based on your consent given before its withdrawal,
- object to the processing of your data based on the sole pursuit of our legitimate interests and prohibit us from processing them, including for direct marketing,
- file a complaint with the authority in charge of the protection of personal data in your country and/or in the Grand Duchy of Luxembourg (Commission Nationale pour la Protection des Données – CNPD, established in 15, boulevard du Jazz, L 4370 Belvaux – https://cnpd.public.lu/en).
7. How to contact us and how to exercice your rights?
You may address your questions relating to the processing of your personal data and/or a request regarding the exercise of your rights mentioned above to the Data Protection Officer (DPO) of the CFL:
- on our website www.cfl.lu by clicking on the link gdpr.cfl.lu,
- or by regular mail for the attention of the Data Protection Officer (DPO), Société Nationale des Chemins de Fer Luxembourgeois (CFL), 9, place de la Gare – L 1616 Luxembourg.