Privacy Policy for Motorway Users

In compliance with the obligations set forth by EU legislation (European Data Protection Regulation No. 679/2016) and national legislation (Legislative Decree No. 196 of 30 June 2003, Personal Data Protection Code including subsequent amendments)

Dear user,

We hereby inform you that, pursuant to Articles 13 and 14 of EU Regulation 679/2016 on personal data protection (hereinafter referred to as the “GDPR Regulation”), the information and data collected by and/or communicated to Autostrada dei Fiori S.p.A. (hereinafter also referred to as the “Company” and/or the “Data Controller”) will be processed in accordance with the aforementioned GDPR Regulation and Legislative Decree No. 196/2003 (Privacy Code), as last amended.

This privacy notice is intended for all users who interact with the Company, whether directly or through its official website and/or the complaints platform.

1. Types of data collected

The Company may collect certain personal data including (but not limited to) name, surname, date of birth, address, gender, nationality, e-mail address, and other data (hereinafter referred to as “Personal Data”) that may be necessary for the management of the motorway service and other services generally provided through the Company’s website (hereinafter referred to as the “Service” or the “Services”).This may also include photographic images of vehicle number plates (captured by cameras located at toll stations), relevant for the toll payment due and/or in cases of anomalies detected in toll station access lanes.

Please note that the images taken by the cameras (if any) do not permit the identification of the persons on board the vehicles in any way.

Moreover, the Company wishes to inform you that, in order to provide quality Services and carry out all relevant assessments in case of complaints, in full compliance with Resolution 132/2024 of the Italian Transport Regulatory Authority (ART) and the Privacy Policy in force, it will record all phone calls to the users call centre. Any data provided through such recordings falls into the Personal Data category, as specified above.

Personal Data may be submitted voluntarily by the user while browsing the Company’s website or may also be collected during the use of the Service if conditions exist that necessitate their collection (e.g., correct toll allocation, complaints, accidents, etc.). The Company’s cookie policy can be found at the following link: https://www.autostradadeifiori.it/cookies/.

The user is responsible for the accuracy and truthfulness of Personal Data, including that of third parties, provided through the website or other means made available by the Company, relieving the Data Controller from any liability arising from inaccuracies in the data provided.

2. Purpose of processing

The processing of Personal Data collected – including all recordings of user phone calls to the call centre provided by the Company – is intended for the proper management of the Service, with specific reference to the obligations arising from the user’s use of the Service and related to the functions carried out by the Company in an institutional capacity. Such purposes include:

• calculation and toll allocation, including the acquisition of data to manage the relationships with accredited electronic toll service providers;
• communications with the user concerning toll transactions and any related requests (payment and recovery of toll credit), managed by the Company as Concession Holder of the A4 Turin-Milan motorway section, even through the call centre made available to users and the complaints platform;
• guarantee of provision of a quality service, pursuant also to Resolution 132/2024 – ART, and assessment and management of any complaints received, even through the complaints platform;
• activities for the prevention and detection of infringements relating to the obligation to pay tolls pursuant to Article 176 of Italian Legislative Decree 285/1992, as amended;
• user communications, including those forwarded through the relevant call centre, concerning safety, traffic, and use of the infrastructure managed by the Company;
• compliance with the administrative, tax, and legal obligations generally applicable to the Company;
• proper execution of the obligations arising from the Service provided to the user, including through the website and the call centre;
• interventions on the website.

3. Legal bases for processing 

The legal bases for processing are:

• Legal obligation: the need to follow up/execute legal obligations as a motorway concession holder (technical-administrative management and toll collection; requests from competent authorities; user requests/complaints; legal publications); pursuant to Article 6(1)(c) of the GDPR Regulation;
• Reasons of public interest: need to properly implement the motorway service, prevention of motorway toll evasion, pursuant to Article 6(1)(e) of the GDPR Regulation;
• Legitimate interest: the need to pursue the legitimate interest of the Company of collecting motorway tolls and using the motorway infrastructure it manages properly, pursuant to Article 6(1)(f) of the GDPR;
• Data Subject’s consent: expressly provided pursuant to Article 6(1)(b) of the GDPR, and concerning the recording of phone calls to the call centre made available by the Company, for the purposes specified above.

4. Processing methods

Personal Data may be processed in a hard-copy, computerised and digital format and entered in the relevant databases that may be accessed and therefore become known by operators, who may carry out consultation, use, processing, comparison and any other appropriate operation, including automated operations, in compliance with the provisions of the law necessary to guarantee, among other things, the confidentiality and security of the data as well as their accuracy, updating and relevance to the stated purposes, in accordance with the applicable data protection legislation (including the GDPR Regulation and the Legislative Decree No. 196/2003).

5. Nature of data provision

The provision of data is:

1. a) Mandatory for achieving the purposes related to the obligations set forth by laws, regulations, or EU regulations, including the proper collection of the toll.
2. b) Optional, although sometimes necessary for the correct establishment and/or continuation of the relationship with our Company, and for the correct navigation of the site.

Any refusal to provide the data or incomplete data may prevent the Data Controller from carrying out its institutional duties and fully delivering the services, as well as from complying with legal obligations.

6. Scope of data communication

Your Data may be shared, where necessary for the provision of Services, with the designated and authorised personnel of our Company, with entities required to process such data on behalf of the Company for the same purposes stated above, who are appointed as “Data Processors” pursuant to Article 28 of the GDPR Regulation, with interconnected concessionary companies, with providers of the European or national electronic toll service in relation to the data of their respective customers, with third party companies, including those providing debt collection services on behalf of the Company and/or access control and/or surveillance services, and with companies providing IT and plant engineering services in relation to the activities carried out, with whom the Company has entered into special agreements on data processing, as well as to comply with requests from competent Authorities and for the protection of the Company.

The full list of entities designated as Data Processors pursuant to Article 28 of the GDPR can be requested from the Company by sending a formal request to the following email address:  privacy@autostradadeifiori.it.

The aforementioned areas of communication do not require your authorisation, as they are functional to the provision of the Services, to defend a right in court or to pursue a legitimate interest of the Data Controller. For any further communication requiring your prior consent, we will proceed accordingly.

All the aforementioned Personal Data shall not be disclosed or communicated to unauthorised third parties.

Personal Data shall be managed and stored on servers located in Italy or within the European Union and will not be transferred outside the European Union.

7. Data retention period

The Personal Data collected, also taking into account any choices made by the data subjects regarding cancellation or revocation during the course of processing, will be processed for a period corresponding to the needs for which it was collected, in compliance with the applicable legal or regulatory provisions or for a period deemed appropriate to ensure the right of defence in the event of litigation or for tax obligations, in compliance with the principle of data minimisation set out in Article 5, paragraph 1, letter c) of the GDPR Regulation.

8. Data Controller – DPO

The Data Controller is Autostrada dei Fiori S.p.A., located in Imperia, at Via della Repubblica 46 – 18100, and can be contacted at the following email address: privacy@autostradadeifiori.it.

The Data Controller has also appointed a Data Protection Officer (“DPO”), who can be contacted at the following email address: dpo@autostradadeifiori.it.

The Data Processor responsible for debt collection activities on behalf of the Company is NIVI S.p.A.

9. Rights of the data subject

You may exercise your rights at any time as outlined by Article 13, letter b) and Articles 15, 16, 17, 18, and 20 of the GDPR by reaching out to the contact details provided in this privacy policy.

Specifically, as Data Subject, you have the right to know which personal data is being used, where it came from, to check its accuracy or to request that it be supplemented or updated, or corrected or restricted. You also have the right to request the deletion, transformation into anonymous form or blocking of data processed in breach of the law, as well as to object in any case, for legitimate reasons, to its processing and to modify or revoke previously given consents, without prejudice to the lawfulness of the processing based on the consent given before the revocation. Furthermore, we inform you that you have the right to object to the processing of your data at any time, in accordance with Article 21 of the GDPR, by sending an email to privacy@autostradadeifiori.it.

Furthermore, we inform you that you are entitled to lodge a complaint with the Data Protection Authority, whose contact details you will find at the following link www.garanteprivacy.it/

Autostrada dei Fiori S.p.A.

Last updated: March 2025