Foreword
This Privacy Policy governs how SANEF Group processes the Personal Data of Customers and Visitors, in accordance with the Applicable Regulations.
This Privacy Policy does not cover the Processing carried out by Bip & Go which is subject to its own specific privacy policy available at https://www.bipandgo.com/en/privacy-policy nor the Processing carried out by the entities of the SANEF Group entities when acting as a Data Processor on behalf of another Data Controller.
In the event of any discrepancy or inconsistency between the French and English versions of this Privacy Policy, the French version shall prevail.
1. Definitions
For the purposes of this Privacy Policy, the following terms and expressions shall have the meanings set out below:
“Agents”: refers to employees of the SANEF Group processing Personal Data or whose Personal Data is processed in the course of carrying out the tasks assigned to them.
“Customer”: refers alternatively to:
- Any person using the “Motorway Network”, and/or
- Any person who has subscribed to the Services offered by SANEF Group.
“SANEF Customer Account”: refers to the secured area of the Website where the Customer may enter their Personal Data and benefit from various Services made available to them.
Among the Services offered, in particular concerning the Free Flow Tolling, Customers may access to:
- Automatic payment through the association of a license plate and payment method,
- Details of journeys on a Free-Flow toll motorway,
- Email notifications sent after each Free-Flow toll passage
- The history of information related to registered vehicles and payment methods,
- An online contact form to ask any questions related to Free-Flow tolling and your journeys.
For all those who have not created a SANEF Customer Account, the online contact form is also available from the Website homepage.
“Cookie”: refers to text files issued by the Website publisher and stored on the hard drive of the connection terminal (computer, smartphones, tablets, etc.), or any similar tracking technology. They allow, in particular, the identification of a Customer upon login and the storage of the Customer’s usage preferences for future visits.
“Data”: refers to a specific set of information collected in order to carry out a Processing.
“Personal Data”: refers, in accordance with Article 4(1) of the GDPR, to information relating to an identified or identifiable natural person.
“Location Data”: refers to any data processed in an electronic communications network indicating the geographical position of the terminal equipment of a user of a publicly accessible electronic communications service, as referred to in Article 2 (c) of the “E‑Privacy” Directive concerning the processing of Personal Data and the protection of privacy in the electronic communications sector.
“Free-Flow”: refers to SANEF Group’s motorway routes without physical toll barriers. The Free Flow enables the automatic detection of each vehicle travelling on the motorway and associates it with the toll fee owed based on the journey made. It operates using a series of equipment installed on gantries above the traffic lanes.
“SANEF Group”: refers without distinction:
- SANEF: Limited Company with a share capital of 53,090,461.67 Euros, registered with the Nanterre Trade and Companies Register under number 632 050 019, whose registered office is located at 30 Boulevard Gallieni 92130 Issy-les-Moulineaux; and/or
- SAPN: Limited Company with a share capital of 14,000,000 Euros, registered with the Nanterre Trade and Companies Register under number 632 054 029, whose registered office is located at 30 Boulevard Gallieni 92130 Issy-les-Moulineaux.
“Partners”: refers to any professional, established, potential or future and more generally any person with whom the company has a business relationship.
“Applicable Regulations”: collectively refers to:
- The European Union's General Data Protection and Privacy Regulation No. 2016/679 (“GDPR”);
- Directive 2002/58/EC on privacy and electronic communications (“E‑Privacy Directive”) and any additional legislation or regulation replacing the E-Privacy Directive ;
- Any current or future personal data protection law or regulation that may be applicable to SANEF Group due to its Data Processing activities or its place of establishment and necessarily including the French Law No. 78-17 “Informatique et Libertés” as amended;
- Guidelines or opinions adopted by the former “Article 29 Working Party” on Data Protection or by the European Data Protection Board regarding interpretation and application of the GDPR and the E‑Privacy Directive;
- Judgments handed down by the Court of Justice of the European Union or the European Court of Human Rights concerning Personal Data and privacy protection as well as freedom of expression or information;
- Decisions rendered by an authorized judicial or administrative authority binding on SANEF Group due to its Data Processing activities or its place of establishment;
- Any applicable amendments to the Regulations, Directives, laws, or decisions mentioned above.
“Motorway Network”: refers to the motorway network granted by the French State to SANEF and SAPN to ensure its operation. The motorways concerned are the following: A1 – A2 – A4 – A13 – A14 – A26 – A29 – A131 – A132 – A139 – A140 – A150 – A151 – A154 – A314 – A315 – A813 – TUR.
The relevant motorway sections are defined by the operating regulations. It also includes service areas of the A25, A31, and as well as the La Courneuve service areas on the A1 motorway.
“Services”: refers to the services provided to Customers and Visitors on the Websites or outside the Websites (in commercial agencies, on payment terminals, at toll stations plazas, at service areas, etc.) and on its mobile and computer applications, but excludes services explicitly provided under another privacy policy.
“Websites”: refers to SANEF Group websites accessible at www.sanef.com, www.groupe.sanef.com and www.autoroutes.sanef.com, or any address that may be substituted or via any redirection URL, including all the pages and sections of which it is composed. The terms and conditions of use of the Websites are set out in the terms and conditions of use available at: https://www.sanef.com/client/sanefApi/downloadCgu
“Processor”: refers to any legal person, public authority, agency, or other body that processes Personal Data on behalf of and under the instructions of SANEF Group, pursuant to Article 4(8) of the GDPR.
“Processing/To Process”: refers to any operation or set of operations, as defined in Article 4(2) of the GDPR, performed on Data or sets of Personal Data, whether or not by automated means.
“Personal Data Breach”: refers, under Article 4(12) of the GDPR, to any breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise processed.
“Visitor”: refers to any person accessing the Websites.
2. General Information Regarding the Websites
The Websites are the property of SANEF, a limited company (SA) with a share capital of €53,090,461.67, whose registered office is located at 30 boulevard Gallieni, 92130 Issy-les-Moulineaux (RCS NANTERRE 632 050 019).
The publishing director is Mr. Arnaud QUEMARD, Chief Executive Officer of SANEF.
The Websites are hosted on SANEF’s servers. All data accessible to Customers, or Visitors are provided for informational purposes only and may not be used for commercial purposes.
SANEF Group has no means to verify the accuracy of the information provided by the Customer when creating an account on the Websites. Consequently, SANEF Group cannot be held liable for false statements or identity theft. The Customer undertakes to provide accurate information to SANEF Group and to update it when necessary.
The law makes any person guilty of fraud or false statements liable to fines and imprisonment (in particular Articles 226-1, 226-4-1, 313-1, 441-1 and 441-7 of the French Criminal Code).
3. Data Collected When Using the Motorway Network
3.1 Video surveillance Activities
As part of managing video surveillance activities on public roads, SANEF Group collects images of vehicles and individuals, as well as data related to toll passages.
Data is retained for a maximum of 6 days from the time the video is taken. Once this period has expired, video surveillance images are automatically deleted.
Video footage relating to toll fraud is retained for a maximum of 1 month.
However, Data may be kept for a longer period of time in the context of legal proceedings and in accordance with the Applicable Regulations.
3.2 Tolling
Use of the Motorway Network involves the operation of computer and video systems and therefore the collection and Processing of Personal Data.
Two methods of toll collection are implemented by the SANEF Group:
- Traditional toll stations,
- Free-Flow tolling, implemented exclusively on motorways A13 and A14 (SAPN network) and at the North and South toll points of interchange No. 38 at BOULAY/VARIZE on the A4 motorway (SANEF network).
3.2.1 Common Provisions
As part of the management of toll transactions and events, SANEF Group collects Data relating to the toll passage point, the payment method, and vehicle identification (including images of the vehicle profile allowing verification of its classification).
If a toll tag is present and detected in the vehicle, Data collected includes the toll tag identifier. This Data enables identification of the toll tag holder and payment of the toll.
In the event of a payment incident or payment by cheque, SANEF Group processes Data relating to the identification of the driver and the vehicle owner.
SANEF Group may also collect Personal Data indirectly:
- For subscribers to the Liber-t Bip&Go electronic toll payment service, via other motorway concession companies and car park operators in order to establish a single invoice for their journeys on the entire motorway network and invoice the amount corresponding to the journey actually made on a network shared with another motorway concession company,
- Where applicable, from other toll tag issuers to enable the Customer to pay the amount of the journey made on the SANEF Group's network, in accordance with the contractual conditions that bind the Customer to the issuer.
3.2.2 Toll Stations – Special Cases
a. Beauvais Bypass via the A16
The Beauvais Urban Community “Communauté d’Agglomération de Beauvais” has set up an offer allowing Customers with a toll tag, travelling between Beauvais Nord and Beauvais Centre (regardless direction), to benefit from a full reimbursement of this journey (hereinafter the “Reimbursement Scheme”).
In this context, Customers eligible for the Reimbursement Scheme must complete a subscription form for the offer on the website of the Beauvais Urban Community website “Communauté d’Agglomération de Beauvaisis”: www.beauvaisis.fr
Within the framework of the Reimbursement Scheme, the purposes of the Processing carried out by SANEF Group are limited to the establishment and transmission to the Beauvais Urban Community:
- The toll tag numbers of Customers who meet the eligibility conditions for the Contournement Beauvais via A16;
- The reimbursement amount for each of the said Customers;
- Any subscription fees for the Liber‑t Bip&Go tag;
for the sole purpose of allowing the Beauvaisis Urban Community to issue the corresponding reimbursements to Customers.
Other Personal Data Processing carried out under the Reimbursement Scheme is the responsibility of the Beauvaisis Urban Community, including:
- Processing the Personal Data of Customers wishing to benefit from a refund from the subscription form;
- Verifying and checking the eligibility conditions of the above-mentioned Clients;
- Communicating to SANEF Group the toll tag numbers of Customers subscribing to the Reimbursement Scheme;
- Proceeding with the reimbursement;
- Managing claims and, more generally, customer relationship within the framework of the Reimbursement Scheme.
The terms and conditions of such processing (legal basis, purposes, retention period, list of processors, security measures, etc.) are determined solely by the Beauvaisis Urban Community in accordance with the Applicable Regulations.
Requests to exercise rights arising from the above processing shall be handled by the Beauvaisis Urban Community at the following address:
Data Protection Officer, Communauté d'Agglomération du Beauvaisis, 48 rue Desgroux, 60000 Beauvais or [email protected]
b. Pass‑Amiens Subscription
SANEF Group and Amiens Métropole Urban Community have set up an offer allowing Customers residing in one of the municipalities of the Amiens Métropole Urban Community to benefit from a reimbursement scheme corresponding to 70% of the first 12 journeys, already discounted by SANEF Group under the “Fréquence +” offer (hereinafter the “Pass‑Amiens Offer”).
As part of this scheme, eligible Customers must complete a application form on the Amiens Métropole Urban Community website at the following address: https://www.amiens.fr/Actualites/Rocade-deposer-sa-demande-de-remboursement
Under the Pass‑Amiens Offer, the purposes of the Processing carried out by SANEF Group are limited to preparing and transmitting to the Amiens Métropole Urban Community:
- The toll tag customer number of Customers who meet the eligibility conditions for the Pass‑Amiens Offer;
- The amount of the applicable subsidy for each of the said Customers;
solely for the purpose of enabling the Amiens Métropole Urban Community to pay the corresponding subsidy to Customers.
Other Personal Data Processing carried out as part of the Pass‑Amiens Offer is the responsibility of the Amiens Métropole Urban Community, namely:
- Processing the Personal Data of Customers applying for the subsidy via the subscription form;
- Verifying and checking the eligibility conditions of the concerned Customers;
- Communicating to SANEF Group the customer number of the eligible Customers so that SANEF can identify the journeys covered by the subsidy;
- Issuing the subsidy payment;
- Handling complaints and, more generally, managing customer relations in connection with the subsidy.
The terms and conditions of the said processing (purposes, retention period, management of rights requests, list of processors, etc.) are determined exclusively by the Amiens Métropole Urban Community, under its sole responsibility and in accordance with the Applicable Regulations.
Requests to exercise rights resulting from the above processing shall be handled by the Amiens Métropole Urban Community at the following email address: [email protected], or by postal mail at:
DPO – Amiens Métropole – Place de l'Hôtel-de-Ville – BP 2720 – 80027 Amiens CEDEX 1.
3.2.3 Free‑Flow Tolling
SANEF Group processes the following Personal Data as part of the barrier‑free tolling system known as “Free‑Flow”.
3.2.3.1 Passage through the North and South toll points of interchange No. 38 at Boulay/Varize on the A4 motorway
SANEF, acting as Data Controller, operates a Free‑Flow tolling system for the North and South toll points of interchange No. 38 at Boulay/Varize on the A4 motorway.
For more information on Free‑Flow at these toll points:
https://www.autoroutes.sanef.com/en/assistance/boulay/how-boulay-works
a. When passing through the toll passage
For each vehicle passing through the toll passage/crossing, the following Data is collected and processed in the toll system to manage transactions and events and to combat fraud and unpaid tolls:
- Front and rear license plate numbers;
- Vehicle category;
- Timestamp and location of passage;
- Electronic toll tag data for subscribers, if present, for billing purposes;
- Context photos.
b. When paying for the toll passage
The Customer may pay for their toll passage online or at payment terminals and must provide the vehicle’s license plate number for this purpose. They may also provide information relating to title, surname, first name, email address, and telephone number to benefit from SANEF’s alert Services.
When paying online or at payment terminals, bank card data is processed (bank transaction identifier compliant with EMV standards, authorization number if required, etc.).
c. “Info Passage” Alert Service
The "Info Passage" alert Service offered by SANEF : “Info Passage” service , Boulay toll, allows Customers to receive passage notifications and/or payment reminders.
When subscribing to this Service, Customers provide their Personal Data including title, surname, first name, email address and telephone number.
Once the subscription is completed, Customers will receive:
- On D+1 after their passage: a notification informing them of the passage, the 10‑day payment deadline, and available payment solutions;
- On D+8: a payment reminder notification.
Customers may benefit from the Service without having paid their passage beforehand. In this case, in order to protect the confidentiality of the information generated by the Service, SANEF reserves the right to request a copy of an identity document and/or vehicle registration certificate. These copies will be deleted once the customer service representative has verified the submitted information.
d. Anti‑fraud measures
In the context anti-fraud, SANEF Group collects photos of front and rear license plates and data obtained through access to the Vehicle Registration System (“SIV”).
Data is retained for up to 1 year from the time the infringement file is transmitted to the competent authorities.
3.2.3.2 Free‑Flow tolling on the Paris–Normandy motorways (A13 – A14)
SAPN, acting as Data Controller, operates a barrier‑free tolling system (“Free‑Flow”) on the Paris–Normandy motorways (A13 – A14) under the trade name “SANEF Normandie”.
To find out more about the Free‑Flow on the Paris–Normandy (A13 – A14) :
Le péage en flux libre sur l’axe Paris‑Normandie (A13 – A14)
a. Categories of Personal Data
In the context of the Free Flow system, only Personal Data that is strictly necessary for the service is collected.
For the purposes of detecting, calculating, and paying the toll, the following categories of Personal Data are collected when the vehicle passes under the gantry or during online payment:
- Vehicle data: vehicle photo and context, toll tag number detected in the vehicle, front and rear license plate photos, vehicle category, etc.;
- Passage data: timestamp of passage, location, lane position, direction, etc.;
- Payment data: information relating to bank or credit cards and payment data.
Personal Data relating to a vehicle is automatically collected when the vehicle passes under gantries equipped with ANPR (Automatic Number Plate Recognition) cameras. These cameras capture only images of the passage. Optical character recognition is used to read the vehicle’s license plate. The gantry-mounted cameras also enable automatic determination of the vehicle class.
A key difference from traditional tolling is the systematic collection of the license plate number, which is essential to associate a toll passage with a vehicle via automated analysis. If the plate cannot be read automatically, an authorized operator will perform a manual review. In case of questions or disputes concerning passage qualification, the Customer may file a complaint with Customer Service.
When subscribing to or using the website www.autoroutes.sanef.com/en, the categories of Personal Data collected include:
- Personal Data relating to toll payment for Customers paying online, such as vehicle, passage, and payment method information;
- Personal Data necessary to create a SANEF customer account for Customers who choose to do so, such as email address, last name and first name;
- Personal Data relating to customer account management, such as transaction history or subscription to optional Services (e.g., “toll payment notification” as mentioned in section 3.2.3.2.d, or “facilitating Free‑Flow toll payment” as mentioned in section 3.2.3.2.e);
- Vehicle registration certificate data, particularly for authenticating the vehicle owner or applying pricing associated with vehicles adapted for persons with reduced mobility;
- Data from the registration certificate, insurance certificate, rental contract (LOA or LLD), order form for a vehicle purchased less than one month ago, sworn statement from the employer, in particular for the authentication of the vehicle owner. This Data is subject to automated processing using an optical character recognition device allowing the extraction of only necessary Data to check the validity of the document. A manual review is implemented when the main control does not provide a sufficiently reliable conclusion that the validity of the document has been verified.
- Personal Data relating to Customer inquiries and complaints addressed to SAPN via the various Customer Service communication channels.
b. Retention Periods for Personal Data
Depending on the purposes described above, Personal Data is retained for no longer than necessary for each Processing activity, in accordance with the Applicable Regulations, particularly those relating to statutory limitation periods.
License plate data and images are retained for 13 months from the date of payment.
Payment method data is deleted once the transaction has been completed. In the case of payment by bank card, this data is retained for evidentiary purposes in the event of a dispute, in intermediate archives, for a maximum period of 15 months from the transaction. This Data may be retained for a longer period as a regular payment method, subject to obtaining the explicit consent of the Customer. This consent is collected via a checkbox and may be withdrawn at any time.
Personal identification Data is deleted 6 months after the closure of the Customer Account. Furthermore, if no login to SANEF Customer Account or use of any Service is observed within a 24‑month period, the Customer Account will be closed after a notice period.
c. Installation of Gantries for Free‑Flow Tolling
The commissioning process for each Free‑Flow gantry requires installation operations and verification of the proper functioning of the equipment and systems.
During the installation of Free‑Flow gantries on motorways A13/A14, activation of detection equipment is necessary to verify the proper functioning of the gantries and interface systems, and to ensure correct configuration and calibration of systems and databases.
System and database checks are also carried out to verify proper operation and configure the associated application settings.
These operations require the collection of Data associated with vehicles for the purposes of testing, analysis, adjustment, performance optimization, and configuration of detection equipment, gantry controllers, and associated systems (technical back office).
Customer Data (identification, contact details, payment method, infringement record, etc.) required to verify the operation of customer‑relationship systems (commercial back office) is fictitious or pseudonymized.
The categories of data subjects are Customers on motorways A13 and A14 passing under the relevant Free‑Flow gantry.
The necessary Data is retained in accordance with the Applicable Regulations and only for the time strictly necessary to commission the Free‑Flow detection gantries.
d. “Toll Payment Notification” Service
After registering their license plate number in their SANEF Customer Account, the Customer may receive, no later than the day after passing through a Free‑Flow toll section, an email alert informing them of tolls pending payment if the payment has not yet been made.
The passage alert includes the license plate number, the motorway used and the date of the journey.
The Service is available on www.autoroutes.sanef.com and can only be activated on one license plate number.
To benefit from the Service, the Customer must provide the following Data:
- A license plate number.
The license plate number will be retained for as long as SANEF Customer Account remains active and will be deleted within 6 months following closure of SANEF Customer Account.
The legal basis for this Processing is the Customer’s consent.
e. “Simplify the Payment of Your Free‑Flow Toll” Service
This Service allows Customers to register one or more license plate numbers, one or more payment method, and activate (or not) automatic toll payment by associating a license plate with a payment method.
The registered payment method may be a bank card or an accredited card.
The Customer may choose to pay for their tolls automatically or to trigger one‑off payments for pending tolls associated with a registered license plate.
To benefit from this Service, the Customer must register in their SANEF Customer Account:
- One or more license plates,
- One or more payment methods
- For the automatic payment Service, the association of a payment method with a license plate, the Customer must also provide a supporting document to access the Service (vehicle registration certificate, employer certificate, rental agreement, etc.).
This Data is retained for as long as SANEF Customer Account remains active. Once the SANEF Customer Account is closed, Data relating to the payment method is retained for 1 month.
The supporting document is retained for the duration of the validity check and no longer than 1 week after being provided. After this period or once the verification is completed, it is deleted.
If a toll transaction is carried out, the transaction is linked to the corresponding SANEF Customer Account.
The Customer may trigger one‑off payments by selecting the desired payment method and the toll passage to be paid.
When automatic payment is activated, the amount is debited from the registered payment method within 48 hours.
The information displayed when automatic payment is activated includes license plate number, motorway used, toll point, date and time of the journey, and amount due.
The Data processed per toll transaction includes passage data, vehicle data, toll amount, and the identifier of the Customer who established the association of the license plate number with a payment method.
These Personal Data are retained for the duration necessary to carry out the Processing and in accordance with the Applicable Regulations.
3.2.3.3 Common Provisions for Free‑Flow Tolling Systems
a. Purposes
Personal Data is processed solely for Free‑Flow tolling and is not shared or used for any other purpose.
The purposes justifying the collection and Processing of Personal Data under Free‑Flow tolling are:
- Calculating the toll;
- Paying and recovering the toll;
- Managing customer relations;
- Improving processes and resolving system malfunctions necessary for the proper execution of the above operations.
b. Legal Basis
Processing activities related to the management of Free‑Flow tolling are based on legal obligations, including:
- The amendment to the SAPN concession agreement published in the French Official gazette in December 2021 (Decree No. 2021‑1726 of 21 December 2021);
- The decision of the Ministry of Transport MES‑2019‑06 of 13 March 2019 “authorizing the commissioning of the Free‑Flow toll at the Boulay interchange on the A4 motorway”;
- The French Highway Code (Articles L.419‑1, R.419‑1 and R.419‑2);
- The French Code of Criminal Procedure (Article 529‑6).
c. Non‑payment of the Toll
In accordance with applicable legislation, in particular Article L.529‑6 of the French Code of Criminal Procedure, if a toll has not been paid within 72 hours, SAPN may issue an infringement notice.
For this purpose, an accredited SAPN officer may access the Vehicle Registration System (SIV) of the Ministry of the Interior to obtain the identity and postal address of the vehicle’s registered owner, whose license plate was recorded, in order to send a Payment Notice (“Avis de paiement” or “AVP”) including the amount of the toll, and a flat-rate penalty.
If payment remains outstanding after 2 months, SAPN may forward the payment notice, along with the Data relating to the vehicle and toll passage, to the Officers of the Public Prosecutor (OMP) responsible for initiating criminal proceedings.
For other offences (speeding, dangerous driving, etc.), Free‑Flow tolling does not grant SAPN any public authority powers. Only law‑enforcement authorities remain competent.
d. Recipients and Processors
SAPN only shares Customer Personal Data with authorized employees acting within the scope of their duties (e.g., image review in case of uncertainty about license plate recognition, as mentioned in subsection g).
SAPN may transmit Customer Personal Data to authorized third parties such as tax authorities, customs, law‑enforcement authorities, when required by law or by a court decision (e.g., judicial requisition under Articles 60‑1 et seq. of the Code of Criminal Procedure).
SAPN may also share Personal Data with processors involved in the Free‑Flow tolling system (for example, for A13-A14, FDJ Service - NIRIO for in‑person payments, or MONEXT for online payments). Their missions are strictly limited to the Processing necessary for Free‑Flow tolling and in compliance with applicable regulations.
All contracts with SAPN partners comply with Article 28 GDPR and CNIL guidelines.
It includes obligations relating to purpose and duration of Processing, nature and purpose of Processing, categories of Personal Data, categories of data subjects, processor obligations, controller rights, and provisions on Data transfers.
SAPN does not sell, transfer, or disclose Customer Personal Data to unauthorized third parties.
e. Control of Personal Data
The modalities for exercising data subject rights under Chapter III of the GDPR are detailed in Article 14 of this Privacy Policy.
Furthermore, to allow Customers control their Personal Data:
On the Websites, Customers may modify their information through their SANEF Customer Account, this includes their license plate numbers and bank details.
Customers may also terminate all or part of the services involving their Personal Data or close their SANEF Customer Account themselves.
Upon account closure, Personal Data will be deleted in accordance with sections 3.2.3.2 b. and d., and the Applicable Regulations.
When contacting Customer Service, Customers may provide Data related to their toll passages.
In order to maintain confidentiality, Customer Service will request relevant supporting documents using a secure communication method.
Also, Customers may object to call recordings when contacting Customer Service.
f. Security of Personal Data
To ensure the security of Personal Data, all systems used for Free‑Flow tolling incorporate, from the design stage, mechanisms protecting privacy and Personal Data in accordance with the Privacy by Design principle.
In accordance with Article 32 GDPR, security is ensured through various technical and organizational measures, such as:
- Measures to ensure confidentiality, integrity, availability, and resilience of systems and services;
- Measures to restore the availability and access to Personal Data in a timely manner in case of physical or technical incident;
- Procedures aiming at testing, analysing, and evaluating the effectiveness of these security measures.
g. Image Review
In case of doubt regarding a passage or vehicle identification, authorized operators may perform an image review to confirm the validity of the passage, the correct identification of the vehicle and the correct toll classification.
The operator performs the necessary checks and, if need be, corrections to enable accurate pricing and billing of the passage.
The operator relies on images associated with the passage to verify and, if necessary, correct:
- license plate number,
- country of plate number registration,
- vehicle brand,
- vehicle class.
Operator access to images associated with a passage event is strictly limited to their review duties and passage qualification purposes.
All operator access to passage event information is logged in technical logs.
h. Processing under Bip&Go’s “Free‑Flow Notification” Service
SANEF Group collects the Personal Data transmitted by Bip&Go relating to its Customers (email, toll tag number, license plate number, customer name or company name, language) who have subscribed to Bip&Go’s “Free‑Flow Notifications” service as described in Bip&Go’s Particular Conditions available at Liber-t electronic motorway toll payment with Bip&Go.
If a Customer’s license plate is identified but their Liber‑t Bip&Go toll tag is not detected during passage on a SANEF Group “Free‑Flow” motorway section, the Customer receives an alert including the vehicle license plate number and passage data (toll point, date, and time).
The payment terms for this passage are defined in Bip&Go’s Particular Conditions.
License plate numbers transmitted by Bip&Go are retained for the duration of the Customer’s subscription to the Service and are updated daily based on information provided by the Customer and transmitted to Bip&Go.
The alerts sent by SANEF to Customers are not stored.
Bip&Go, SANEF, and SAPN each act as independent data controllers.
Data is secured and accessible only to SANEF employees and its processors as necessary for providing the Service.
For reference, the Data Processing carried out under the “Free-flow Notifications” service does not affect the Processing of Personal Data collected directly by SANEF Group companies during the Customer’s passage on a Free‑Flow motorway, which is retained as described in section 3.2.3.
i. Processing carried out under the Bip&Go “Undetected Free‑Flow Passage Notification” (NPNDFL) Service
To facilitate payment of tolls for passages made on its Free‑Flow motorway sections, SANEF Group processes the Personal Data of Bip&Go’s Customers who have subscribed to the “Undetected Free‑Flow Passage Notification” service as defined in Article XIX of Bip&Go’s Special Conditions, available at: Liber-t electronic motorway toll payment with Bip&Go.
The purpose of the processing carried out by SANEF Group is to issue a passage alert to Bip&Go customers whose badge was not detected at a Free‑Flow tolling section but who were recognized based on the license plate numbers they provided when subscribing to the service.
The legal basis for the processing is the Customer’s consent.
To perform operations required for the above purpose, the Personal Data processed includes: Passage Data (toll point, date and time), Toll Tag Number, Vehicle License Plate, Customer Name, Language, Email address.
Except for the above‑mentioned Passage Data, the Personal Data is collected and communicated by Bip&Go to SANEF or SAPN in accordance with Article 4.6 of Bip&Go’s Privacy Policy: Privacy policy and legal notice of Bipandgo.com.
The payment conditions for these passages are defined in Bip&Go’s Particular Conditions referenced above.
Personal Data transmitted by Bip&Go as part of this service is retained by SANEF or SAPN for the duration of the customer’s subscription to the service and is updated daily based on the information provided by Customers to Bip&Go.
The alerts sent by SANEF or SAPN to the Customer are retained for five (5) years in order to respond to customer disputes within the applicable commercial prescription period.
The Personal Data is secured and accessible only to SANEF Group employees and its processors, strictly within the limits necessary for the provision of the service.
For all purposes, the processing operations carried out as part of the “Undetected Free‑Flow Passage Notification” service do not prevent Personal Data processing carried out directly by SANEF or SAPN during a Customer’s passage on a Free‑Flow motorway section, in accordance with Article 3.2.3 of this document.
3.3 ANPR Cameras (Automatic Number Plate Recognition)
a. Anti‑fraud Measures
As part of a SANEF Group initiative to improve anti‑fraud mechanisms using images from ANPR cameras, the following Data is processed:
- Still images of vehicles captured when they pass through toll lanes, or under a Free‑Flow gantry.
- Optical Character Recognition (OCR) readings of license plates captured by ANPR cameras under the same circumstances.
The Data processed corresponds to the transaction message fields required to match the license plate with the entry toll station of the transaction, including date and time (entry/exit), entry/exit toll station, license plate number, license plate number recorded in the toll tag at subscription, and transaction identification number.
Images are retained to confirm or refute toll non‑payment offences.
If a case file is created and transmitted to competent authorities, the Data is retained for 1 year from the date it is sent to them.
For heavyweight vehicles equipped with a TIS (Télépéage Inter Société) toll tag, the vehicle’s license plate number is read by an ANPR camera and recorded. An automated process compares the license plate number stored in the tag with the license plate number detected by the ANPR camera and applies penalties in case of discrepancy.
Once the automated process is completed, pieces of evidence (relating to the license plate, toll tag, vehicle, and related images) are retained for 14 months.
b. Claims Management and journey reconstitution
SANEF Group processes Data to manage claims submitted by email, phone, or the customer contact form available on the Websites.
Data relating to claims is retained for 5 years.
In specific cases, when the ticket issued at the toll station is illegible or when an abnormal journey time is detected, the Customer’s journey is reconstituted automatically.
The vehicle’s passage is retrieved using its license plate collected by ANPR cameras.
This way, the Customer is charged the toll corresponding to the reconstituted journey without needing to request assistance via the toll barriers intercom.
The Customer may still submit a claim and request manual verification of the pricing associated with its journey.
Data processed by SANEF employees includes the license plate number and toll station entry passage photos. The retention period for calls made from toll barriers is described in section 4, “Call Recording”. License plate data is kept for a maximum of 24 hours for the purpose of journeys’ reconstitution. Passage photos are kept for 5 days on each toll station server for claim management.
c. Calculation of the Number of Electric Vehicles on the Network
The use of ANPR cameras also enables SANEF Group to perform Data Processing to generate statistics on electric vehicles on the Motorway Network.
Using license plate images captured by ANPR cameras, SANEF Group can identify a vehicle’s energy source via specific vehicle registration system (SIV) database fields.
This access is granted under a technical license authorizing reuse of public information from the SIV, issued by the Ministry of the Interior.
The purposes of this data processing are to determine the number of electric vehicles on the Motorway Network, and the number of kilometres they travel.
This processing is based on legitimate interest, arising from SANEF Group’s obligation to publish its carbon footprint under Decree n°2022‑982 of 1 July 2022 on greenhouse gas emissions reports.
Data is retained only for the day of collection and deleted immediately afterwards.
As part of a study on a defined motorway segment, SANEF Group evaluates the number of electric vehicles using the Network to support the creation of lanes dedicated to carpooling and other users, including lanes for electric vehicles.
This study supports the creation of dedicated lanes included in the program of operations referenced in the 14th amendment to the concession agreement between the State and SANEF.
ANPR cameras allow SANEF to collect license plate images, identify vehicle energy sources via SIV queries, establish anonymized statistics on the proportion of electric vehicles (classes C1, C2, C5) using the targeted motorway segment during peak hours and for a limited period. Data is retained for the duration of the study.
3.4 Breakdown Assistance Management and Monitoring
As part of managing and monitoring breakdown assistance on the Motorway Network, SANEF Group has implemented a mobile application used by towing companies.
Through this mobile application, SANEF and the towing company collect driver’s first name, last name, postal address, phone number, as well as vehicle identification data (including possible photos of the vehicle being assisted), and breakdown mission data (timestamp and location).
Where applicable, SANEF and the towing company also collect Data relating to the characteristics of persons on board (elderly people, children, or persons with reduced mobility) to adapt the intervention.
Towing companies are recipients of the Data collected as part of the management and reporting of breakdown services as defined above, for the purposes specific to them, such as invoicing, tracking their interventions, and reporting service quality indicators.
Data is retained for up to 5 years to process customer claims and disputes.
4. Call recordings
SANEF Group records conversations from Customers made via the emergency call network, toll barriers, as well as calls made to the Operations Control Center (PCE) or to the Customer service for the following purposes:
- Managing Customer assistance requests,
- Managing Customer complaints,
- Recording transactions (for calls made from toll barriers),
- Improving service quality and training SANEF Group employees, and
- Managing incidents of misconduct committed by Customers toward SANEF Group employees.
Data collected consists of the information necessary to fulfil these purposes and may include, in particular, information relating to the vehicle owner, the payment method, or the identification of the vehicle.
By way of exception to the provisions of Article 14 “Procedures for Exercising Rights” below, for calls made from the emergency call network, toll barriers, and calls made to the PCE:
- As the recordings serve an evidentiary purpose and are kept for a short period, neither Customers nor Agents have rights of rectification or erasure.
- Given the purposes pursued by SANEF Group as outlined above, Customers and Agents have only a limited right to object to the recording of conversations.
An informational voice message is provided at the beginning of the call, reminding callers of the processing conditions.
For calls made to the SANEF Group’s Customer Service, calls are not recorded systematically, only a limited proportion is recorded. The Customer is informed that they may object to the recording by pressing the “*” key on their telephone keypad.
A traceability system for access to the recordings database is implemented to ensure that only authorized personnel can access it. Data is retained for 1 to 3 months depending on the type of call. In the context of managing incidents of misconduct, Data is retained for the time necessary to process the case, within the limit of the applicable statutory limitation period.
5. Customer Relationship Management
When a Customer contacts the customer service center with a request or complaint via the contact form available on the Websites, customer service collects only the Personal Data strictly necessary to assess the situation, resolve any incidents encountered by the Customer, or respond to any questions they may have. This may include the Customer’s contact details, financial Data, Data relating to their vehicle, their Liber-t subscription, or photos of any damage they may have suffered on the Motorway Network.
Personal Data relating to Customers is retained for 1 year after the closure of the last request associated with the contact, and up to 5 years in the context of complaint handling.
When using the Autoroutes de France Sanef et Sapn website, the categories of Data collected are as follows:
- Data related to toll payment for Customers wishing to pay their toll online, such as Data relating to the vehicle, the passage, and the payment method,
- Data necessary to create a SANEF Customer Account for Customers who wish to do so, such as the account holder’s identity or email address, as well as Data relating to the management of the Customer Account, such as transaction history or the subscription to optional services (passage alert services, bank card/license plate association service),
- Data relating to Customer requests and complaints submitted through the various communication channels of the customer service center.
As part of customer relationship management, SANEF Group outsources part of its activities and may transfer Customers’ Personal Data to third countries. For more information on the conditions and procedures applicable to this processing, please refer to section 11.1, “Transfer of personal data to a country outside the European Economic Area (EEA),” of this privacy policy.
6. Improvement of Products and Services
Personal Data is processed by SANEF Group for the purpose of developing and improving its products and Services in order to maintain a high level of performance and best meet the needs of its Customers.
As part of its operations, SANEF Group conducts satisfaction surveys among its Customers. The purpose of these surveys is to gather Customers’ feedback to improve the products and Services offered. Participation in these surveys is entirely voluntary, and the responses provided by Customers are anonymized.
Anonymized responses are retained for a period of 3 years.
7. Commercial Prospecting, Newsletters, and Contests
Unless a Customer, Application User, or Visitor object, they may receive offers and information from SANEF Group relating to products and Services similar to those already provided, based on SANEF Group’s legitimate interest in promoting its products and Services to its Customers and Visitors.
By exception to the above, the consent of the Customer, or Visitor will be required:
- When Personal Data is collected through paper or online forms that are not linked to the Services or the Websites;
- For the sending of offers and information from SANEF Group Partners.
The Customer, or Visitor may choose at any time to stop receiving communications from SANEF Group or its Partners by using the unsubscribe link included in any email sent by SANEF Group or its Partners, or by contacting SANEF Group using the contact details provided in Article 14 of this policy.
Personal Data relating to prospects is deleted no later than 3 years after their last contact or at any time when the individual exercises their right to object.
When a person exercises their right to object to receiving marketing communications, the information necessary to record this objection is retained for a maximum of 5 years from the date the request is processed.
SANEF Group organizes contests on motorway service areas, on the Websites, and on social media. On these occasions, SANEF Group collects the Personal Data provided by participants on the contest entry form, such as their first and last name, telephone number, email address, username, and postal address.
Participants are informed that their Personal Data, collected as part of the contests, is essential to validate their participation, ensure the organization of the contest, and send out prizes. The details of the Processing and the data collected in connection with the contests are described in the participation rules of the respective contests.
Personal Data collected is intended exclusively for SANEF Group and its Partners for the management of the contests. Its use for marketing and communication purposes is carried out in compliance with the Applicable Regulations.
Unless otherwise required by law, Personal Data will be retained for a maximum of 3 years from the date of collection.
8. Data Relating to Websites, Applications, and Job Applications
8.1 Personal Data Collected Automatically
Certain Personal Data may be collected automatically, such as Data gathered through Cookies when the Customer, or Visitor uses or browses the Websites or interacts with SANEF Group. This includes, in particular, Data relating to the type of device used to access the Websites, the operating system, IP address, browser type, and any interactions with the content of the Websites.
8.3 Spontaneous Applications and Responses to Job Offers
If an individual wishes to apply for a job offer published by SANEF Group or submit a spontaneous application, they must complete an application form.
This form includes information such as first name, last name, address, telephone number, and email address. The individual must also provide their education level, spoken languages, and a résumé.
The Personal Data submitted is processed solely for the purpose of reviewing the application in connection with potential recruitment.
Personal Data relating to candidates is retained for 1 year from the last contact with the candidate, unless the candidate objects. This Data will be deleted upon simple request from the candidate within a maximum of 1 month from the date of the request.
9. Relations with SANEF Group Partners
9.1 Processing Related to Partner Evaluation Obligations
SANEF Group carries out Personal Data Processing relating to its Partners to comply with its compliance obligations, including those arising from anti‑terrorism measures, anti‑money laundering regulations, and the Transparency, Anti-Corruption and Economic Modernisation Act 2016-1691 of 9 December 2016, known as the Sapin II Act.
As part of its obligation to assess Partners, SANEF Group processes or outsources the processing of the following Personal Data:
- Identity, roles, and contact details of individuals directly (members of leading bodies, directors, beneficiaries) or indirectly (through the same shareholding group) connected to Partners;
- Where applicable, identity, roles, and contact details of individuals linked to the above persons;
- Where applicable, identity, roles, and contact details of individuals with the same name (“namesakes”);
- Where applicable, sanctions imposed on the above individuals;
- Where applicable, information such as press articles relating to the above persons or sanctions.
The Personal Data collected is essential for fulfilling the Partner evaluation obligation and is analysed, processed, and transmitted to the relevant SANEF Group departments that need access as part of their duties. Personal Data is retained for up to 7 years from the end of the contractual relationship with the investigated third party or, where applicable, from the last payment.
9.2 Processing Related to Contractual Relationships with Partners
SANEF Group carries out Personal Data Processing to manage contractual relationships with its Partners. This includes collecting Personal Data relating to the identity and contact details of Partner employees designated as contract signatories or responsible for contract performance (e.g., technical or commercial contacts).
Personal Data collected is essential for contract performance and is transmitted to SANEF Group departments that require such information as part of their duties.
Personal Data collected may be transferred to SANEF Group companies, subcontractors, or service providers. Retention periods are determined according to applicable legal requirements.
10. Recipients of Personal Data
10.1 General Principle Regarding Recipients
Personal Data is transmitted to SANEF Group departments (including operations, marketing, customer relations, debt recovery, audit, finance, etc.), within the scope of access rights granted to each employee, as well as to its parent company (Abertis) and its Processors, strictly to the extent necessary and permitted for providing Services and Websites.
10.2 Cases of Sharing Personal Data with Authorized Third Parties
For the management of toll transactions and events, SANEF Group may transfer Personal Data to:
- Other motorway concession companies and parking operators:
-
For Liber‑t Bip&Go electronic toll subscribers, to create a single invoice for journeys across the entire motorway network;
-
To invoice the amount corresponding to the journey actually made on a network shared with another motorway concession company;
-
Where applicable, to other toll badge issuers so the Customer can pay for journeys made on SANEF Group networks according to their contract with the issuer.
Personal Data may also be transmitted to competent public authorities in the event of an appeal against an offence, court officers, ministerial officers, and organizations responsible for debt recovery.
Personal Data of Customers, or Visitors may be disclosed in the following cases, as permitted by Applicable Regulations:
- To comply with a legal obligation, injunction, or other judicial measure related to actual or suspected illegal activities; to prevent or act against such activities;
- In cases of contractual breach by the Customer;
- To protect the rights, property, and safety of SANEF Group;
- To protect the rights and safety of Customers.
10.3 Storage of Personal Data
Personal Data may be processed by SANEF Group companies and their service providers both within and outside the European Economic Area, under data protection rules consistent with EU regulations and GDPR standards.
11. Subcontractors
SANEF Group uses subcontractors for the provision of Services and Websites. Subcontractors and their employees are bound by confidentiality and security obligations when processing Personal Data. Processors undertake all technical, organizational, and structural measures necessary to prevent any Personal Data Breach, including:
- Accidental or unauthorized destruction, deterioration, alteration, or loss of Personal Data,
- Accidental or unauthorized disclosure or access,
- Any illegal or unauthorized Processing or not foreseen in the Privacy Policy.
11.1 Transfer of Personal Data to a Country Outside the European Economic Area (EEA)
SANEF Group may transfer Customer Personal Data to countries whose data protection level has not been recognized as adequate by the European Commission.
In this context, SANEF Group may use subcontractors located outside the European Economic Area (EEA), this is the case for activities carried out for the purposes described below:
- Outsourcing part of Customer Service activities for managing customer relations (personal data transferred is hosted in France);
- Using a digital monitoring tool for communication‑related activities.
To ensure a level of protection equivalent to that guaranteed within the European Union (EU), SANEF Group implements the appropriate safeguards provided under Article 46 GDPR, to govern such transfers, in particular those arising from the Standard Contractual Clauses approved by the European Commission, available by clicking here.
A copy of the signed Standard Contractual Clauses may be obtained by contacting the Data Protection Officer (DPO): [email protected]
12. Use of Cookies and Similar Technologies
Customers, and Visitors are informed through a banner that cookies may be installed automatically when visiting the Websites.
In accordance with Applicable Regulations and the French data protection authority, Commission Nationale Informatique et Libertés “CNIL”, recommendations, SANEF Group has set a maximum validity period of 13 months for Cookies, starting from the last interaction of the Customer, or Visitor with the Cookie. Once this period has expired, SANEF Group must obtain the Customer’s or Visitor’s consent again for the use of Cookies. By exception to the above, audience measurement Cookies that collect only anonymous statistical data are retained for a maximum period of 25 months.
12.1 12.1 Functional Cookies
These Cookies are necessary for the proper functioning of the Websites when the Customer or Visitor browses them. They allow, in particular, to link the actions of the Customer or Application User when required to log in to an identification service (Session ID).
Functionality Cookies make it possible to remember that the Customer has visited the Websites during a session, as well as to store the preferences necessary for the provision of the Service, in order to enhance their experience on the Websites and personalize features. They are used, for example, to record the selected language. It should be noted that these Cookies cannot track the movements of the Customer or Visitors on other Websites.
List of functional cookies used on the website
CookieConsent
autoroutes.sanef.com
1 year
currpage
autoroutes.sanef.com
Session
localState
autoroutes.sanef.com
Persistent
orientation
autoroutes.sanef.com
Session
ppsearchDB#ppSearchEngine
autoroutes.sanef.com
Persistent
rc::a
google.com
Persistent
rc::c
google.com
Session
12.2 Marketing Cookies
Marketing cookies allow SANEF Group to improve the usability of its websites by analyzing the paths taken by Visitors. The results of these analyses are processed anonymously for statistical purposes only.
These Cookies also make it possible to understand the browsing habits of the Customer or Visitor and thus personalise their browsing by offering them content and offers adapted to their expectations. These Cookies are useful for SANEF Group to measure the performance of advertising campaigns while providing the Client with targeted advertising.
List of marketing cookies used on the site
__utma
google-analytics.com
2 years
__utmb
google-analytics.com
1 day
__utmc
google-analytics.com
Session
__utmt
google-analytics.com
1 day
__utmz
google-analytics.com
6 months
_ga
autoroutes.sanef.com
2 years
_gat
autoroutes.sanef.com
1 day
_gid
autoroutes.sanef.com
1 day
_hjAbsolute
SessionInProgress
autoroutes.sanef.com
1 day
_hjid
autoroutes.sanef.com
Persistent
_hjIncludedIn
PageviewSample
autoroutes.sanef.com
Persistent
_hjTLDTest
autoroutes.sanef.com
Session
collect
google-analytics.com<
Session
NID
google.com
6 months
12.3 Multimedia Cookies
Multimedia Cookies make it possible to operate a media player (audio or video) corresponding to content requested by the Customer or Visitor on the Websites.
List of Multimedia Cookies used on the site
dzr_uniq_id
deezer.com
179 days
persist:cache:0
deezer.com
Persistent
plyr
autoroutes.sanef.com
Persistent
sid
deezer.com
Session
vuid
vimeo.com
2 years
WIDGET::local
::assignments
soudcloud.com
Persistent
12.4 Social Network Cookies
Social network cookies make it possible to share the SANEF Group's content on social networks (Facebook, Instagram, LinkedIn, X, etc.).
List of Social Network cookies used on the site
__atuvc
AddThis
2 years
__atuvs
AddThis
1 day
_at.cww
AddThis
Persistent
_at.hist.#
AddThis
Persistent
at-rand
AddThis
Persistent
12.5 Location Cookies
Location Cookies are used to determine your geographical location. When used, these cookies enable certain location-based features or to measure audience metrics by geographic area. The collection of location data is activated only with the Costumer or Visitor’s prior consent.
It should be noted that the simple consultation of the interactive map does not require the use of location cookies, which can then be blocked by the Customer or the Visitor.
12.6 Deleting Cookies
Customers or Visitors understand that Cookies improve browsing comfort and are necessary to access certain secure areas. In particular, by blocking all Cookies through their web browser, the Customer or Visitor will only be able to access to the public sections of the Websites and will not be able to access their customer account.
The Customer or Visitor is informed through the websites’ cookie banner of the Cookie purposes and the consequences of refusing to allow Cookies to be stored on their device.
Customers or Visitors may:
- Accept all cookies,
- Reject all cookies,
- Decide all a cookie-by-cookie basis.
This information and these settings are also easily accessible at any time via a “cookie settings” link available at the top or bottom of website pages.
However, it is possible to reject statistical Cookies or advertising Cookies to be stored by using appropriate browser Cookie settings, private browsing mode, or the “Do Not Track” (DNT) function.
Rejecting advertising Cookies does not stop ads from being displayed. They will be non personalized ads randomly, without considering the proven or inferred interests of Customers or Visitors.
Depending on each browser, the Customer or Visitor have the following options: accept or reject all cookies, manage cookies by source, or display a message requesting for the Customer or Visitor’s consent each time a Cookie is stored on their device.
If the Customer or Visitor wishes to delete or reject Cookies, he may do so by clicking on “Cookie setting” and changing their web browser settings, or by consulting online help support offered by the web browser (Internet Explorer, Mozilla, Chrome…).
Microsoft Edge :
Settings (accessible via the “Tool” Icon at top right of the page) → Cookies and site permissions → Adjust as needed
Chrome :
Settings → Advanced settings → Privacy → Content settings → Adjust as needed
Firefox :
Tools → Options → Privacy → Adjust as needed
For broader cookie management and understanding of all types of Cookies, not only those used on the Websites, Customers and Visitors may consult: youronlinechoices.com. This platform, managed by the Interactive Advertising Bureau (IAB) France, lists companies that allow opting out of targeted advertising.
13. Tracking Pixel
The Sanef Group implements tracking pixels within electronic communications sent to people who have created a customer account or subscribed to a newsletter. They are small invisible images that are not directly contained in the email in question but are hosted on remote servers.
The information collected is used to measure the open rate of emails individually for deliverability purposes. Anonymized information in the form of statistics (overall click-through rate, open rate) is also processed in order to measure the overall performance of our communications and to adapt our strategy (frequency, communication channel…).
14. Security
Customers are informed that SANEF Group takes the technical and organizational measures necessary and reasonable to ensure the security of Personal Data and protect it from unauthorized access, alteration, disclosure, misuse, or loss.
For example, SANEF Group has implemented a secure access system for Personal Data using authentication processes, as well as encryption protection through the HTTPS protocol when Personal Data is transmitted over the internet.
SANEF Group cannot be held responsible for the loss of one or more logins (username or password) and, unless the Customer has submitted a prior written and duly notified objection to SANEF Customer Service, cannot be liable for any harmful consequences resulting from the account being used by an unauthorized person.
In case of loss or theft of an identifier, the Customer must use the procedure implemented by SANEF Group allowing them to recover their logins and/or reset their password.
15. Procedures for Exercising Rights
The individuals concerned under this section may exercise their rights as defined in Chapter III of the GDPR.
14.1 Contact to Exercise Your Rights
In accordance with Applicable Regulations, SANEF Group has appointed a Data Protection Officer (“DPO”).
Customers or Visitors may exercise their rights of access, rectification, objection, erasure, and portability, under the conditions provided by Applicable Regulations, by contacting SANEF Group DPO at 30 boulevard Gallieni, 92130 Issy-les-Moulineaux
or by email at [email protected]
or via the online form at https://www.sanef.com/client/index.html#assistance
They may also send any inquiry or question related to the Processing of their Personal Data to this contact address.
If the right to object is exercised, SANEF Group will cease Processing the Personal Data unless it has compelling legitimate grounds or needs the data to establish, exercise, or defend legal claims, in accordance with Applicable Regulations. In such cases, SANEF will inform the Customer or Visitor of the reasons why the request cannot be fully or partially granted.
The Customer also has the right to the portability of certain Personal Data, which allows them to request a machine-readable copy of Personal Data processed by SANEF as part of their contractual relationship with SANEF Group. This excludes:
- Data produced by SANEF for its own purposes or in order to comply with its legal (including accounting, social, or tax) obligations;
- Information relating to subscription history, amounts paid or payable, as well as any information generated by SANEF for its legitimate interest, including understanding Customers’, Visitors’, or prospects’ interests.
The Customer may also define instructions regarding the fate of their Personal Data after their death.
If, after contacting SANEF Group, the Customer believes that their rights have not been respected, they may lodge a complaint with the CNIL.
14.2 Conditions for Exercising Rights
To access their Data, the Customer or Visitor may be required to provide proof of identity to the DPO, in accordance with Applicable Regulations.
A Customer or Visitor may mandate another person to exercise their right of access. The representative must provide a letter specifying:
- The subject of the mandate (exercise of the right of access),
- The identity of the person granting the mandate and their own identity.
For example, the claimant may obtain information on the source of their Personal Data and request a copy of it.
The DPO has 1 month to respond. This period may be extended by 2 additional months depending on the complexity or number of requests. If extended, the claimant will be informed within the initial 1‑month period.
To maintain evidence of compliance with access, rectification, and erasure obligations, SANEF keeps copies of response letters or emails for 5 years from the date they are sent.
14.3 Cases in Which Requests May Be Refused
The DPO is not required to respond to requests when:
- They are clearly abusive, particularly due to their number, repetitive nature, or systematic pattern;
- The Personal Data is no longer retained, in which case access is impossible.
14.4 Cases of Limitations
SANEF Group may restrict the exercise of certain rights, particularly the right to erasure, when specific Personal Data must be retained to:
- Comply with legal obligations, contractual needs, or service provision requirements;
- Meet compelling legitimate grounds that override the rights and freedoms of the individual concerned, or to establish, exercise, or defend legal claims.
16. Intellectual Property
The Services, Websites, and their content—including all graphic, visual, audio, photographic, and textual elements, the Websites’ architecture, and the databases composing them (collectively the “SANEF Content”)—are the exclusive property of SANEF Group or its respective holders.
Extraction, reproduction, use, or storage of all or part of SANEF Content is prohibited without the express written authorization of SANEF Group.
As SANEF does not control all the information sources it provides access to, and given the complexity of processing such information, SANEF cannot guarantee the completeness or accuracy of information within SANEF Content and cannot be held liable for errors or omissions.
Creating hyperlinks to www.sanef.com, www.autoroutes.sanef.com, and www.groupe.sanef.com requires prior written authorization from SANEF Group.
SANEF is not responsible for information published on websites accessible via such links.
The Websites respect copyright laws. All rights of authors of protected works reproduced and communicated are reserved. Unless authorized, any use of such works beyond individual and private reproduction or consultation is prohibited.
17. Social Media
SANEF Group has created profiles on Facebook, Instagram, LinkedIn, X, and TikTok mainly to share news and information about its Services.
Visitors who have a profile on these platforms may subscribe to SANEF pages, thus indicating an interest in the information shared. By joining these pages, the Visitor consents to the processing of Personal Data published on their profile or communicated via private messages for the purposes of relationship management, Services, and contests.
SANEF Group has access to and processes public profile information, including the Visitor’s contact name. This Data is used solely within the social network itself.
SANEF may:
- Access public profile information;
- Send individual private messages through the platform’s messaging systems.
SANEF may also process public information shared by the Visitor on social platforms (comments, posts, location, age, etc.) in the context of using a digital monitoring tool.
Visitors retain control over their profiles through privacy settings and may delete content or restrict shared information.
Visitors may publish links, images, photos, or any supported media on SANEF pages. They must own the content or have the necessary rights or consents.
Content that is offensive, unethical, indecent, or that infringes intellectual property is strictly prohibited.
SANEF reserves the right to immediately remove such content and may request the permanent blocking of the Visitor.
SANEF is not responsible for content freely published by a Visitor.
Visitors should be aware that their posts are visible to others and remain responsible for their own privacy.
Privacy policies of social networks are available at:
- Facebook: https://fr-fr.facebook.com/privacy/policy/
- Instagram: https://about.instagram.com/fr-fr/blog/announcements/instagram-community-data-policy
- X (Twitter): https://x.com/fr/privacy
- LinkedIn: https://fr.linkedin.com/legal/privacy-policy
- TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/fr
18. Updates to the Privacy Policy
This Privacy Policy may be updated, particularly following legislative or regulatory developments. Customers may consult updates directly on the Websites or will be informed by email whenever necessary.