Privacy policy

Keolis TRAM Santa Azur makes every effort to protect your personal data in accordance with applicable European and French regulations.

This privacy policy is intended to inform you about the purposes and conditions under which we process personal data that we may collect through our various channels, such as our commercial services, our website www.santa-azur.com, our social networks, or our possible events.

Our Cookie Management Policy, available at www.santa-azur.com, supplements this Privacy Policy to inform you of the purposes and conditions of use of cookies or navigational data that may be deployed on our websites and mobile applications.

Please take the time to read this Privacy Policy so that you have all the information you need to understand how your personal data is used and to exercise freely and fully the rights guaranteed to you by the applicable laws and this Privacy Policy.

1. General provisions

Data controller

The person responsible for processing your personal data is Keolis TRAM Santa Azur, except when we are acting on the instructions and for the exclusive account of our principals. In this case, we will inform you either at the time of collection of your personal data, or in this Privacy Policy, or when you wish to make representations to us regarding the protection of your personal data.

Terms and Conditions of Use

The Privacy Policy is an integral part of the terms and Conditions of Use of the Site, and should be reand in conjuction with them

Applicable law and competent administrative authority

The Privacy Policy is governed by the General Data Protection Regulation n°2016/679 (“GDPR”) and by the French Data Protection Act n° 78-17 of 6 January 1978 as amended (“Loi Informatique et Libertés”), under the regulatory control of the French data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés www.cnil.fr ).

Links to third party websites

Our site may contain or use links to websites, mobile applications, products or services that are operated by third parties (including advertising sites, our partners or social networks). Please note that the Privacy Policy does not extend to these third parties over whom we have no control and for whom we cannot be held responsible.

We encourage you to review the privacy policies, procedures and practices of these third parties.

Protection of minors

For the purposes of the digital delivery of Keolis TRAM Santa Azur products and services, we may collect personal data from minors under the age of 16, under the control and with the consent of their legal representatives (parents or guardians). Users of our digital services who inform us that they are under 16 years of age have a discretionary right to have their data erased (subject to our legal retention obligations described in Article 3 “Use of data collected and retention periods” below), which they may exercise directly or through their legal representative, at any time and without cause, by contacting us at dpo.tps@keolis.com

2. The personal data we collect

This Privacy Policy applies to personal data that we may collect from or about you (see below), including from the following sources

• Completion of our subscription or collection forms on paper or electronically or on the occasion of operations or events organised by Keolis TRAM Santa Azur in which you participate;
• Visit one of our physical outlets and/or purchase one of our services
• Request for contact or exchanges by email/mail and/or telephone with our customer relations services
• Processing of video protection images from cameras installed in our facilities open to the public (commercial agencies, transport vehicles)
• Validation of tickets, access control to our services (urban, interurban, collective or individual transport, medical care, vehicle rental or parking, etc.) or processing of offences and recovery of fines;
• Use of our services, including our ticketing systems and applications as well as transport on demand services, transport for people with reduced mobility;
• Browsing our website : www.santa-azur.com
• Receiving and sending e-mails, text messages and other electronic messages between Keolis TRAM Santa Azur and you;
• Telephone or voice exchanges between you and Keolis TRAM Santa Azur or one of its service providers;
• Exercise your rights under the RGPD by mail and/or email to Keolis TRAM Santa Azur

3. Use of collected data and retention periods

We collect and use your personal data for the main purposes described below. We keep your personal data only for as long as is necessary to fulfil the various purposes, except where we are permitted or required by law to keep it longer.

• To manage the issuing and use of tickets and to combat fraud
• To manage our customer and prospect files, the provision of our services and the contractual, technical, financial and accounting management of the relationship with our customers and users of our services;
• Securely process your payment details when you subscribe to a service;
• To inform you of the latest news about our network and any incidents and disruptions in the provision of our services;
• To better understand your needs and expectations in order to provide you with adapted services and to measure the use of our services in order to improve our offers
• Handling your requests, exercising your rights and complaints;
• Comply with the law, regulations, and legal requests and orders.

4. Data transmission

Your personal data may be communicated to :

In Groupe Keolis

We may share your personal data with certain entities of the Keolis Group, in order to ensure the continuity of our services, our website and our mobile applications;

To service providers, subconctractors

We may share your personal data with trusted third parties located in the European Union (hereinafter “EU”) to help us operate our services. We may share your personal data with trusted third parties, located within the European Union (hereinafter “EU”), to help us operate our services and in particular to ensure the proper functioning of the Keolis TRAM Santa Azur websites and mobile applications;

To business partners

We share certain pseudonymous data, containing no direct identifiers, for the purposes described in Article 3 “Use of your personal data” above, concerning cookies and trackers collected with partners who collect and process these cookies/trackers. Ces derniers étant responsables distinct/conjoints de traitement concernant les traitements effectués.

To third parties for legal reasons

In the event that we are required to comply with laws and regulations and legal requests and orders or if permitted by law (i.e. for the protection and defence of rights, situations that threaten life, health or safety, etc.), such as the transmission of unpaid reports to the Office of the Public Prosecutor, or the transmission of videoprotection images to the Judicial Police in the event of a judicial requisition

In any case, we always require these recipients to provide sufficient guarantees of confidentiality and security and to take the necessary physical, organisational and technical measures to protect and secure your personal data, in accordance with the legislation in force.

All of your data is processed and hosted primarily within the EU. Data security

5. Date security

Keolis TRAM Santa Azur secures your personal data by implementing adequate physical, organisational and technical measures to prevent any unauthorised access, use, disclosure, modification or destruction, in accordance with the regulations in force.

These measures include

• Storage on secure servers within the European Union;
• The security of your data, in particular via pseudonymisation procedures, encryption of transmitted data and the implementation of means to guarantee the confidentiality, integrity and availability of your data;
• Limited access to your data on a “need to know” basis;

Although Keolis TRAM Santa Azur takes all possible measures to protect your personal data, we cannot guarantee the security of information transmitted on our websites or on one of our mobile applications when a security flaw affects your terminal or browser.

6. Your rights on your personal data

Under the RGPD and the Data Protection Act, you have various rights, including

Access, modification, updating and deletion of your personal data

You may request access to your personal data held and processed by Keolis TRAM Santa Azur, consult them, obtain a paper or electronic copy and request correction, updating or deletion.

Opposition

You may, at any time, request that some of your data no longer be processed.

Portability

You may request that your data being processed be provided to you in an open and machine-readable format, either for your own use or for transfer to another controller.

Limitation of treatment

In some cases, you can request that the processing of your data be restricted.

You can also define what happens to your data after your death.

Complaint to a Supervisory Authority

Without prejudice to any other legal remedy, you have the right to lodge a complaint with the supervisory authority of the country of the European Union in which you reside, work or in which you consider that a violation of your rights has occurred.

You may exercise all these rights by sending a written request, accompanied by proof of identity (where this is necessary to verify your identity), to the contacts mentioned in Article 9 “Contact us”.

We will endeavour to respond to your requests as quickly as possible and in accordance with the applicable regulations. However, in some cases, we may not be able to respond favourably in order to meet our legal or contractual obligations.

7. Changes to the Privacy Policy

Keolis TRAM Santa Azur may make changes to the Privacy Policy from time.

We encourage you to check this page regularly for changes and to stay informed about the measures we take to protect your personal data.

8. Data storage duration

We retain your personal data only for as long as is necessary to fulfil the various purposes set out in section 3 “Use of your personal data” above, except where we are permitted or required by law to retain it for longer.

The table below summarises the different maximum retention periods applicable or imposed on Keolis TRAM Santa Azur according to the purposes for which your personal data may be processed. These maximum retention periods apply unless you request the deletion or cessation of use of your data before the expiry of these periods for a reason compatible with any legal obligation that may be imposed on Keolis TRAM Santa Azur.

Table
Finality	Retention periods
Customer management, prospecting, promotional and loyalty operations, sending offers	3 years from the end of the commercial relationship or the last contact initiated by the customer or prospect.
Management, issue and use of transport tickets (management of customer relations, distribution of transport media and tickets, management of sales channels and management of ticket validations).	Data relating to the customer relationship is kept for the duration of the contractual relationship and 2 years after the end of it for customers and prospects. Data relating to complaints in the context of post-payment (information necessary for invoicing, including validation data, with the exception of the place) are kept for 4 months from the date of the events. Data relating to unpaid bills are removed from the stop list as soon as they are cleared. In the absence of regularisation, the data are kept for a maximum of 2 years. Validation data may be retained for a maximum of 48 hours and for the sole purpose of combating technological fraud.
Response to your requests	Time needed to process your request
Responses to satisfaction surveys	3 years from the last contact.
Management and archiving of purchases and services, guarantees, collection, claims management	10 years from the last event, except for data concerning means of payment, which are processed by Keolis TRAM Santa Azur’s payment service providers only for the duration of the statute of limitations for payment operations.
Follow-up of the issued fines and the corresponding fines Issuance of regularisation bulletins. Handling of reminders and complaints following an infringement report	The offenders’ data are deleted as soon as the fine is paid. In the absence of payment, the retention of this data is for a maximum of 12 months (for the purpose of detecting habitual offences).
Audience measurement and personalisation of websites, mobile applications and cookie management	13 months from the time the cookie is deposited
Management of data access and rectification requests	1 year from receipt of the application
Management of request to the processing operation(s)	3 years after the right to object has been taken into account

9. Contact us

To exercise your rights or if you have any questions about the Privacy Policy, please contact us at dpo.tps@keolis.com