Privacy statement on per kilometre levies

Why is this Notice important for you?

Introduction

What data do we process about you and how?

What personal data do we process about you?
For what purposes do we use your data and on what legal basis?
Who has access to your data?
Use of cookies
Links to third party websites

How do we protect your data?

Retention period
Security of your data
Automatic decision-making and profiling
Children

You can contact us

What are your rights?
How to contact us
Update date and changes

1. Introduction

This information notice relating to the protection of personal data (hereinafter, the “Privacy Statement“) has been drawn up in order to provide information about the personal data processed by the Walloon Infrastructure Financing Company, acting as controller (hereinafter, “SOFICO, we, us or our”, as the case may be), whose registered office is located at rue Canal de l’Ourthe 9/3, 4031 Liège, Belgium, and which is registered with of the Crossroads Bank for Enterprises under number 0252.151.302.

We attach great importance to the protection of personal data that we process in our capacity as toll collectors within the meaning of Article 2, 8° of the Walloon Decree of 16 July 2015 introducing a per kilometre levy to be paid by heavy goods vehicles for the use of roads (hereinafter the “PKM Decree”) in relation to road users subject to the per kilometre levy, or – in case of companies – in relation to the contact persons and/or drivers of heavy goods vehicles of these companies (hereinafter “you”).

That is why we secure and protect your data in accordance with applicable laws, including the General Data Protection Regulation[1] (hereinafter, the “GDPR”) and the Belgian law of 30 July 2018 on the protection of individuals with regard to the processing of personal data.

Through this privacy statement, we wish to inform you about what personal data we process about you, what we use them for, and with whom we share them. We will detail the legal basis on which we process your data and explain your rights and choices.

2. What personal data do we process about you?

We have indicated in the table below the categories of your personal data that we process and how we collect them.

Data categories	Description of the data
Identification data of the persons liable to pay the per kilometre levy under the PKM Decree or, in the case of companies, their contact persons	This includes data that (i) we receive from toll service providers with whom you have concluded a toll transaction (last name, first name, postal address), or (ii) you submit to us by completing the exemption request form (last name, first name, postal address, telephone, email) accessible from this website https://sofico.org/en/redevance-poies-lourds/ (hereinafter the “Website”) or directly from the website https://www.exemption.sofico.org/stark-exoneration/fr/. or (iii) are transferred to us by the interregional entity VIAPASS (last name, first name, postal address, telephone, email) or (iv) you provide to us by email at exemption@sofico.org (last name, first name, address, telephone number, email, VAT number) or at contact@sofico.org
Daily toll data	This includes data that we receive from the toll service providers with whom you have concluded a toll transaction (technical OBU ID, vehicle plate number and country, vehicle characteristics, kilometres travelled and day of travel, fee due excluding VAT).
Data on the daily declaration of bills	This includes data that we receive from the toll service providers with whom you have concluded a toll transaction (the name of the payer, their address, the vehicles/OBU involved, the amount due for the period concerned.
Geo-tracking data	This includes data that the toll service providers with whom you have concluded a toll transaction process on our behalf to establish the number of kilometres travelled by the tolled vehicle.
Vehicle data	This includes data that we receive from service providers with whom you have concluded a toll transaction or that you provide to us either via Viapass or directly using the exemption request form (country, registration, VIN, vehicle type, registration certificate), or by email via the addresses “exemption@sofico.org” or “contact@sofico.org”, in order to obtain exemption for a vehicle or to find out whether a vehicle is subject to the scope of the per kilometre levy.
Information contained in a complaint or claim	This includes data that you provide to us when you contact us for a dispute or a complaint.

3. For what purposes do we use your personal data and on what legal basis?

We have set out in the table below the purposes for which we process your personal data, the associated legal bases on which we lawfully process your personal data and the categories of personal data (as identified above) used for those purposes:

Purpose	Legal basis	Data categories
Calculation and collection of the per kilometre levy under the PKM Decree	Our public interest mission as a toll collector under Decree PKM	Your identification data, daily toll data, daily bill declaration data or geo-tracking data.
Handling requests for exemption from the per kilometre levy or requests to find out whether a vehicle is subject to the per kilometre levy	Our public interest mission as a toll collector under Decree PKM	Your identification data and vehicle information that you have provided to us by filling in the online form, or that we have received from Viapass, or that you have sent to us by email to the address “exemption@sofico.org” or “contact@sofico.org”
Complaints management	Our public interest mission as a toll collector under Decree PKM	Your identification data and the information contained in your complaint or claim
Production of statistics (including traffic policies)	Our public interest mission under the decree of 10/03/1994 on the creation of SOFICO	Your identification data, daily toll data, daily bill declaration data, geo-tracking data, vehicle data, information contained in a complaint or a claim
Improvement in traffic management	Our public interest mission under the decree of 10/03/1994 on the creation of SOFICO	Your real-time geo-tracking data

4. Who has access to your data?

In order to pursue the purposes specified above, we may share your personal data with the following recipients:

Categories of recipients	Reason for sharing
The Wallonia Public Service for Finance (SPW)	We provide it (directly and/or with the assistance of toll service providers acting on our behalf) with the data it needs to monitor compliance with the PKM Decree and impose fines where appropriate.
IT service providers	We work with service providers who work on our behalf and who may need access to some of your personal data in order to provide their services to us. These include companies we have engaged to provide a hosting service for our websites and servers.
Toll service providers	We work with the toll service providers with whom you have concluded a toll transaction to assist us in calculating and collecting the toll due and to manage your requests in this regard (requests for exemption and possible complaints).

Some of our service providers are located in third countries other than our own. When we transfer personal data to countries outside the European Economic Area that are considered by the European Commission not to provide an adequate level of protection for personal data, we use standard contractual clauses approved by the European Commission to ensure adequate protection. For further information, including a copy of the documents used to protect your personal data, please contact us as set out in section 12 below.

5. Use of cookies

Cookies are small text files placed on your computer’s browser (or other digital device used) by the websites you visit. They are generally used to enable websites to function or operate more efficiently, as well as to provide information to the website owners.

5.1 Cookies requiring consent

In addition, our Website uses other cookies that are not deemed necessary and require your consent. Please refer to the table below for all relevant information about these cookies used by our Website.

5.2 Sharing on social media

For reasons of data privacy, we have deliberately declined the use of direct social media plug-ins on our Website. Instead, we use an alternative technical solution that allows you to decide whether and when you wish to transmit data to social media operators. Thus, when you visit this Website, data are never automatically transmitted to a social network; only when you click on the corresponding button yourself will your browser connect to the servers of the social network. In other words, clicking on the social network icon tells your browser that you consent to it connecting to the social network’s servers and sending usage data to that social network operator, whether or not you are a subscriber to such a social network.

Please note that we have no influence on the nature or scope of the data that social networks may subsequently collect. For more information on the purposes and scope of data collection, the processing and use of data by the social networks, your personal data protection rights and the relevant configuration settings, see the respective privacy notices of the social networks.

5.3 How can I prevent cookies from being installed or disable cookies?

This website allows you to manage your preferences regarding cookies that require consent by clicking on “prohibit” in the banner that appears when you open the website and can be accessed later.

6. Links to third party websites that we make available to you

Some areas of this website contain links to third party websites. Please note that these links are provided for your convenience, that we have no control over these third parties or their websites, and that they have a different privacy statement from ours that applies to information you submit when you visit these third party websites. We advise you to read the privacy statements of these websites carefully before submitting personal data to them.

7. Retention period

We retain your personal data in accordance with our data retention policy only for as long as is necessary to fulfil the purposes described in section 3 above or in accordance with the statutory limitation periods for claims.

8. Security of your data

We implement technical and organisational measures, in line with industry standard practices, to ensure an appropriate level of security for personal data processed. Nevertheless, security requires efforts from all parties involved. We therefore encourage you to contribute to these efforts by taking appropriate security measures yourself, in particular by ensuring that the OBU that has been provided to you is protected against theft and by using this OBU in accordance with its terms of use.

9. Automated decision-making and profiling

No automated decisions or profiles will be made by us about you in connection with the processing of personal data described in this privacy statement.

10. Children

The content of this website is not intended for children under the age of 13. We do not knowingly or directly collect information from children under the age of 13. If you are under 13, please do not use this website or provide any personal information. If you are a parent or legal guardian and you believe that your child has provided us with personal data, please contact us using the contact details in section 12 below.

11. What are your rights?

The GDPR gives individuals certain rights in relation to their personal data. Accordingly, we are available to assist you in exercising these rights. Subject to limitations imposed by applicable law and subject to applicability, the following rights are granted to individuals:

Right of access: the right to be informed and to obtain access to the personal data we process about you;
Right of rectification: the right to have us rectify or update your personal data when it is inaccurate or incomplete;
Right to erasure: the right to have us erase your personal data;
Right to limit processing: the right to have us temporarily or permanently cease processing of all or part of your personal data;
Right to object:
- the right to object at any time to the processing of your personal data on grounds relating to your particular situation;
- the right to object to the processing of your personal data for marketing purposes;
Right to data portability: the right to receive a copy of your personal data in an electronic format and the right to transmit that personal data for use by a third party service; and
Right to object to automated decision-making: the right not to be subject to a decision based exclusively on automated processing, including profiling, which produces legal effects concerning you or which affects you in a similar significant way.

These rights may be limited, for example, if the execution of your request reveals personal data of another person, or if you ask us to delete information that we are required to retain by law or by compelling legitimate interests.

When we have asked you for your consent, you may withdraw it at any time without giving any reason. If you request to withdraw your consent to our newsletter, this will not affect the lawfulness of the processing based on the consent given prior to the withdrawal of consent.

To exercise your rights, please contact us using the contact details in section 12 below.

Finally, as a data subject, you have the right to lodge a complaint with a supervisory authority (in particular in the EU Member State of your habitual residence, or place of work, or the place of the breach) if you consider that the processing of your personal data violates the applicable laws on the protection of personal data. For your information, you can find the contact details of the Belgian Data Protection Authority on its website: https://www.autoriteprotectiondonnees.be/citoyen

12. How to contact us

If you have any questions about this privacy statement or wish to exercise your rights, please contact our data protection officer by sending an e-mail to dpo@sofico.org or by writing to us at the following postal address : SOFICO, Data Protection Officer, rue Canal de l’Ourthe 9/3, 4031 Liège, Belgium.

13. Update date and changes

This privacy statement was last updated on 08/02/2023. We may make changes to it from time to time. Please check this page for the most recent version.

The privacy statement on per kilometre levies is available here.

[1] REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.