TollNow data protection

Toll Collect GmbH (hereinafter "Toll Collect", "we" or "us") appreciates your use of the TollNow app. When you use the TollNow app, we process personal data about you and the TollNow app accesses information on your end device. Personal data refers to all information relating to an identified or identifiable natural person. The following information explains which personal data we process, which information is stored on your end device, which information on your end device we access when you use the TollNow app, and how we handle this data.

The controller is responsible for the processing:

Toll Collect GmbH
Linkstr. 4
10785 Berlin

+49 30 74077-0

Fax: +49 30 74077-22222

info@toll-collect.de

You can contact our data protection officer, whom you can consult for questions relating to Toll Collect's processing activities, at:

Data protection officer

Toll Collect GmbH
Linkstr. 4
10785 Berlin

Downloading the app

When you download the TollNow app, information is transferred to the app store you have selected (e.g. Google Play or Apple App Store). In particular, the following personal data may be processed by the app store operator: user name, e-mail address, time of download, individual device identification number.

In addition, the app store independently collects various data and provides analysis results. This data is processed exclusively by the respective app store and is beyond our control.

Login

You can use toll payment via the TollNow app as a registered Toll Collect user. You can log in to the TollNow app using the login details for your customer account.

We process the login data in order to authenticate you when you log in and to follow up requests to reset your password.

The legal basis for processing is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in conjunction with Art. 32(1) GDPR. The storage of information on your end device and access to information already stored on your end device are justified by the fact that the storage of the information and access to the information within the meaning of Section 25 (2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) are essential in order to provide you with the desired app service.

Toll Collect stores the login details for your customer account for 30 days from the time when you unregister.

The provision of login details is not legally or contractually required and is not necessary for the conclusion of a contract. You are not obliged to provide the login details. However, failure to provide the login details would mean that you would not be able to use the TollNow application.

Declaration

Toll Collect processes the vehicle characteristics relevant to the toll amount for the purpose of selecting and using the vehicles already stored in the customer account for a TollNow journey, for checking and, if necessary, adjusting the vehicle declaration before each TollNow journey, and to enable you to reuse the last vehicle declaration entered.

The legal basis for this processing is Art. 6(1)(e) GDPR in conjunction with Section 4(3)(3) German Federal Trunk Road Toll Act (BFStrMG).

The provision of data relevant to toll collection is required by law in accordance with Section 5a (1) and (3) of the German Truck Toll Regulations. If you wish to use TollNow, you are obliged to provide the relevant data for toll collection in accordance with Section 5a (1) and (3) of the German Truck Toll Regulations. Failure to provide the data would mean that you would not be able to use TollNow for toll payment.

The last declaration used for each vehicle is saved long-term in the TollNow app. Toll Collect deletes vehicle declaration data one year after the relevant vehicle is unregistered.

Journey authorisation and credit check

For the purpose of ensuring all prerequisites are met for starting a journey, the following checks are made: technical data on the app, such as the app ID and device type, status of the device (battery status, power-saving mode, internet connection available, required app authorisations), declaration data, and data for authorising the payment method.

The legal basis for this processing with respect to the declaration data is Art. 6(1)(e) GDPR in conjunction with Section 4(3)(3) German Federal Trunk Road Toll Act (BFStrMG). The legal basis for the processing of the technical app data and the authorisation data for the means of payment is Art. 6(1)(f) GDPR. Toll Collect has a legitimate interest in maintaining the operation of the app and avoiding financial risks. Access to information already stored on your terminal device for the purpose of checking the requirements for starting a journey is justified by the fact that access to the information within the meaning of Section 25 (2) No. 2 TDDDG is essential in order to provide you with the desired app service.

The provision of declaration data is required by law in accordance with Section 5a (1) and (3) of the German Truck Toll Regulations. The provision of other data is neither contractually nor legally required and you are not obliged to provide this data. However, failure to provide the data would mean that you would not be able to use TollNow for toll payment.

Toll collection

User, vehicle and position data are collected for the purpose of logging on to start a TollNow journey. The legal basis for processing is Art. 6(1)(e) GDPR in conjunction with Section 4(3)(3) German Federal Trunk Road Toll Act (BFStrMG). The data is transferred to the central systems and processed there for toll collection, for quality assurance of toll collection and to prevent fraud in connection with toll collection.

The legal basis for this processing is Art. 6(1)(e) GDPR in conjunction with Section 4(3)(3) German Federal Trunk Road Toll Act (BFStrMG). The storage of information on your end device and access to information already stored on your end device are justified by the fact that the storage of the information and access to the information within the meaning of Section 25 (2) No. 2 TDDDG are essential in order to provide you with the desired app service.

The provision of data required for the operation of the toll collection system is required by law in accordance with Section 4 (3) sentence 3 of the German Federal Trunk Road Toll Act (BFStrMG). If you wish to pay the toll using TollNow, you are obliged to provide the data required for the operation of the toll collection system in accordance with Section 4 (3) sentence 3 German Federal Trunk Road Toll Act (BFStrMG). Failure to provide the data would mean that you would not be able to use TollNow for toll payment.

The positioning data processed for toll collection is anonymised or deleted immediately after passing through the recognition process. Anonymised positioning data is deleted after no later than 120 days. All other data processed for toll collection will be deleted or anonymised after 180 days from the time of collection.

Journey overview and creation of TollNow receipts

The TollNow app saves an overview of your past journeys. You can use the journey overview to generate TollNow receipts for the relevant journeys and use them as PDF documents via the "Share" function on your device.

The purpose of the processing is to provide you with information about your past journeys.

The legal basis for the processing is Art. 6(1)(e) GDPR in conjunction with Section 4(3)(3) German Federal Trunk Road Toll Act (BFStrMG). The storage of information on your terminal equipment required for the journey overview and the creation of TollNow receipts is justified by the fact that the storage of the information within the meaning of Section 25 (2) No. 2 TDDDG is essential in order to be able to create the journey overview and TollNow receipts requested by you.

Past journeys are stored for 120 days from the time the journey was completed.

Blocking toll payment via TollNow

The operation of the TollNow app and toll collection are continuously monitored and quality assured. This is done for the purpose of recognising and eliminating technical errors and irregularities that could lead to missing toll collections. You will be notified of any errors identified in the form of a warning message. If the errors and irregularities detected cannot be rectified, TollNow will block toll payment.

The legal basis for the processing of toll data is Art. 6(1)(e) GDPR in conjunction with Section 4(3)(3) German Federal Trunk Road Toll Act (BFStrMG). The legal basis for reporting errors is Art. 6(1)(f) GDPR. Toll Collect's legitimate interest in reporting errors is to maintain the operation of the app. The storage of information in your end device and access to information already stored on your end device are justified by the fact that the storage of the information and access to the information within the meaning of Section 25 (2) No. 2 TDDDG are essential in order to provide you with the desired app service.

The provision of data required for the operation of the toll collection system is required by law in accordance with Section 4 (3) sentence 3 of the German Federal Trunk Road Toll Act (BFStrMG). If you wish to pay the toll using TollNow, you are obliged to provide the data required for the operation of the toll collection system in accordance with Section 4 (3) sentence 3 German Federal Trunk Road Toll Act (BFStrMG). Failure to provide the data would mean that you would not be able to use TollNow for toll payment.

Toll Collect stores the information about payment blocking until this functionality is manually unblocked.

Enforcement

Toll Collect processes the enforcement data listed in Section 7 (2) sentence 1 German Federal Trunk Road Toll Act (BFStrMG) to monitor compliance with the toll requirement.

The legal basis for the processing is Art. 6(1)(e) GDPR in conjunction with Section 7(2) sentence 1 German Federal Trunk Road Toll Act (BFStrMG). The storage of information on your end device and access to information already stored on your end device are justified by the fact that the storage of the information and access to the information within the meaning of Section 25 (2) No. 2 TDDDG are essential in order to provide you with the desired app service.

The provision of the data required for enforcement is prescribed by law in accordance with Section 7 (2) sentence 1 German Federal Trunk Road Toll Act (BFStrMG). Failure to provide the data would mean that you would not be able to use TollNow.

Toll Collect stores the enforcement data provided by the TollNow app for a maximum of ten days from the time of collection if the toll has been duly paid. If Toll Collect discovers during the toll requirement enforcement that the toll has not been paid correctly, Toll Collect will store the enforcement data until the administrative procedure for subsequent toll collection has been completed

Logging

If you have given your consent, Toll Collect stores the following information on your terminal device and accesses it in order to subsequently process it for the purpose of technical error analysis, improving the stability of the application, optimising performance and ensuring operational security:

• Interaction and navigation data
• Journey-related data
• Device and system data
• Setting and localisation data (region, time zone)
• App and version data
• Environment data and library information
• Diagnostic and performance data

The legal basis for storing the information on your end device and accessing the information that is already stored on your end device is Section 25 (1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The legal basis for the subsequent processing of personal data is Article 6(1)(a) GDPR and Section 4(3) sentence 3 German Federal Trunk Road Toll Act (BFStrMG) for the processing of journey-related data.

Toll Collect stores this data for 42 days from the time of collection.

The provision of data is not required by law or contract and is not necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide the data would have no consequences for you.

Crash reports

If you have given your consent, Toll Collect stores the following information on your device:

• Interaction data
• Journey-related data
• Timestamp
• Devices and platform information
• Activity states
• System operations
• System events
• Geolocation operation logs (without location data)
• Information about the app logic

If the TollNow app is unexpectedly terminated by the system or if other operational abnormalities occur, you can send this data and an error description to Toll Collect via an error report.

The purpose of the processing is to track technical processes, evaluate usage processes, analyse functional processes and identify systematic sources of error in order to improve the TollNow app based on the knowledge gained.

The legal basis for the storage of the information on your end device is Art. 25 (1) sentence 1 TDDDG in conjunction with Art. 6(1)(a) GDPR. The legal basis for the subsequent processing of personal data is Article 6(1)(a) GDPR and Section 4(3) sentence 3 German Federal Trunk Road Toll Act (BFStrMG) for the processing of journey-related data.

The provision of data is not required by law or contract and is not necessary for the conclusion of a contract. You are not obliged to provide the data. Failure to provide the data would have no consequences for you.

Push notifications

Toll Collect sends silent and visible push notifications to your device if contact with the TollNow app is lost during a TollNow journey.

The purpose of silent push notifications is to reactivate the TollNow app in cases where it has been deactivated by your device's operating system. The purpose of the visible push notifications is to inform you about the termination or crash of the TollNow app during a TollNow journey and to provide proof that you have taken note of the interruption of toll collection via TollNow. For this purpose, Toll Collect processes the location and time of the notification as well as the location and time that the notification was acknowledged.

Toll Collect uses the Firebase Cloud Messaging service to send push notifications. With Firebase Cloud Messaging, a registration token that uniquely identifies your app instance is stored on your end device when you start the TollNow app for the first time.

The legal basis for the processing is Art. 6(1)(f) GDPR. The legitimate interests that Toll Collect pursues by sending push notifications are to ensure that tolls are collected for the use of toll roads, to support the obligations of toll debtors to cooperate and to avoid subsequent collection and administrative offence proceedings. The storage of information on your end device required for the push notifications and the access to information already stored on your end device are justified by the fact that the storage of the information and the access to the information within the meaning of Section 25 (2) No. 2 TDDDG are essential in order to be able to provide you with the desired app service.

Toll Collect stores the registration token for 60 days. The registration token is stored on your end device until you uninstall the TollNow app. Toll Collect stores the push notifications and the associated confirmations for 120 days from the time of creation or collection.

The provision of the registration token is not required by law or contract and is not necessary for the conclusion of a contract. You are not obliged to provide the registration token. However, failure to provide the registration token would mean that you would not be able to use the TollNow app to pay the toll.

Access authorisations required for the app functions

• For Android (from version 6) Other: access all networks, deactivate hibernation mode, receive internet data, retrieve network connections, retrieve WLAN connections
• For iOS mobile data: Internet data also received outside a WLAN area
• Basic functions: The app must be able to store and transfer data. To do this, it requires authorisations to change and delete the contents of the memory.
• Location data: To be able to determine the route travelled with the app, the current location must be transmitted. As the app can also run in the background on the device during a journey, permanent authorisation is required: "When using the app" is not sufficient.
• Messages: To display necessary information on the collection status of your journey.
• Push notifications: We are interested in informing you about important events (for example, certain error statuses during data collection) within the app. This is done with so-called push notifications. You must expressly agree to this by giving the appropriate operating system approval.

Further optional access permissions

• Activity Recognition: Improves the functionality of the app by detecting certain movement states of the device. Consent can be revoked at any time by disabling the live activity function in the app or device settings.
• Login with biometric authentication (Face ID/facial recognition, Touch ID/fingerprint recognition) Enables the use of fingerprint or facial recognition in user authentication. Processing is carried out by the end device. Only the result of the check is sent to the app. You must expressly agree to the use of facial recognition by giving the appropriate operating system approval. Consent can be revoked at any time by disabling facial recognition in the app or device settings.

Toll Collect GmbH will disclose your personal data that is processed within the scope of TollNow to the following recipients or categories of recipients:

• Federal Logistics and Mobility Office (BALM) for enforcement of compliance with the toll requirement, the implementation of administrative offence proceedings and operator monitoring as the controller within the meaning of Art. 4(7) GDPR
• Parties involved in payment transactions as controllers within the meaning of Art. 4(7) GDPR
• Service providers as processors within the meaning of Art. 4(8) GDPR (e.g. for the operation of our computing centre or development service providers for the further development of the toll collection system)

Toll Collect obtains the Firebase Cloud Messaging service from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes the personal data for Toll Collect as a processor within the meaning of Art. 4(8) GDPR. Google Ireland Limited also uses other processors who process the personal data in so-called third countries outside the European Economic Area. An overview of these other processors is available via the following link:

https://cloud.google.com/terms/subprocessors?hl=de .

The European Commission has issued adequacy decisions for transfers to the other processors in Argentina, Israel, Japan, the Republic of Korea (South Korea), Switzerland, the United Kingdom and — if the other processor is certified under the EU-US Data Privacy Framework — the United States of America. The other transfers are based on the standard contractual clauses for the transfer of personal data to third countries, which are available via the following link:

https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=de .

Toll Collect only your personal data stores for as long as is permissible under data protection law. The specific time of deletion is determined according to the following criteria:

• If a fixed statutory deletion period applies, Toll Collect deletes your personal data no later than the end of the statutory period.
• If a statutory retention obligation applies, Toll Collect deletes your personal data once the data retention obligation ends and the data is no longer required for the business processes of Toll Collect.
• If neither a statutory deletion period nor a statutory retention period applies, Toll Collect deletes your personal data as soon as it is no longer required for the businesses processes of Toll Collect.

Timely deletion is safeguarded by a deletion concept in accordance with DIN 66398.

You have the following rights with regard to processing of personal data that relates to you:

• Right to information,
• Right to correction,
• Right to deletion ("right to be forgotten"),
• Right to restrict processing,
• Right to data communicability.

You have the right to object at any time to the processing of personal data concerning you, provided that the processing is carried out for the performance of a task in the public interest or in the exercise of official authority (Art. 6(1)(e) GDPR) or for the protection of legitimate interests (Art. 6(1)(f) GDPR).

Once consent is granted, you have the right to revoke that consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

You also have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by Toll Collect.

.

TollNow's processing operations are not related to decisions based solely on automated processing, including profiling.