Data Protection Notice

Introduction

a) About TII

Transport Infrastructure Ireland (“TII”) is the operational name of the National Roads Authority (“NRA”) following the dissolution of the Railway Procurement Agency and the transfer of its functions to the NRA in accordance with the Roads Act 2015. TII’s main address is Parkgate Business Centre, Parkgate Street, Dublin 8, D08 DK10, Ireland.

b) About eFlow

eFlow is a registered business name of TII (references to “eFlow” in this notice are references to Transport Infrastructure Ireland). eFlow (TII) operates the barrier-free tolling system on Dublin’s M50 motorway and it is also a provider of electronic tags for use in connection with the payment of tolls on all toll roads in the Republic of Ireland.

The eFlow tolling service is managed and operated on behalf of TII by Turas Mobility Services Ltd., an Irish company based in Dublin.

Purpose of Notice

eFlow (TII) is the controller of personal data that is collected and processed in accordance with this notice.

The purpose of this notice is to inform you of the personal data relating to you that eFlow may collect and process in order to provide toll road services and the uses (including disclosures to third parties) that eFlow may make of such personal data. eFlow fully respects your right to privacy and is committed to protecting your personal data. Any personal data that is processed in relation to the eFlow business is processed in accordance with applicable data protection law.

Contacting eFlow

You can contact eFlow in the following ways:

by post: Data Protection Officer, Block 8, Harcourt Centre, Charlotte Way, Dublin, D02 K580
by email: dataprotection@eflow.ie
by phone: 0818 50 10 50 (International: +353 1 4610122
by using the Webchat with the eFlow team on the eFlow website

Personal Data Processed by eFlow

The processing of personal data is required in order to provide toll road services to eFlow customers. eFlow may collect and process some or all of the following personal data in relation to you:

Personal data category	Description
Registered account data (i.e. toll road users with a registered eFlow account)	• full name • contact details including your postal address, email address and contact telephone number • licence plate number and captured image of same from M50 journey • journey reference number • tag provider and tag number • credit card, debit card or direct debit details • toll road passage information payment history • correspondence and telephone conversation recordings with eFlow
Unregistered account data (i.e. toll road users who have not registered an account with eFlow)	• full name • postal address (and on occasion, your phone number and email address) • licence plate number and captured image of same from M50 journey • M50 passage information • payment history • correspondence and telephone conversation recordings with eFlow
Communications data	When you contact eFlow by phone, email or through the eFlow website, eFlow records details of those communications (e.g. correspondence records, web message, letter/fax correspondence, phone call recordings including logs of phone calls, etc.) and any other details which you may provide
Payments data	For the purpose of processing payments, eFlow may collect credit card or debit card details
Exempt Vehicle data	• licence plate number and captured image from M50 journey • journey reference number • tag provider and tag number
Customer Satisfaction Survey data	· name and contact details (email address and mobile telephone number) · account number (in the case of registered customers) · type of vehicle · details of account (in the case of registered customers) · survey responses (including verbatim comments) · licence plate number

Sources of Personal Data

The personal data relating to you that eFlow holds is generally collected directly from you (e.g. when you use eFlow services). As well as collecting information from you directly, eFlow may receive or collect information about you and your vehicle from the following sources:

the National Vehicle and Driver File, in accordance with specific legislative authority;
foreign vehicle licensing authorities, in the countries in which the vehicle is registered;
vehicle rental companies, to enable eFlow to contact you and request the payments for your passage;
Compatible Operators in connection with the processing of interoperable toll transactions;
toll passage photographic and video recordings for all vehicles that use the M50 toll road; and
cameras/CCTV on the M50.

Legal Bases

The personal data described above is used by us and by third party service providers acting on our behalf. The legal bases on which we collect, process and transfer your personal data for these purposes are:

where such processing is necessary to comply with TII’s legal and regulatory obligations (“Legal Obligation”);
where such processing is necessary to carry out its tasks in the public interest and/or in the exercise of official authority vested in TII (“Public Interest/Official Authority”);
where such processing is necessary for the performance of a contract with you or where it is necessary to take steps at your request prior to entering into a contract with you (“Contract”); and
your consent (“Consent”), where this is the case you will be asked to give a positive indication of that consent.

Purpose of Processing Activities and Legal Bases

eFlow processes personal data in order to:

Purposes	Categories of personal data	Legal bases
To ensure that payment is obtained from all road users using eFlow services in accordance with TII’s statutory obligations	Registered account data Unregistered account data Payment data	Public Interest/Official Authority, pursuant to section 59(1) of the Roads Act 1993 (as amended) and Bye-law 5 of the Bye-Laws for the M50 (between Junctions 6 and 7) (the “M50 Bye-Laws”) Contract (in relation to registered eFlow customers)
To outsource services to third party service providers	Registered account data Unregistered account data Communications data	Public Interest/Official Authority, pursuant to section 63 of the Roads Act 1993 (as amended)
To respond to queries and complaints	Registered account data Unregistered account data Communications data	Contract (in relation to registered eFlow customers) Public Interest/ Official Authority, pursuant to the Roads Act 1993 (as amended)
To issue proceedings (civil and criminal) with respect to unpaid tolls	Registered account data Unregistered account data Communications data Payment Data	Public Interest/ Official Authority pursuant to sections 59(1) and 81(3)(b) of the Roads Act 1993 (as amended)
To comply with TII’s other statutory obligations	Registered account data Unregistered account data Communications data Payment data	Legal Obligations under Part V of the Roads Act 1993 (as amended) and the M50 Bye-Laws
Where you are a registered eFlow customer, to maintain your account	Registered account data	Performance of a contract
Exempt vehicle data	Exempt Vehicle Data	Public Interest/Official Authority, pursuant to section 62 of the Roads Act 1993 (as amended) and Bye-law 12 of the M50 Bye-Laws
To undertake customer satisfaction surveys	Registered account data Unregistered account data Fleet accounts	Public Interest/ Official Authority, pursuant to the Roads Act 1993 (as amended) – participation in surveys is entirely voluntary

The legal basis on which we collect, process and transfer special categories of data relating to you (e.g. data relating to health) in the manner described above are that Public Interest and Consent (specifically, your explicit consent to such processing).

The legal basis for processing your personal data for the purposes of criminal proceedings is TII’s performance of its statutory functions with regard to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties in connection with unpaid tolls.

Transfers Abroad

In connection with the above, eFlow may transfer your personal data outside the European Economic Area to service providers in India and the United States of America, both of which are jurisdictions which are not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. In such circumstances, eFlow ensures that appropriate measures are in place to comply with its obligations under applicable law governing such transfers. One such measure is entering into a contract governing the transfer which contains the ‘standard contractual clauses’ approved for this purpose by the European Commission. Currently, these standard contractual clauses are the basis on which eFlow ensures that transfers can be made in a manner which is compliant with applicable data protection law.

The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection. In this regard, eFlow relies on the adequacy decisions in respect of transfers to W5 Marketing Intelligence Ltd. in the UK and to Kapsch Trafficcom Argentina S.A. in Argentina (see further details below).

Further details of the measures that eFlow has taken in this regard are available from the eFlow Data Protection Officer, using the contact details indicated above.

Recipients of Data

In connection with eFlow, the following are the key recipients of personal data processed by TII:

*Recipient of Personal Data*	*Purposes of Processing*
Turas Mobility Services Ltd.	For the operation and management of eFlow
Abtran Unlimited Company	Host and operate the customer channels subsystem
Pierse Fitzgibbon Solicitors LLP	Provision of enforcement services for unpaid tolls by domestic vehicles
Euro Parking Collection plc	Provision of collection and enforcement services for unpaid tolls incurred by foreign registered vehicles
TollPlus LLC	Support services in connection with the operation of eFlow
Kapsch Trafficcom Argentina S.A.	Support and troubleshooting in connection with captured images
W5 Marketing Intelligence Limited	Data storage in connection with customer surveys

We may also disclose any of your personal data detailed in the “Personal Data Processed by eFlow” section above to other organisations in connection with the above purposes, in the following circumstances:

We may share personal data with our agents, contractors and service providers who assist us with the operation of aspects of our services and functions, such as our payment card processor, banking and printing/postal correspondence contractors, foreign vehicle licensing authorities and law enforcement agencies.
Where we appoint a new operator of eFlow, we may share personal data with this new operator in order to facilitate the successful transition to the new operator and to ensure continuity of service for eFlow customers during any transition period.
Where we are under a duty to disclose or share personal data in order to comply with any legal obligation, or to protect the rights, property or safety of eFlow, our customers, or others.
Where required or permitted by law, we may share your personal data with other public authorities and bodies, such as the Gardaí or other law enforcement authorities for the purposes of the prevention, investigation, detection, or prosecution of criminal offences or the execution of criminal penalties.
In connection with the processing of interoperable toll transactions in Ireland, we may disclose your personal data to a relevant compatible operator.
We may share toll passage data with key stakeholders, e.g. the Department of Transport, for the purposes of research and statistical analysis.
For the purpose of operating competitions on behalf of TII we may disclose, subject to your consent, your name, email address and marketing preferences provided to us by you.
Where we are otherwise permitted by law.

Retention

Generally, we will only retain your personal data for as long as necessary for the purpose or purposes for which it was obtained, including for the purposes of satisfying any legal, accounting, or reporting requirements. The retention periods differ depending on the type of categories of personal data held.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Further specific information on our retention practices in relation to the processing activities discussed above is available from the eFlow Data Protection Officer, using the contact details indicated above.

Necessity of Provision of Certain Information and Consequences

You are not under a statutory obligation to provide eFlow with any personal data. However, there are certain pieces of information that you must provide to us in order to open an eFlow account or pay a toll or a penalty (e.g. your name, your contact details and payment details). If we do not receive this information, this will impact our ability to (i) process your application; and/or (ii) process your payment (which may result in enforcement proceedings).

Security of Your Information

The personal data which we process is held on secure servers hosted by Turas Mobility Services Ltd. eFlow has adopted appropriate technical and organisational security measures to protect your information from unauthorised access and against unlawful processing, accidental loss, destruction or damage. We will also ensure that our agents or third-party service providers who process your data are required to keep your data safe and secure.

Your Rights

You have the following rights, in certain circumstances and subject to certain restrictions, in relation to your personal data:

Right to access the data – You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
Right to rectification – You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information such that it is complete.
Right to erasure – You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.
Right to restriction of processing or to object to processing – You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
Right to data portability – You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.

Please note that these rights are not absolute and are subject to certain restrictions and exemptions. For example, the right to erasure of personal data will not apply where we have a legitimate reason to continue to hold such data and we may continue to process your personal data, despite an objection by you, where we have compelling legitimate grounds for the processing which override your interests, rights and freedoms.

In order to exercise any of the rights set out above, please contact the eFlow Data Protection Officer, using the contact details indicated above.

Questions and Complaints

If you have any questions or complaints about our use of your personal data, please contact us using the contact details above. Alternatively, TII’s Data Protection Officer may be contacted as follows:

by post: Data Protection Officer, Transport Infrastructure Ireland, Parkgate Business Centre, Parkgate Street, Dublin 8, D08 DK10
by phone: +353 1 646 3600
by email: dataprotection@tii.ie

Further information about data protection can be found on the Data Protection Commission’s website: www.dataprotection.ie

You also have the right to lodge a complaint with the Data Protection Commission if you are not happy with the way we have used your information or addressed your rights. Details of how to lodge a complaint can be found on the Data Protection Commission’s website.

Updates

We may amend this Data Protection Notice from time to time. Any material changes we make to this Data Protection Notice in the future will be posted to our website (www.eflow.ie). This Data Protection Notice was last updated on 7 November 2023.