Personal data

Information for the processing of personal data in ASFINAG toll systems
  1. ASFINAG as the responsible body for toll system data processing
    1. The responsible body for the data processing described in the following is ASFINAG Autobahnen- und Schnellstraßen-Finanzierung-Aktiengesellschaft, 1011 Vienna, Rotenturmstraße 5-9, Postbox 983, T +43 (0) 50 108-10000, F +43 (0) 50 108-10020, office@asfinag.at, FN 92191 a (hereinafter "ASFINAG").
    2. The ASFINAG data protection officer can be contacted under: ASFINAG data protection officer, c/o Autobahnen- und Schnellstraßen-Finanzierung-Aktiengesellschaft, 1011 Vienna, Rotenturmstraße 5-9, postbox 983, datenschutz@asfinag.at, T +43  (1)  9551266, F +43 (1) 9551277

  2. Background of the processing in the toll systems
    1. Tolls must be paid when using motor vehicles on the federal roads (§ 1 BStMG - Federal Roads Toll Act). The toll is payable either for routes navigated (mileage-related toll) or for certain periods (time-based toll) or for certain toll roads (A9, A10, A11, A13, S16) in accordance with special road financing laws. The use of toll roads with multi-lane motor vehicles whose maximum permissible gross vehicle weight is more than 3.5 tons is always subject to mileage-based road tolls (GO toll). The time-dependent toll for single-lane and multi-lane motor vehicles, whose maximum permissible total weight is not more than 3.5 tons is always paid prior to the use of toll roads by attaching a sticker to the vehicle or by registering the vehicle license plate in the ASFINAG toll system (digital vignette).  The use of certain toll roads (A9, A10, A11, A13, S16) is always subject to the usage-based toll ((digital) section toll).
    2. The processing of certain data by ASFINAG is mandatory for the purchase, management and control of toll products, namely the GO toll, the (digital) vignette and/or the (digital) section toll. The purpose, data categories, recipient and processing time are shown separately in objective information depending on the toll product.
    3. The processing of personal data by ASFINAG itself or on its behalf by the processors referred to below, takes place exclusively within the European Union and under the provision of appropriate data security.
    4. ASFINAG will not process personal data for any purpose other than the one for which the personal data was collected.

  3. Legal basis for processing
    1. According to Federal Roads Toll Act (BStMG), ASFINAG is entitled to process personal data required for toll collection, toll monitoring and tracking of toll evasion in an automated manner. Unless otherwise described below, the purpose and legal basis of data processing arise directly from the BStMG.
    2. According to § 16a BStMG, ASFINAG may use the following data within the scope of the mileage-based toll: Data on devices for electronic payment of the mileage-based toll; data on vehicles whose use on federal roads is subject to mileage-based tolls; contact, communications, payment, transaction, and billing data; data relating to interoperable toll systems; data on cases of toll evasion.
    3. According to § 16a BStMG, ASFINAG may use the following data within the scope of the time-based toll as well as the section toll: Data regarding vehicles that have a digital vignette or digital section toll authorization; contact, communications, payment, and billing data; transactions data in the case of section toll; data on cases of toll evasion.
    4. In accordance with § 19a BStMG, ASFINAG may use technical facilities to ascertain the correct payment of tolls and to prosecute toll evasion, which allows in particular the registration of vehicle type, number of axles, vehicle windscreen, vehicle driver, license plate, adhesive toll vignette, location and time of road use. The use of imaging equipment to determine the proper payment of time-based toll must be made on regularly changing toll sections, but this may take place at each toll section several times a year. For details, see point 8.
    5. The legal basis for the processing of personal data in the quality control system for toll collection in the fully electronic HGV/truck toll system in Austria (GO toll) is predominantly the legitimate interests of ASFINAG, namely that its processing for the monthly or annual expert assessment of compliance with the contractual (quality) requirements by the operators of the GO toll system are necessary.
    6. The legal basis for the processing of personal data in connection with voluntary additional services (in particular "my account" in the ASFINAG online shop and in the ASFINAG app) is the purchaser's consent to the respective services.  The purchaser has the right to revoke the consent at any time without affecting the legality of the processing carried out on the basis of its consent until the revocation.
    7. The data processing mentioned in this document is duly registered with the Austrian Data Processing Register under DVR number 0527602.

  4. Digital Vignette
    1. The digital vignette can be purchased from the ASFINAG online shop, the ASFINAG app "Unterwegs" and at machines.
    2. Upon request, the digital vignette can be purchased using credit cards, PayPal and bank transfer stating any e-mail address.  In the case of purchasing from a distance, it is necessary to state an active e-mail address in order to be able to send to the purchaser a confirmation and reference data regarding the digital vignette, which they require in the event of withdrawal, re-registration or change, and to be able to send the purchaser an invoice.
    3. ASFINAG collects the following data categories with regard to the purchaser for obtaining and managing the digital vignette: License plate number, country of registration, vignette number, type of license plate, purchased digital vignette product, status or period of validity, e-mail address, reference date, purchase price and method of payment, data on payment processing including data on billing, system via which the purchase has been made (ASFINAG online shop, in the ASFINAG app "Unterwegs" or on machines), including any user settings in the system or Device-ID or Google Account ID, data for the confirmation e-mail pursuant to § 10 ECG, as well as the date and time for any withdrawal and processing of the purchase of the digital vignette in accordance with the FAGG (including name and address).
      With regard to the purchaser when using registration codes, the registration number, the registration code and the master data and administrative data (valid for product, date system import, status, date activation, date lock) and date of redemption.
      With regard to the purchaser when paying with a credit card or bank transfer:   Product name, unit price, total price, invoice number, the transaction or approval number of the payment service provider, status of payment (OK, rejected, terminated, ...) and if paying by credit card also the type of credit card (Amex, Diners, Visa, ...). With regard to the purchaser when using the PayPal payment service:  E-mail address, product name, unit price, total price, invoice number and the transaction number of PayPal and payment status (OK, rejected, terminated, ...).
      With regard to the consumer that (voluntarily) registered to use “My Account” functionalities: The identification number, name, contact details (including e-mail validation data), billing data, registration time, request for notification by e-mail before expiry (yes / no), the access data, particularly the username and password, the allocation of already purchased products, and the user settings for "My Account" in the Web/ App.
      With regard to a company that (voluntarily) registered to use "My Account" functionalities (in addition to consumer data above): The billing data, the customer (organizational unit), contact person, and any purchase conditions.
      With regard to a company contact person (additionally), their name and the contact details.
      With regard to the purchaser and the registration holder of digital vignette products to which changes have been made, the business case identification number, the original and new data (history), the system with which the change was made (Web) and the identification data.
      With regard to the purchaser and the registration holder of digital vignette products to which changes have been made to the motor vehicle license plate number (additionally) the name, the address, the reason for the change, proof (documents proving the facts, e.g. relocation, ...) and the result of the review of the facts, the status of the change (provisional, ...), as well as the data on vehicle registration holders and the data in connection with any reimbursement of expenses (invoice number,  amount of collected reimbursement of expenses regarding the above information, time of collection, payment processing), as well as the comments on the change process.
      With regard to the vehicle registration holder of a motor vehicle up to 3.5 t maximum permissible weight with a digital vignette (vehicle data possibly from a central motor vehicle registry) the license plate number, the country of registration, the vignette number, the type of license plate, the digital vignette product purchased, the status or the period of validity, the vehicle owner, and vehicle owner's address.
      With regard to the registration holder, whose vehicle license plate is registered as exempt from the toll payment or who has a user authorization in accordance with the toll ordinance, the vehicle license plate number or license plate part, the date of registration, the name of the organization of the registration holder, the date of commencement of the exemption, the date of the end of the exemption and the documents proving the exemption.
    4. The data related to the receipt of the digital vignette will be deleted after the expiration of the tax law archiving period. Data related to replacement vignettes will be deleted no later than one year after completion of the process.
      Business letters and other correspondence shall be deleted within the meaning of § 212 UGB at the latest after seven years (end of the calendar year).
      Data related to "My Account" will be deleted immediately after termination of "My Account" by the user.
    5. Where necessary for (re)payment processing, the following data categories will be transmitted to the payment service provider:
      With regard to the purchase of a digital vignette by credit card or by bank transfer: Product name, unit price, total price, invoice number, method of payment, and in the case of repayment processing the transaction or approval number of the payment service provider. With regard to the purchaser of the digital vignette when using the PayPal payment service: The e-mail address, product name, unit price, total price, invoice number, and on repayment processing the PayPal transaction number.
      With regard to the purchaser and/ or registration holder where changes were made to their digital vignette products (only for vehicle license plate changes): Data in connection with any reimbursement of expenses (invoice number, amount of collected reimbursement, collection time, payment).
      The transmission is made based on corresponding contracts between the payer and the payment service provider as well as between the payment service provider and ASFINAG.
    6. ASFINAG uses the following processors to guarantee a correspondingly high quality, security and availability of the purchase options:

      Company Address Order processing category
      ASFINAG Maut Service GmbH 1120 Wien, Am Europlatz 1 Product development and operation
      ACP IT Solutions GmbH 1120 Wien, Wagenseilgasse 3 Technical Support
      Atos IT Solutions and Services GmbH 1210 Wien, Siemensstraße 92 Technical Support
      Tieto Austria 1200 Wien, Handelskai 94-96 Technical Support
  5.  (Digital) section toll
    1. ASFINAG's section toll products can either be purchased on-site at toll points or digitally online.
    2. The digital section toll can be purchased from the ASFINAG online shop, the ASFINAG app "Unterwegs", at points of sale, and at machines. Upon request, the section toll can be purchased using credit cards, PayPal, or bank transfer stating any e-mail address. In the case of purchasing from a distance, it is necessary to state an active e-mail address in order to be able to send to the purchaser a confirmation and reference data regarding the digital section toll, which they require in the event of withdrawal, re-registration or change, and to be able to send the purchaser an invoice.
    3. ASFINAG collects the following data categories with regard to the purchaser for obtaining and managing the (digital) section toll:
      With regard to the vehicle registration holder of a motor vehicle up to 3.5 t maximum permissible weight when paying the toll on-site from a toll machine or person paying the toll for the license plate number (text and image): The country of registration, the toll ticket number, type of license plate, the authorized toll road section, the purchase date, the purchase price, the location, the date, the time of the navigated toll lanes (entrance and if necessary exit), as well as the refund amount (in case of leaving the toll road at an earlier exit).
      With regard to the vehicle registration holder of a motor vehicle up to 3.5 t maximum permissible weight on the purchase of a toll ticket (single journey, monthly ticket, annual ticket, prepaid ticket, ...) in advance: The license plate number (text and image), the country of registration, the toll ticket number, the authorized toll section(s), the date of purchase, the purchase price, the number of the annual vignettes (if the annual vignette is credited to the purchase price of the toll ticket), the validity period of the toll ticket, the vehicle registration certificate data (for vehicle-related time-dependent billing), the remaining balance (for mileage-based billing), the name (for annual ticket subscriptions and discount tickets), the address (for annual season tickets and discount tickets), the type of employment (discount tickets for commuters and military), the period of service of the military service (discount tickets for military), the address of the workplace and distance from the place of residence (for discount tickets for commuters and military), the employer's confirmation of the amount of the commuter allowance (for commuter discount tickets), the confirmation of registration data (for commuter discount tickets and military), data proving the total loss (if the toll ticket is transferred to another license plate), the location, the date, the time of the navigated toll lanes (entrance and if necessary exit), as well as the refund amount (in case of leaving the toll road at an earlier exit).
      With regard to the ticket holder (when paying with these payment methods) on the purchase of a toll ticket (single journey, monthly ticket, annual ticket, prepaid ticket, ...) the credit, debit or fuel card number or instead the payment service provider’s transaction number.
      With regard to the purchaser of toll tickets in advance through the ASFINAG APP "Unterwegs" or the ASFINAG website: The e-mail address, the payment service provider’s transaction number, the data for the confirmation e-mail pursuant to § 10 ECG, as well as the date and the data on any cancellation and processing of the purchase as defined by FAGG (including name and address). With regard to the purchaser of toll tickets by advance sale via the ASFINAG APP "Unterwegs" the Device-ID or the Google-Account-ID, as well as the password for the recording of credit card information.
      With regard to the customer’s clerk (when paying the toll on-site or purchasing a toll ticket at a point of sale): The toll purchaser’s number. With regard to the vehicle registration holder of a motor vehicle over 3.5 t maximum permissible weight: 
      The license plate number (text and single image), as well as the country of registration.
      With regard to the purchaser when paying with a credit card or fuel card: Product name, unit price, total price, invoice number, the transaction or approval number of the payment service provider, status of payment (OK, rejected, terminated, ...) and if paying by credit card also the type of credit card (Amex, Diners, Visa, ...). With regard to the purchaser when using the PayPal payment service: E-mail address, product name, unit price, total price, invoice number and the transaction number of PayPal and payment status (OK, rejected, terminated, ...).
      With regard to the consumer that (voluntarily) registered to use “My Account” functionalities for digital section toll products: The identification number, name, contact details (including e-mail validation data and any billing data), registration time, request for notification by e-mail before expiry (yes / no), the access data, particularly the username and password, the allocation of already purchased products, and the user settings for "My Account" in the Web/ App.
      With regard to a company that (voluntarily) registered to use "My Account" functionalities for digital section toll products (in addition to consumer data above): The billing data, the customer (organizational unit), contact person, and any purchase conditions. With regard to a company contact person (additionally), their name and the contact details.
      With regard to the purchaser and registration holder of digital section toll products to which changes have been made, the business case identification number, the original and new data (history), the system with which the change was made (Web, toll point) and the identification data.
      With regard to the purchaser and the registration holder of digital section toll products to which changes have been made to the motor vehicle license plate number (additionally) the name, the address, the reason for the change, proof (documents proving the facts, e.g. relocation, ...) and the result of the review of the facts, the status of the change (provisional, ...), as well as the data on vehicle registration holders and the data in connection with any reimbursement of expenses (invoice number, amount of collected reimbursement of expenses, time of collection, payment processing), as well as the comments on the change process.
      With regard to the sales partners: The name and/ or the name and company data, identification marks, the (electronic) contact data, the data for setting up the contract, the payment transaction information (IBAN, BIC, amounts, ...), the name of the point of sale of the sales partners and the contact persons. With regard to the contact person of sales partners: The name, contact data and the access data (user ID and password).
      With regard to the registration holder, whose vehicle license plate is registered as exempt from the toll payment or who has a user authorization in accordance with the toll ordinance, the vehicle license plate number or license plate part, the date of registration, the name of the organization of the registration holder, the date of commencement of the exemption, the date of the end of the exemption and the documents proving the exemption.
    4. The data required for toll collection using digital tolls will be deleted within one year from the use of the toll route respectively stored until then for documentation reasons. Data in connection with the purchase of the digital section toll will be deleted after expiry of the taxable filing period or the 30 years plus grace period resulting from the case law on the deadline for any duty to refund tolls until the end of the year. Business letters and other correspondence shall be deleted within the meaning of § 212 UGB at the latest after seven years (end of the calendar year).
      Data related to "My Account" will be deleted immediately after termination of "My Account" by the user.
    5. Where necessary for payment processing, the following data categories will be transmitted to the payment service provider: 
      With regard to the purchaser of the section toll at a toll point when paying by credit or debit card: Total price of the payment. With regard to the purchaser of the section toll at a toll point when paying with a fuel card:  Total price, location and time of payment and fuel card number.
      With regard to the purchase of a digital section toll by credit card or by bank transfer: Product name, unit price, total price, invoice number, method of payment, and in the case of repayment processing the transaction or approval number of the payment service provider. With regard to the purchaser of the digital section toll when using the PayPal payment service: The e-mail address, product name, unit price, total price, invoice number, and on repayment processing the PayPal transaction number. 
      With regard to the purchaser and registration holder where changes were made to their digital section toll products (only vehicle license plate changes): Data in connection with any reimbursement of expenses (invoice number, amount of collected reimbursement, collection time, payment).
      The transmission is made based on corresponding contracts between the payer and the payment service provider as well as between the payment service provider and ASFINAG.
    6. ASFINAG uses the following processors to guarantee a correspondingly high quality, security and availability of the purchase options:

      Company Address Order processing category
      ASFINAG Maut Service GmbH 1120 Wien, Am Europlatz 1 Product development and operation
      ACP IT Solutions GmbH 1120 Wien, Wagenseilgasse 3 Technical Support
      Atos IT Solutions and Services GmbH 1210 Wien, Siemensstraße 92 Technical Support
      Tieto Austria 1200 Wien, Handelskai 94-96 Technical Support
      CAT Traffic Cichon Automatisierungstechnik GmbH 4020 Linz, Wiener Straße 213 Technical Support
      Point of sales

      See

      www.asfinag.at/maut-vignette/vertriebsstellen
       
  6. GO Toll
    1. ASFINAG charges the following data categories in connection with the GO toll:
      With regard to the vehicle registration holder (from whom a mileage-related toll for the use of toll sections is to be paid): The name (from central motor vehicle certificate in accordance with § 30 BStMG and according to Section 5.6 of the toll regulations Part B), the address (from central motor vehicle certificate in accordance with § 30 BStMG and according to item 5.6 of the toll regulations Part B), the license plate number (for possible follow-up check of the central motor vehicle certificate according to § 30 BStMG and point 5.6 of the toll regulations Part B), the vehicle type (truck/ bus/ special vehicle) (from central motor vehicle certificate according to § 30 BStMG and according to item 5.6 of the toll regulations part B), the country of registration (for possible follow-up check of the central motor vehicle certificate according to § 30 BStMG and according to item 5.6 of the toll regulations Part B), the EURO emission class, the contact person of the vehicle registration holder (point 5.6 of the toll regulations Part B), the PAN number (contract number), the GO Box ID number (vehicle unit number), the type of contract relating to the GO Box (pre or post-pay), the date of activation of the GO Box (date of personalization and issuing to the payer of the toll), the expiration date or (blocking) status of the GO-Box, the credit balance of the Pre-Pay-GO-Box concerned, the user name and the user password (for inquiries via the Internet at www.go-maut.at), the means of payment type (credit card, debit card, cash, fuel card, direct debit or bank transfer), bank details (bank code, account-holding bank, bank account number, IBAN code, SWIFT code), the bank guarantee (bank guarantee amount, issuing bank, international bank code, bank guarantee expiration date), card ID number, expiry date of the means of payment, the revocation notice regarding the means of payment, the location, the date, the time and the amount of the credit balance of the Pre-Pay-GO-Box (booking of a toll amount/ credit on the GO-Box) and data for the reimbursement of unused toll amounts of the Pre-Pay-GO-Box, the location, the date and time of payment of the system fee (reimbursement of costs/ processing fee), the location, the date, the time and the amount of the repayment of the toll (billing for the kilometers travelled in retrospect under certain exceptions), the location, date, time and amount of the toll transaction (tolls properly cleared when a toll collection point is driven through), the basic category of the GO-Box (basic setting by number of axles), the vehicle category declared in the toll transaction (according to the set number of axles), as well as the toll service provider responsible for billing.
      With regard to aid organizations (if vehicles are exempted from tolls for journeys in the context of emergency humanitarian aid - § 5 BStMG) (details will be provided by the applicant): The address, telephone number, fax number, e-mail address, aid organization contact person, the number of the approved exception request (in the case of temporary exemptions from the toll), the data of the vehicle registration holder of motor vehicles that are exempted from tolls for journeys in the context of humanitarian aid transport or in emergencies:  - name - address - telephone -, fax number and e-mail address - contact person, the vehicle registration number, the GO-Box-ID-Number (only for Post-Pay), the type of exception according to § 5 BStMG, the occasion according to § 5 BStMG, period (from - to) for temporary exceptions according to § 5 BStMG, route data according to § 5 BStMG, and the type of freight.
      With regard to the contact person (information can be submitted during system registration): The name, address, position/function, telephone number, fax number, e-mail address, access data (user and password) and the preferred correspondence language.
      For controlling the quality of the collection of the fully electronic truck toll system of Austria, ASFINAG collects the following data of the vehicle registration holder (from whom a mileage-based toll for the use of toll roads is payable):  License plate number, type of vehicle (truck/ bus/ special vehicle ), nationality, EURO emission class, PAN number (contract number), GO-Box ID number (vehicle unit number), type of contract regarding GO-Box (pre or post-pay), activation date of the GO-Box (date of personalization and issue to the toll payer), expiry date of the GO-Box, credit balance concerning Pre-Pay GOBox, location, date, time and amount of the repayment of the toll (billing for the kilometers travelled in retrospect under certain exceptions), location, date, time and amount of the toll transaction (due toll collection when passing through a toll collection point), basic category of the GOBox (basic setting by number of axles), declared vehicle category for toll transactions (according to the set number of axles), location, date, time and type of violation (non-payment/ incorrect vehicle category /violation of license plate link), photograph of the motor vehicle (in exceptional cases the possibility that the driver of the motor vehicle is recognizable on the photograph cannot be excluded); or the following data regarding the contracting party, which generate data required for quality evaluation, namely (toll collection): GPS position data (geographic latitude, geographic longitude), timestamp, speed, user identification (ID), name, address, telephone and fax number, and other information required for addressing, resulting from modern communication techniques, or the following data of vehicle registration owners, whose vehicles are recorded by the video recording used for quality measurement, namely video data of the vehicle with license plate number.
    2. GO toll customer data (see point 6.1) is deleted at the latest after seven years (at the end of the calendar year).
      Go toll transaction data will be deleted after expiry of the taxable filing period or the 30 years plus grace period resulting from the case law on the deadline for any duty to refund tolls until the end of the year. GO toll billing data, i.e. master data regarding the customer’s bank details or other means of payment (credit, fuel, service cards, ...), but not financial transaction data are deleted within a maximum of six months after clearing.
      Business letters and other correspondence shall be deleted within the meaning of § 212 UGB at the latest after ten years (end of the calendar year).
      Data related to the quality control for the toll collection of the Austrian fully electronic toll collection system, is deleted within a maximum of three years after collection. The retention period is required by the contractual arrangements with the operators of the GO toll system.
    3. Where necessary for (re)payment processing, the following data categories will be transmitted to the payment service provider with regard to the registration holder: Name, vehicle registration number, type of vehicle (truck/ bus/ special vehicle), country of registration, EURO emission class, GO Box ID number (vehicle device number), type of contract relating to the GO-Box (pre or post-pay), bank details (bank code, account-holding bank, account number, IBAN code, SWIFT code), card ID number, expiry date of the means of payment, data for crediting the Pre-Pay GO box and data for the reimbursement of unused toll amounts of the Pre-Pay GO box, payment of the system fee (reimbursement of costs/ processing fee), location, date, time and amount of the toll transaction (proper debiting of the toll when driving through of a toll collection point), location, date, time and amount of excess toll (billing of the kilometers travelled in retrospect under certain exceptions), declared vehicle category in toll transaction (according to the set number of axes), and the data for payment, possibly including billing data.
      The transmission is made based on corresponding contracts between the payer and the payment service provider as well as between the payment service provider and ASFINAG.
    4. ASFINAG uses the following processors to guarantee a correspondingly high quality, security and availability of the purchase options:

      Company

      Address

      Order processing category

      ASFINAG Maut Service GmbH

      1120 Wien, Am Europlatz 1

      Product development and operation

      T-Systems Austria GesmbH

      Rennweg 97-99, 1030 Wien

      Product development and operation

      Kapsch TrafficCom AG

      1120 Wien, Am Europlatz 2

      Product development and operation
  7. Vignette evidence according to BStMG
    1. BStMG states that anyone can enter a query via the Internet in the (https://evidenz.asfinag.at), which is controlled by the ASFINAG, and enquire whether a vehicle has a digital vignette or a digital route toll and for which periods they are valid.
    2. The data is processed from purchase until the end of the validity period of the respective product and then deleted from the vignette evidence.
    3. ASFINAG uses the following processors to guarantee correspondingly high security and availability of the register:

      Company Address Order processing category
      ASFINAG Maut Service GmbH 1120 Wien, Am Europlatz 1 Product development and operation
      ACP IT Solutions GmbH 1120 Wien, Wagenseilgasse 3 Technical Support
      Atos IT Solutions and Services GmbH 1210 Wien, Siemensstraße 92 Technical Support
      Tieto Austria 1200 Wien, Handelskai 94-96 Technical Support
  8. Control systems for toll products
    1. ASFINAG collects the following categories of data as part of the control system based on the legal foundations, according to point 3.
    2. (Digital) vignette: In order to be able to control the proper toll payment related to the digital vignette, the registration holder, whose vehicle license plate to which the digital vignette(s) is (are) registered and whose validity has not yet expired, or which are registered as exempt from the toll payment, this circumstance, the sequential number, the vehicle license plate number or partial license plate number and the country of registration are processed. With regard to the vehicle registration holder of a motor vehicle up to 3.5 t maximum permissible weight, in case of a suspected improperly paid vignette: The name (from central motor vehicle certificate pursuant to § 30 BStMG), the address (from central motor vehicle certificate pursuant to § 30 BStMG), the motor vehicle license plate, the type of vehicle (from central motor vehicle certificate pursuant to § 30 BStMG), the maximum permissible total weight of the vehicle (from central motor vehicle certificate pursuant to § 30 BStMG), the country of registration, the location, date, time and type of violation (no vignette/ invalid vignette), the photograph of the motor vehicle (in in exceptional cases the possibility that the driver of the motor vehicle is recognizable on the photograph cannot be excluded), the location, the date, the time and the amount of the payment of the replacement toll, the claim date of the replacement toll (if requested in writing) and the due date of the replacement toll (if requested in writing).  With regard to the driver of the motor vehicle (in case of justified suspicion regarding a violation of § 20 Abs.1 BStMG and detention by the public security authorities), the name, address, identity of the driver, issuing country of the driver’s identity card, issuing authority of the identity card, identity card number, vehicle license plate number, vehicle type, location, date, time of day and type of violation (no vignette/ invalid vignette).
    3. (Digital) section toll: With regard to the vehicle registration holder of a motor vehicle up to 3.5 t maximum permissible weight regarding the section toll (in case of justified suspicion regarding a violation of § 32 Abs 1 BStMG): The name (from central motor vehicle certificate pursuant to § 30 BStMG), the address (from central motor vehicle certificate pursuant to § 30 BStMG), the motor vehicle license plate, the type of vehicle (from central motor vehicle certificate pursuant to § 30 BStMG), the maximum permissible total weight of the vehicle (from central motor vehicle certificate pursuant to § 30 BStMG), the country of registration, the location, date, time and type of violation, the photograph of the motor vehicle (in in exceptional cases the possibility that the driver of the motor vehicle is recognizable on the photograph cannot be excluded), the location, the date, the time and the amount of the payment of the replacement toll, the claim date of the replacement toll (if requested in writing) and the due date of the replacement toll (if requested in writing). With regard to the driver of the motor vehicle (in case of justified suspicion regarding a violation of § 32 Abs.1 BStMG and detention by the public security authorities), the name, address, identity of the driver, issuing country of the driver’s identity card, issuing authority of the identity card, identity card number, vehicle license plate number, vehicle type, location, date, time of day and type of violation (no vignette/ invalid vignette).
    4. GO Toll: With regard to the driver of a motor vehicle over 3.5 t maximum permissible weight (in case of justified suspicion regarding a violation of § 20 Abs.2 BStMG and detention by the public security authorities), the name, address, identity of the driver, issuing country of the driver’s identity card, issuing authority of the identity card, identity card number, vehicle license plate number, vehicle type, location, date, time of day and type of violation (no vignette/ invalid vignette). With regard to the registration holder, in case of justified suspicion regarding a violation of § 20 Abs.2 BStMG: The name (from central motor vehicle certificate in accordance with § 30 BStMG and according to Section 5.6 of the toll regulations Part B), the address (from central motor vehicle certificate in accordance with § 30 BStMG and according to item 5.6 of the toll regulations Part B), the license plate number (for possible follow-up check of the central motor vehicle certificate according to § 30 BStMG and point 5.6 of the toll regulations Part B), the vehicle type (truck/ bus/ special vehicle) (from central motor vehicle certificate according to § 30 BStMG and according to item 5.6 of the toll regulations part B), the country of registration (for possible follow-up check of the central motor vehicle certificate according to § 30 BStMG and according to item 5.6 of the toll regulations Part B), the EURO emission class, the contact person of the vehicle registration holder (point 5.6 of the toll regulations Part B), the PAN number (contract number), the GO Box ID number (vehicle unit number), the type of contract relating to the GO Box (pre or post-pay), the date of activation of the GO Box (date of personalization and issuing to the payer of the toll), the expiration date of the GO-Box, the credit balance of the Pre-Pay-GO-Box concerned, the user name and the user password (for inquiries via the Internet at www.go-maut.at), the means of payment type (credit card, debit card, cash, fuel card, direct debit or bank transfer), bank details (bank code, account-holding bank, bank account number, IBAN code, SWIFT code), the bank guarantee (bank guarantee amount, issuing bank, international bank code, bank guarantee expiration date), card ID number, expiry date of the means of payment, the revocation notice regarding the means of payment, the location, the date, the time and the amount of the credit balance of the Pre-Pay-GO-Box (booking of a toll amount/ credit on the GO-Box), the location, the date and time of payment of the system fee (reimbursement of costs/ processing fee), the location, the date, the time and the amount of the repayment of the toll (billing for the kilometers travelled in retrospect under certain exceptions), the location, date, time and amount of the toll transaction (tolls properly cleared when a toll collection point is driven through), the basic category of the GO-Box (basic setting by number of axles), the vehicle category declared in the toll transaction (according to the set number of axles), the location, the date, the time and the type of violation (nonpayment /incorrect vehicle category /violation of license plate link), photograph of the motor vehicle (in exceptional cases the possibility that the driver of the vehicle is recognizable in the photo cannot be excluded), the location, the date, the time and the amount of the payment of the replacement toll, the claim date of the replacement toll (if requested in writing), the due date of the replacement toll (if requested in writing)  as well as the toll service provider responsible for billing.
    5. Deletion deadlines: Image data and vehicle license plate and control data derived there from, which relate to cases of proper payment of the toll, are immediately deleted in an irrevocable manner. Data documenting cases of toll evasion and data of the registration holder and/or driver and any correspondence thereto are stored in the toll system, but only as long as they are necessary for the purpose of collecting the toll, solicitation of payment of a toll and prosecution of toll evasion (§ 19a Abs. 2 BStMG). No later than three years after the collection of the toll, after payment of the replacement toll or after completion of the administrative penalty procedure in the toll system, the image data and derived license plate and control data, which document cases of toll evasion, are deleted in an irrevocable manner. This does not apply as long as legal proceedings regarding tolls, replacement tolls or administrative penalties are pending (§ 19a (3) BStMG).
    6. To the extent necessary for criminal prosecution for toll evasion, ASFINAG shall send the image, license plate number and control data, the data in connection with the steps taken by ASFINAG to trace the evasion, to the prosecuting authorities.
    7. Where necessary for payment of the replacement toll, the following data categories will be transmitted to the payment service provider: With regard to the payment, the amount of the replacement toll and the method of payment or data for payment, possibly including billing data. With regard to the payment by credit card, the name and the credit card number and data. The transmission is made based on corresponding contracts between the payer and the payment service provider as well as between the payment service provider and ASFINAG.
    8. ASFINAG uses the following processors to guarantee a correspondingly high quality, security and availability of the purchase options.

      Company

      Address

      Order processing category

      ASFINAG Maut Service GmbH

      1120 Wien, Am Europlatz 1

      Product development and operation

      T-Systems Austria GesmbH

      Rennweg 97-99, 1030 Wien

      Product development and operation

      Kapsch TrafficCom AG

      1120 Wien, Am Europlatz 2

      Product development and operation
  9. Additional services
    1. The purchaser of toll products has the option to choose additional unpaid services such as "My Account", renewal reminder, ASFINAG newsletter, and so on.
    2. ASFINAG then collects the data categories specified in the respective consent texts prior to receipt of the additional services for the duration specified therein.
    3. For the respective additional services ASFINAG uses processors named in the respective consent texts and any other recipients.

  10. Information regarding the rights of the affected persons
    1. according to the legal position of the DSG2000, affected persons have the right to information rectification or deletion and objection.  From 25.5.2018 the following rights of affected persons will apply according to the then actual General Data Protection Regulation:
    2. Right to information: Any person affected by data processing has the right to ask ASFINAG for confirmation whether it has processed personal data concerning said person; if this is the case, the affected person has a right to information regarding such personal data (copy of the personal data that is the object undergoing processing) and the following information: (a) the processing purposes; (b) the categories of personal data that are being processed; (c) the recipients or categories of recipients to whom the personal data have been disclosed or are still being disclosed, in particular to recipients in third countries or to international organizations; (d) if possible the planned duration for which the personal data are stored or, if this is not possible, the criteria for determining such duration; (e) the right of rectification or deletion of the personal data concerning the said person or the limitation of the processing or the right to object to such processing; (f) the right of appeal to a supervisory authority; (g) if the personal data are not collected for the person affected, all available information on the source of the data; (h) the (non) existence of automated decision-making including profiling. ASFINAG will provide a copy of the personal data that is the subject of the processing. For all other copies requested by the person affected ASFINAG may charge a reasonable fee based on the administrative costs. If the person effected files the application electronically, the information is provided in a standard electronic format, unless otherwise stated.
    3. Right to rectification and deletion: The affected person has the right to demand from ASFINAG the correction of incorrect personal data concerning said affected person without delay. In consideration of the purposes of the processing the affected person has the right to request the completion of incomplete personal data, including by means of a supplementary statement.
      Furthermore, the affected person has the right to ask ASFINAG to immediately delete personal data concerning said affected person and ASFINAG is obliged to delete personal data immediately if one of the following reasons applies: (a) Personal data are no longer necessary for the purposes for which they were collected or otherwise processed. (b) The person affected revokes the consent on which the processing is based and there is no other legal basis for the processing. (c) The person affected files an objection (see below) against processing. (d) The personal data were processed unlawfully. (e) ASFINAG is required to delete the personal data in order to fulfill a legal obligation. (f) The personal data has been collected in relation to information society services offered (consent of a child). The right of deletion does not exist in particular if the processing is necessary for the fulfillment of a legal obligation of ASFINAG or for the performance of a public interest task or in the exercise of public authority delegated to ASFINAG and /or assertion, exercise, or defense of legal claims.
    4. Right to restriction of processing: The person affected has the right to demand that ASFINAG restrict processing if one of the following conditions is met: (a) The accuracy of the personal data is disputed by the person affected, for a period allowing ASFINAG to verify the accuracy of the personal data, (b) the processing is unlawful and the affected person is refuses deletion of the data and instead requests the restriction on the use of personal data;  (c) ASFINAG no longer needs the personal data for the purposes of the processing, but the person affected requires them to assert exercise or defend legal claims or (d) the person affected has objected to processing until such time as it has been determined, whether the legitimate reasons of ASFINAG outweigh those of the person affected.
      If the processing has been restricted, these personal data may only be stored with the consent of the affected person or for the purpose of asserting, exercising or defending legal claims or protecting the rights of another natural or legal person or for reasons of significant public interest of the Union or a Member State.
      An affected person, who has restricted processing, will be notified by ASFINAG before the restriction is lifted.
    5. Right to data portability: The affected person has the right to receive personally identifiable information provided to ASFINAG (as part of the voluntary additional services), in a structured, common and machine-readable format, and has the right to transfer that data to another responsible person.
       In exercising their right to data portability, the affected person has the right to grant that the personal data be transferred directly from one responsible party to another responsible party, where technically feasible.
    6. Right of objection: The person affected has the right, at any time and for reasons related to their particular situation, to lodge and objection to the processing of personal data relating to the performance of a task in the public interest or in the exercise of official authority, which has been transferred to ASFINAG, or which is required to safeguard the legitimate interests of ASFINAG or a third party. ASFINAG will then no longer process the personal data unless it can demonstrate compelling legitimate grounds for processing, that outweigh the interests, rights and freedoms of the affected person or the processing is for the purpose of enforcing, pursuing or defending legal claims.
      If personal data is processed to operate direct advertising, the affected person has the right to object at any time to the processing of their personal data for the purpose of such advertising. If the affected person objects to processing for direct marketing purposes, their personal data will no longer be processed for these purposes.
    7. Right of appeal to the supervisory authority: Any affected person shall have the right to lodge a complaint with a supervisory authority without prejudice or to any other administrative or judicial remedy, in particular in the Member State of their residence, place of work or place of alleged violation, if the person affected considers that the processing of their personal data violates these legal requirements - see https://www.dsb.gv.at/rechte-der-betroffenen.