INTRODUCTION
SA SNCF Gares & Connexions attaches high importance to your privacy and wishes to build a strong and lasting relationship with you. Protection of your personal data is a priority for us. This is why we make our data protection policy available to you to inform you about our practices when it comes to processing information that you provide to us through our Platform (the ‘Platform’) accessible from the ‘garesetconnexions.sncf’ website, the Ma Gare SNCF mobile application and the access portal for the ‘WiFi at stations’ service.
This Policy is subject to French law 78-17 dated 6 January 1978 relative to Information Technologies, Data Files and Individual Liberties modified in 2004 (‘Information Technologies and Liberties law’) as well as European regulation 2016/679 relative to protection of personal data dated 27 April 2016 (‘General Data Protection Regulation’).
1. SOME DEFINITIONS BEFORE WE BEGIN...
Processing of personal data: (‘Processing’) operation or set of operations applied to Personal Data (e.g., collection, recording, storage, consultation, etc.).
Data Controller: refers to the physical or moral person who determines the purposes and means of the Processing.
Personal data: (‘Personal Data’) information collected by SA SNCF Gares & Connexions that can identify you directly (e.g., your first and last name) or indirectly (e.g. through pseudonymised data such as a unique identifier).
Customer: refers to any physical person who has created an account on the Platform and who has previously accepted the terms and conditions.
Right to access: right to view your data at any time and free of charge. Right to rectification: right to demand that incorrect data is corrected and to request to supplement your data.
Right to oppose: within the limits of applicable law, with the exception of processing for which there are legitimate and compelling reasons for processing of your Personal Data, you may at any time oppose the processing of your Personal Data, for example when your data is processed for purposes of commercial prospecting.
Right to deletion: right to have your data deleted from our databases. This is not an absolute right in the sense that we may be required to retain your data for legal or legitimate reasons.
Right to limitation: right to request the limitation of the processing that we perform on your data. This right means that the processing of data concerning you is limited, so we can still retain this data but not use it. This right applies to specific circumstances set out by the General Data Protection Regulation.
Right to portability: right to receive the Personal Data that you have provided to us in a structured, commonly used and machine readable format and to send it to another Data Controller. This right only applies to data that you have provided to us, when the processing is based on your consent or on a contract and it is done using automated processes.
2. WHO COLLECTS YOUR PERSONAL DATA?
SA SNCF Gares & Connexions located at 16 Avenue d'Ivry 75013 PARIS is the Controller for all Processing of Personal Data on the ‘garesetconnexions.sncf’ Site, the Ma Gare SNCF mobile application and the portal to access the WiFi service.
3. WHAT PERSONAL DATA DO WE COLLECT?
Through our Platform, we request that you send us information that will identify you. This is the case when you fill in our registration form. This data includes your first and last name, email address, date of birth, gender and phone number. This information is mandatory. If it is not provided, SA SNCF Gares & Connexions will not be able to provide the requested service.
We also use cookies to collect additional data about use of our Platform. Cookies allow us to provide optimum browsing on our site. You can read our ‘Cookie usage policy’ to find more information about this technology and your rights related to it.
To get unlimited high-speed WiFi, you must create an account from the access portal providing only the following Personal Data: last name, first name and email address. We also need to collect your MAC address, which will immediately be anonymised. Creating a Customer account is optional in order to use this service, you can use the WiFi without creating an account. In this case, the WiFi will be limited to 30 minutes only.
4. FOR WHAT PURPOSE DO WE COLLECT YOUR PERSONAL DATA AND ON WHAT LEGAL BASIS?
SA SNCF Gares & Connexions collects Personal Data for determined, legitimate and relevant purposes.
The Personal Data that we collect concerning you is therefore necessary for the use of services offered by the Platform (lost & found, news about your favourite stations, WiFi, etc.).
Furthermore, if you give your consent, your data can be used to send you email and/or SMS communications about our services (works, services and shops, culture, special deals at your favourite stations).
If you change your phone number you will need to update the information on your account so that we do not send any messages to the new owner of your old number.
You may unsubscribe from these communications at any time by replying STOP by SMS or by clicking the unsubscribe link in the email.
When creating your account, you may receive emails with commercial offers from our partners. You will be asked to give express consent for this.
You are able to unsubscribe from these communications at any time by clicking the unsubscribe link present in each of the emails received. You may also modify your choices on your account in a dedicated section (“My personal information”).
You must be at least 15 years old to use our services. Collecting your date of birth thus helps us to verify your age and personalise our communications. The message will differ according to the Customer’s age bracket.
Finally, we may use your Personal Data for statistical purposes.
In order to enable SNCF to adapt the offer of services and equipment, decide on the dimensions of spaces at stations and optimise our systems, we conduct a statistical measurement of passenger flows at stations using signals emitted by a terminal with activated WiFi connectivity.
5. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?
In accordance with current statutory or regulatory provisions, you have the right to access, rectify and delete data concerning you as well as the right to oppose and limit its processing and the right to data portability.
It can be simpler to modify and/or supplement all incorrect/incomplete information from your account via the ‘My personal information’ section.
SA SNCF Gares & Connexions will respond within one (1) month from receiving the request.
Furthermore, we remind you that in accordance with the provisions of article 40-1 of the French data protection law, you have the right to provide general (directed to a trusted digital third party certified by the CNIL) or specific (directed to the Data Controller) instructions relative to the storage, deletion and communication of your personal data after your death.
These requests relative to personal rights may be made
- by recorded delivery post with acknowledgement of receipt: SNCF Gares & Connexions Direction Digital & Technologies, 16 avenue d’Ivry, 75013 Paris;
- by email: [email protected]
For reasons of confidentiality and protection of Personal Data, a copy of a signed identity document should be included with every request and the address to which the address should be sent must be specified.
Within the limits permitted by applicable legal provisions, when an individual’s requests are manifestly unfounded or excessive, including due to their repetitive nature, we may refuse to follow up on requests or demand payment of reasonable fees to take into account incurred administrative costs to provide the requested information.
Finally, we draw your attention to the fact in accordance with articles 60-2, 77-1-2 and 99-4 of the Code of Procedure, SA SNCF Gares & Connexions may be required, in the context of legal or fiscal proceedings, to share the Personal Data in its possession with the public authorities, and will not be held liable in this regard.
We may also retain some information when it is required by law or when we have a legitimate reason for doing so.
You have the right to submit a complaint with the CNIL to contest the practices of SA SNCF Gares & Connexions regarding protection of personal data and respect of privacy. Please contact us using the details below before submitting a complaint with the CNIL.
6. FOR HOW LONG IS YOUR PERSONAL DATA RETAINED?
SA SNCF Gares & Connexions has set out specific rules concerning the length of time that Personal Data will be retained.
Your Personal Data will therefore be deleted after three (3) years from the last use of any of our services.
We delete it from our systems and our files or anonymise it so that it can no longer be used to identify you.
7. WHO ARE THE RECIPIENTS OF YOUR DATA?
We work closely with subcontractors who may have access to your Personal Data, for example to provide data storage, send you communications and for segmentation. We require these subcontractors to comply with data protection legislation and present sufficient guarantees regarding implementation of appropriate technical and organisational measures.
Our commercial partners do not have access to your Personal Data. SA SNCF Gares & Connexions is the sole sender of electronic communications with the commercial offers of its partners.
Your Personal Data may be sent to companies located in non-EU countries which do not have an adequate level of Personal Data protection. This is the case for example when we use subcontractors in the United States for data storage. Prior to transfer outside of the European Union and in accordance with current legislation, SA SNCF Gares & Connexions implements all required procedures to obtain the guarantees necessary to secure such transfers. These measures may be the signature of standard contractual clauses (based on the model adopted by the European Commission) or verification that the subcontractor is signed up to Privacy Shield.
When it comes to satisfaction surveys, SA SNCF Gares & Connexions and its partners are committed to strict compliance with protection rules as well as anonymisation of data.
8. HOW DO WE PROTECT YOUR DATA?
SA SNCF Gares & Connexions takes every reasonable precaution to ensure the security of your data against loss, misuse, disclosure, modification and destruction.
In particular:
- once your data is received, we apply strict security procedures and measures in order to take every precaution to prevent any unauthorised access, access to databases being strictly limited to persons authorised to access it as part of their missions;
- we also demand through contractual means that our subcontractors respect the security and confidentiality of your Personal Data.
9. HOW TO CONTACT OUR DATA PROTECTION OFFICER?
SA SNCF Gares & Connexions has appointed a data protection officer to assist the Data Controller in complying with the European Regulation. For any questions relative to protection of Personal Data, please contact us at the following address: [email protected]
10. IS THIS POLICY LIKELY TO BE MODIFIED?
SA SNCF Gares & Connexions reserves the right to modify, add or delete elements from the present Policy at any time. SA SNCF Gares & Connexions will inform you in advance of these changes by email or with information on the Platform. This is to ensure that you have reasonable time to exercise your rights in accordance with the Information Technologies and Liberties law and the General Data Protection Regulation. By continuing to access the services after the introduction of these changes, you agree to be bound by the conditions as stated in the new Data Protection Policy.
Nevertheless we encourage you to regularly consult the Policy in order to be aware of the measures taken by SA SNCF Gares & Connexions to protect your personal information.
11. HOW TO CONTACT US?
- For any questions concerning the present Policy, you can contact us directly:
- by email: [email protected] ;
- or by post at the following address: SNCF Gares & Connexions - 16 Avenue d'Ivry - 75634 Paris.
You can also contact our data protection officer at the following address: [email protected]