We take care of your personal data

At Midland Expressway Limited (“MEL”), trading as M6toll (“M6toll”, “we”, “us” or “our”) we are committed to protecting your privacy and personal data. This Privacy Notice explains how we use the information we collect, your rights in relation to your personal data and how to contact us if you have any questions.

This Privacy Notice applies to individuals whose personal data is collected by MEL in the course of operating the M6toll, including drivers, customers, registered account holders, Mobility Exemption Programme (MEP) applicants, callers to our customer service teams, users of our website and mobile services, and individuals whose personal data is collected at roadside toll booths.

1. Who is the Data Controller?

A Data Controller is a natural or legal person or body that, independently or jointly with others (Joint Data Controllers) determines the purposes for which the data is requested, collected, and used, as well as what data is processed, for how long or what Third Parties may be authorised to access the data.

MEL is the Data Controller as defined by the data protection regulations. Midland Expressway Limited is part of the Aleatica Group, an international infrastructure operator. As a subsidiary of Aleatica, certain corporate governance, compliance, and oversight functions are carried out at group level. In certain circumstances, and in line with MEL’s governance structure, Aleatica S.A.U. and other Aleatica group companies may act as Joint Data Controllers, where they participate in or oversee group-wide governance, compliance, internal audit, financial reporting, or operational oversight activities that involve customer or road user personal data.

Our Contact Information

Customer Services Team

Address: Operations Centre, Express Way, Weeford, Lichfield, Staffordshire, WS14 0PQ

Phone Number: 0330 660 0790

E-mail: customer.services@m6toll.co.uk

 

For data protection queries, escalation of concerns, or to exercise your data protection rights, you may contact MEL’s Data Protection function at:

Email: dataprotection@m6toll.co.uk

 

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO). The ICO’s details are:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

 

2. What personal data do we process about you?

MEL collects personal data through multiple channels, including the M6toll website, customer contact centres, roadside toll booths (including verbal collection), mobile and online payment services, CCTV systems, and correspondence with customers and public authorities. The categories of data collected depend on how you interact with MEL and are limited to what is necessary, as defined in MEL’s Record of Processing Activities (RoPA).

Please note that the categories of personal data collected vary depending on whether you are a driver, registered account holder, MEP applicant, claimant, website user, or caller to our customer service team.

We obtain or request personal data, including but not limited to:

• Identity data (e.g. name, title)
• Contact data (e.g. address, email address, telephone number, including numbers provided verbally at roadside toll booths)
• Driver and ANPR data (e.g. vehicle registration number, journey and location data)
• CCTV data (recordings at toll sites)
• Financial and transaction data (for example, details about payments)
• Call recordings and correspondence
• Profile, technical and usage data (for example, information about how the M6toll website is used)
• Marketing and communications preferences
• Account and customer identifier data (e.g. customer account number, payment notice number, tag ID, online account credentials)
• We may invite customers to provide feedback on our services through third-party review platforms such as Trustpilot. In this context, limited personal data may be shared with the platform solely for the purpose of sending a review invitation.
• In limited circumstances, MEL processes special category personal data, primarily in connection with the Mobility Exemption Programme (MEP), where applicants voluntarily provide evidence of disability or health-related benefits in order to assess eligibility or incident/injury management purposes: Health data (for example, MEP applicant’s benefits letter)
• Injury-related information (where recorded as part of road incidents or claims handling)

Special category personal data is processed strictly in accordance with Article 9 of the UK GDPR and the Data Protection Act 2018, with enhanced safeguards and restricted access, as reflected in MEL’s RoPA.

MEL does not routinely process criminal conviction data. Where required for incident investigation or legal claims, such data is processed strictly in accordance with applicable law and with appropriate safeguards.

MEL does not intentionally process children’s personal data, except where incident records include information about children.

MEL does not make decisions based solely on automated processing that produces legal or similarly significant effects on individuals.

3. Why do we obtain and process your data?

We use the information that you have given us ​in order to:

Purposes	Data Type
To protect service users using the roads.	ANPR data Location CCTV data Injury-related information (where incidents involve injuries)
To enable the Payment Notice to be issued to the customer when they have no means of payment at the payment point.	Identity data Contact data Call data Vehicle Registration Number (VRN) Payment Notice Number
To support Payment Notice checks and payment processing.	Driver and ANPR data Payment Notice Number Transaction data (payment status)
To enable customers to make their payments online and to send a reminder text.	Driver and ANPR data Contact data Account/customer identifier (MEL account data)
To support any checks or customer queries.	Driver and ANPR data CCTV data Contact data
To support customer enquiries and confirmation of details/disputes.	Call data Identity data
To support internal processing.	Driver and ANPR data CCTV data Payment Notice Number Identity data Contact data Transaction data Profile/ MEL account data
For internal reporting.	Driver and ANPR data Payment Notice Number Aggregated transaction data
To register you as a new customer.	Identity data Contact data Vehicle Registration Number (VRN number) Account credentials (MEL account)
To manage our relationship with you, which will include notifying you about changes to our terms or privacy policy or asking you to leave a review or take a survey.	Identity data Contact data Marketing and communications data
To provide feedback on our services to the customers through third-party review platforms such as Trustpilot. In this context, when limited personal data may be shared with the platform solely for the purpose of sending a review invitation	Name (where available), Email address, MEL customer reference number, case reference number (where applicable), IP address and associated metadata (when widgets are used), information provided by the customer
To provide you with appropriate information and updates about the M6toll.	Contact data Marketing and communications data MEL account/customer identifier
To give you access to your on-line Account statement.	Identity data Contact data Transaction data MEL account / customer identifier
To communicate with you in relation to your Account, any promotions you participate in, your use of our website and any enquiries or comments made by you	Identity data Contact data Profile data Marketing and communications data
To process your Application for a MEP.	Identity data Contact data Health data Vehicle Registration Number (VRN number)
To verify your circumstances to provide you with an MEP and communicate with you in relation to your MEP.	Identity data Contact data Marketing and communications data Health data
To support in the management of claims.	Identity data Contact Data Location Data CCTV data ANPR Transaction data Payment Notice Number
To support customers in the process of recovery for you/others and your vehicle.	Identity data Contact Data Location Data CCTV data ANPR
To collect contact details verbally at roadside toll booths where no payment method is available, in order to issue a Payment Notice or respond to customer queries	Contact data Vehicle Registration Number (VRN number) Phone number
To verify eligibility for mobility-related exemptions and improve exemption processes through data sharing with Motability Operations Limited	Vehicle Registration Number (VRN)
To perform regional analysis, business reporting and generate insights using postcode data	Customer postcode data, customer account data

We also receive personal information indirectly e.g. when working with law enforcement. Each of the processing activities listed below is supported by an appropriate lawful basis under Article 6 of the UK GDPR, as described in Section 4. Processing involving health or other special category data is subject to additional safeguards as set out in Section 5.

Each of the processing activities listed is carried out under one of the lawful bases described in Section 4, depending on the nature of the interaction. 

4. What are the lawful basis to process the data?

Personal data collected by MEL in connection with the operation of the M6toll is processed on a number of lawful bases under Article 6 of the UK GDPR. In most cases, processing is necessary for the performance of a contract with you, compliance with legal obligations, or for MEL’s legitimate operational and safety interests.

MEL does not generally rely on consent as the primary lawful basis for processing personal data. Consent is used only in limited circumstances, such as where customers choose to receive optional marketing communications, surveys or other communications that are not strictly necessary for the provision of services. Where consent is relied upon, it is obtained clearly and can be withdrawn at any time.

Additionally, our website uses cookies and similar technologies to ensure functionality, improve user experience, analyse website traffic, and support security. For further information about the types of cookies used, their purposes, and how to manage your preferences, please refer to our Cookie Policy available on our website.

In practice, personal data collected through the M6toll website, customer accounts, roadside toll booths, call centre interactions, and related services is processed on the following lawful bases under Article 6 of the UK GDPR:

• Article 6(1)(b) – Contractual necessity – Where processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract. This includes account registration, toll payment processing, issuing Payment Notices, managing your online account, handling customer queries, and processing Mobility Exemption Programme (MEP) applications.
• Article 6(1)(c) – Legal obligation – Where processing is required to comply with legal or regulatory obligations, including road charging enforcement, fraud prevention, financial reporting, responding to lawful requests from public authorities, and managing claims or disputes.
• Article 6(1)(f) – Legitimate interests – Where processing is necessary for MEL’s legitimate interests, provided those interests are not overridden by your rights and freedoms. This includes service improvement, internal reporting and analytics, fraud detection, security monitoring (including CCTV and ANPR systems), recovery processes, and operational management.
• Article 6(1)(a) – Consent – Where processing is based on your consent. This applies primarily to direct marketing communications (where required), optional surveys, and certain promotional communications. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Special category and criminal convictions

MEL processes special category personal data only in limited circumstances and in accordance with Article 9 of the UK GDPR.

This primarily applies in connection with the Mobility Exemption Programme (MEP), where applicants voluntarily provide health-related information or evidence of disability (for example, benefit entitlement letters) in order to assess eligibility. Such data is processed strictly for the purpose of verifying exemption entitlement and administering the scheme.

Special category data may also be processed where required in the context of claims management or incident handling, where health information is provided as part of supporting documentation.

Where processing of special category personal data is carried out under Article 9(2)(f) (establishment, exercise or defence of legal claims) and, where applicable, Article 9(2)(g) (substantial public interest) this is undertaken in accordance with Schedule 1 of the Data Protection Act 2018 and appropriate safeguards and access controls are in place.

MEL does not routinely process criminal conviction data in relation to customers. Where such data is processed in the context of enforcement, incident investigation, fraud prevention, or legal proceedings, it is handled strictly in accordance with Article 10 of the UK GDPR and Schedule 1 of the Data Protection Act 2018, with enhanced security and access restrictions.

6. Your information is securely stored.

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

7. Who do we share your personal data with?

Your data will only be disclosed to service providers and trusted third parties processing personal data under the instructions of MEL. For example, providers of IT hosting services, analytics, maintenance, support or cybersecurity activities that require access to this information to support our systems, as well as third parties where data sharing is required to administer specific services, such as verifying eligibility for mobility-related exemptions. Data may also be shared with law enforcement, debt recovery, and insurers, and other organisations as required for operational or legal purposes, including as part of interoperability requirements, e.g. working with other road charging, or other Aleatica Group corporate companies, for operational or administrative purposes.

Some recipients, including Aleatica group companies, may be located outside the UK. Further details on international transfers are set out in Section 8.

8. Where is your personal data processed?

Some IT-related maintenance, support or cybersecurity service providers could be located in countries outside the UK or European Economic Area (“EEA”) and, therefore, with data protection regulations that are not comparable to those of the states of the EEA. Where personal data is transferred outside the UK or EEA, MEL ensures appropriate safeguards are in place, including the use of International Data Transfer Agreements (IDTAs), UK Addendum to Standard Contractual Clauses, or reliance on adequacy regulations where applicable. These safeguards ensure that personal data continues to receive an equivalent level of protection.  If you have any questions regarding your rights, data protection, please contact customer.services@m6toll.co.uk.

9. What rights do you have over your personal data?

Under data protection law, you have the following rights:

 

• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
• Where processing is based on consent – You have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the consent was withdrawn.
• You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at customer.services@m6toll.co.uk, 0330 660 0790, or Midland Expressway Limited, Operations Centre, Express Way, Weeford, Lichfield, WS14 0PQ, if you wish to make a request.

10.How long do we process your data?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Detailed retention periods for customer and road user data are defined in MEL’s Retention and Erasure Policy and reflect statutory and operational requirements identified in MEL’s Record of Processing Activities.

11. How to contact us?

If you have any questions or queries about how we treat your personal data, or if you want to exercise any of the rights informed in Section 7 of this Privacy Notice, you can contact us by postal mail at:

Midland Expressway Limited, Operations Centre, Express Way, Weeford, Lichfield, WS14 0PQ

Or electronically at: customer.services@m6toll.co.uk

You can also request the protection of the Information Commissioner’s Office (ICO) through its website ico.org.uk

12. How often is this Privacy Notice updated?

 This Public-Facing Privacy Notice is reviewed at least annually and whenever there is a material change to MEL’s processing activities, legal obligations, or Record of Processing Activities.

This Privacy Notice was updated in April 2026.