Travel Update

Privacy Policy

This Privacy Policy (“Privacy Policy”) is intended for customers of the M6toll who are using the expressway and using the M6toll website. If you are an external stakeholder of Midland Expressway Limited please visit the Midland Expressway Limited website midlandexpressway.co.uk and read the related privacy policy here.

Midland Expressway Limited (“MEL”), trading as M6toll (“M6toll”, “we”, “us” or “our”) is committed to ensuring that your privacy is protected. This Privacy Policy explains how we use the information we collect about you and how you can instruct us if you prefer to limit the use of that information.

1. Important information and who we are
Midland Expressway Limited is the data controller and is responsible for your personal data. Our contact details can be found at the bottom of this policy.

We have appointed a Data Protection Officer (“DPO”). If you have any questions about this policy or our data protection practices, please contact the DPO via company.secretary@m6toll.co.uk

2. The types of personal data we collect

We may collect, use, store and transfer different kinds of personal data about you.

For example, when you register a comment on our website, apply to receive a TAG (either online, or on our standard TAG application form) or an ANPR account, or contact us for any promotion that M6toll may run from time to time, we will process personal data about you, including:

  • Identity data (i.e. your name and title)
  • Contact data (i.e. your address, email address and telephone numbers)

If you are applying to open an Account, we will also process:

  • Identity data
  • Contact data
  • Driver and ANPR data (i.e. vehicle license plate number and IMAC details, including the MAC ID of the device and associated timestamp and sensor location)
  • Financial data (i.e. your payment card details)
  • Call data (i.e. recordings of any calls between you and MEL)
  • Transaction data (i.e. details about payments to or from you)
  • Technical data (i.e. log-in details, browser type and operating systems)
  • Profile data (i.e. username and password and survey responses)
  • Marketing and communications data (i.e. advertising preferences)
  • Usage data (i.e. information about how you use our website)

We also process Mobility Exemption Pass (MEP) applications which require us to process data about your health which is a special category of personal data. In addition to the above lists, we will collect and process a copy of the applicants benefits letter.

We may also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data itself under data protection laws as this data will not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any other types of special categories of personal data about you (including details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, or genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Cookies: Please see our cookie policy for details on cookies that we use on our website. We do not share cookie data with anyone, and the cookies are only used for website functionality.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a product or service you have with us, however we will notify you if this is the case at the time.

3. Purposes for which we will use your personal data:

Most commonly, we will use your personal data in the following circumstances:

  • Where we need to perform the contract we are about to enter into or have entered into with you.
  • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. “Legitimate interests” are any purposes where we (or a third-party) use your personal data in a way that you would expect, for example, to aid us in setting up your Account or to allow us to process a payment from you.
  • Where we need to comply with a legal obligation.

We have set out below a more detailed description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. We may process your personal data under a different lawful basis depending on the specific purpose(s) for which we are using your data.

Please contact us if you need additional detail about the specific lawful basis we are relying on to process your personal data, particularly where more than one basis has been set out below:

Our purpose for collecting your personal data: Type(s) of personal data we collect about you:
(Explained in section 2 above)		 Our lawful basis for processing your personal data, including our legitimate interest(s): (explained in section 3 above)
To register you as a new customer
  • Identity data
  • Contact data
 We process your information:

  • For performance of a contract with you; and/or
  • With your consent
To manage our relationship with you, which will include notifying you about changes to our terms or privacy policy or asking you to leave a review or take a survey
  • Identity data
  • Contact data
  • Profile data
  • Marketing/communications data
  • Call data
  • Driver and ANPR data
 We process your information:

  • For performance of a contract with you;
  • With your consent;
  • Because it is necessary to comply with a legal obligation; and/or
  • Because it is necessary for our legitimate interests to keep our records updated and to study how customers use our products/services
To process your application for an Account
  • Identity data
  • Contact data
  • Financial data
  • Driver and ANPR data
 We process your information:

  • For performance of a contract with you;
  • With your consent; and/or
  • Because it is necessary for our legitimate interests to recover moneys due to us
To provide you with appropriate information and updates about the M6toll
  • Identity data
  • Contact data
  • Driver and ANPR data
 We process your information:

  • With your consent; and/or
  • Because it is necessary for our legitimate interests to develop our products/services and grow our business
To give you access to your on-line Account statement
  • Identity data
  • Contact data
 We process your information:

  • For performance of a contract with you; and/or
  • With your consent
To communicate with you in relation to your Account, any promotions you participate in, your use of our website and any enquiries or comments made by you
  • Identity data
  • Contact data
  • Profile data
  • Usage data
  • Marketing/communications data
  • Call data
  • Technical data
  • Driver and ANPR data
 We process your information:

  • With your consent; and/or
  • Because it is necessary for our legitimate interests to develop our products/services and grow our business
To process your Application for a MEP
  • Identity data
  • Contact data
  • Special category data
  • Driver and ANPR data
 We process your information:

  • For performance of a contract with you; and/or
  • With your consent
To verify your circumstances to provide you with an MEP and communicating with you in relation to your MEP
  • Identity data
  • Contact data
  • Special category data
  • Call data
  • Driver and ANPR data
 We process your information:

  • With your consent; and
  • Because it is necessary for our legitimate interests to develop our products/services and grow our business

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us using the contact details set out in paragraph 9 below.

We will not use your personal data for any automated decision making or profiling.

4. How we share your personal data

We require all our third-party service-providers to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Where permitted by applicable law, we may transfer the personal data we collect about you to jurisdictions outside the EEA that may not be deemed to provide the same level of data protection as your home country, as necessary for the purposes set out in this Privacy Notice including (i) to perform our employment contract with you; (ii) for the establishment, exercise, or defence of legal claims; (iii) for compelling legitimate interests of the Company or the data controller, which are not overridden by your interests or rights and freedoms; or (iv) otherwise, with your consent.

In the event that our business is sold or integrated with another business your details may be disclosed to our advisers and any prospective purchasers’ advisers and will be passed on to the new owners of the business.

5. How we protect your personal data
The internet is not a secure medium. However, we have taken reasonable steps to put in place appropriate security procedures to help protect your personal data from being accidentally lost, used or accessed in an unauthorised way.

We have installed a mechanism that uses digital server identities so that you can be sure that you are accessing your account on the M6toll web site. You will be able to access your account on our website only using your specific username and password, which is provided to you by us. M6toll’s servers are located in a secure location which can only be accessed by authorised personnel. Your information is kept confidential and we have appropriate internal procedures to cover the storage, access and disclosure of your information.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

6. Updating your account details
If any of the information that you have provided to us changes, please let us know. If you are an Account customer please login to your account by visiting customer.m6toll.co.uk and update your details. Alternatively, or if you are not an Account customer, please complete our contact form, or contact us using the contact details set out at paragraph 9, below.

7. How we later retain your personal data
We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, as well as the applicable legal, regulatory, tax, accounting or other requirements.

8. Your rights
You have rights under data protection laws in relation to your personal data, including:

  • The right to request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. This is called a data subject access request.
  • The right to request correction of your personal data. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide us.
  • The right to request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.
  • The right to object to processing of your personal data. This enables you to object to the processing of your personal data for direct marketing purposes or where you feel it impacts on your fundamental rights and freedoms.
  • The right to request restriction of processing your personal data. This enables you to ask us to suspend the processing of your personal data.
  • The right to request transfer of your personal data. We will provide your personal data in a structured, commonly used format. (Please note that this only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you).
  • The right to right to withdraw your consent at any time. For example, where you have provided your consent to receive marketing. (Please note, this will not affect the lawfulness of any processing carried out before you withdraw your consent).
  • The right to lodge a complaint with our supervisory authority. The relevant supervisory authority is the Information Commissioner’s Office (the “ICO”). More information can be found on the ICO’s website: https://ico.org.uk/.

Further details on your rights can be found in Table A below. If you wish to exercise any of the rights set out above, please contact us using the contact details set out at paragraph 9 below.

9. How to contact us
We welcome your views about our website and our Privacy Policy. If you would like to contact us with any queries or comments, please use our contact form. Alternatively, please contact our Customer Service Team on 0330 660 0790, or write to:

Customer Service Team, Midland Expressway Limited, Operations Centre, Express Way, Weeford, Lichfield, WS14 0PQ.

 

Table A

Your right

What does it mean?

Limitations and conditions of your right
To request access to your personal data Subject to certain conditions, you are entitled to have access to your personal data (this is more commonly known as submitting a “data subject access request”). If possible, you should specify the type of information you would like to see to ensure that our disclosure is meeting your expectations.
We must be able to verify your identity. Your request may not impact the rights and freedoms of other people, e.g. privacy and confidentiality rights of other staff or Customers.
To request transfer of your personal data Subject to certain conditions, you are entitled to receive the personal data which you have provided to us and which is processed by us by automated means, in a structured, commonly used machine-readable format. If you exercise this right, you should specify the type of information you would like to receive (and where we should send it) where possible to ensure that our disclosure is meeting your expectations.
This right only applies if the processing is based on your consent or on our contract with you and when the processing is carried out by automated means. It covers only the personal data that has been provided to us by you.
To request correction incomplete data You may challenge the accuracy or completeness of your personal data and have it corrected or completed, as applicable. You have a responsibility to help us to keep your personal information accurate and up to date. We encourage you to notify us of any changes regarding your personal data as soon as they occur, including changes to your contact details. Please always check first whether there are any available self-help tools within your profile on our website to correct the personal data we process about you. This right only applies to your own personal data. When exercising this right, please be as specific as possible.
To object to or to request restriction of processing your personal data Subject to certain conditions, you have the right to object to or ask us to restrict the processing of your personal data. This right applies where our processing of your personal data is necessary for our legitimate interests. You can also object to our processing of your personal data for direct marketing purposes.
To request erasure of your personal data Subject to certain conditions, you are entitled to have your personal data erased (also known as the “right to be forgotten”), e.g. where your personal data is no longer needed for the purposes it was collected for, or where the relevant processing is unlawful. We may not be able to erase your personal data, if for example, we need it to (i) comply with a legal obligation, or (ii) exercise or defend legal claims.
To withdraw your consent As stated above, where our processing of your personal data is based on your consent you have the right to withdraw your consent at any time. If you withdraw your consent, this will only take effect for future processing.