Privacy policy: Personal Data Processing

Dear Resident,

We are pleased to share with you our personal data privacy and protection policy relating to personal data that we may need to process in the context of our communications regarding Colas work projects underway within your geographical area.

This policy is presented in a question-and-answer format. It briefly describes the personal data relating to you in our possession and how we use them. It also points out your specific rights in terms of personal data and explains how to exercise them.

Table of Contents

1. Who acts as Data Controller as regards my personal data?

The Data Controller is:

Colas SA
1, rue du Colonel Pierre Avia
75015 Paris, France
Registration number: RCS Paris (France): 552 025 314

The Chief Privacy Officer (CPO) of Colas is your contact person for any question concerning this document. You can contact the CPO at: dataprivacy@colas.com.

Where Colas SA shares your personal data with its Affiliates ("Affiliates" means our subsidiaries), the Affiliates are also joint data controllers as explained in this Privacy Policy.

In this Privacy Policy:

  • References to "we", "us" or "our" mean Colas SA and/or the Affiliates; and
  • References to "you" and "your" are to the data subject.

2. Joint controllers?

We are jointly responsible for processing your personal data and have therefore concluded an agreement in accordance with Article 26 GDPR. The essence of the joint controllers’ agreement is as follows:

  • The controllers collaborate in joint processing activities related to all purposes listed in this policy.
  • The controllers shall provide the data subject with any information concerning the processing of their personal data.
  • Data subject requests are primarily handled by Colas’ Chief Privacy Officer; parties provide each other needed information.
  • The controllers have undertaken appropriate technical and organisational security measures to ensure and demonstrate compliance.

3. Why do you need my personal data?

We use your personal data to:

  • Keep you informed on Colas work projects being carried out within your geographical area.
  • Process your questions or comments through the Hello Travaux app and issue notifications in response.
  • Provide notifications (geolocation) regarding work projects in your area.
  • Compile usage statistics for the Hello Travaux app.

We process your personal data based on your consent. By continuing to browse in our app, you consent to the processing of your data under the conditions stated in this policy.

5. How did you collect my personal data?

We have obtained or collected your personal data as follows:

  1. Data communicated when creating/modifying your user account and/or using the website/app and its services.
  2. Technical data collected during use (IP address, device ID, cookies – cartography, session).
  3. Geolocation data collected by the app, after your consent.

6. What categories of personal data do you collect about me?

We process the following categories of personal data:

  • Username
  • Device ID (for notifications) linked to submitted comments or questions
  • Geolocation (to identify work sites)
  • Usage data / cookies

7. What categories of cookies do we use and why?

We only use strictly necessary cookies so visitors can navigate and use essential functions. These cookies are always active.

Name Description Expiry
cartography Displays the map on the website Session duration
PHPSESSID Manages user authentication Session duration

8. Are you using a service provider (subcontractor) to process my personal data?

Collected personal data are stored on the Microsoft Azure platform in the European Union.

9. Do you share my personal data to other entities?

Colas SA may share your personal data with the Affiliate located in your country when needed to provide requested information.

Affiliates:

  • Colas Ltd: Registered in England and Wales, Company No: 2644726, Wallage Ln, Rowfant, Crawley Down, Crawley RH10 4NF - UK
  • Colas Maroc (GTR): RC 143925 Casablanca, 18, lotissement la Colline II - Sidi Maarouf, 20190 Casablanca – Maroc
  • Colas Suisse SA: RC CH-645.1.004.512-0, Route de Berne 20 1010 Lausanne - Swiss

We do not share nor resell your personal data to third parties. The only third party processing your data is our hosting provider (see previous section).

10. Do you hold any sensitive data1 about me?

No. We do not collect sensitive personal data.

11. Where is my personal data transferred?

Your personal data may be transferred between your country and the European Union.

12. Where are my personal data stored geographically?

Your personal data is stored in the European Union.

13. How long will you keep my personal data?

We keep your data for the duration of your participation and perform systematic annual purges. Geolocation data is not retained.

14. Will my personal data be used to make automated decisions or profiling2?

No.

15. What are my rights concerning my personal data?

You have the following rights:

  1. Right of access – to know whether we hold your data and obtain a copy.
  2. Right to rectification – to correct inaccurate information.
  3. Right to erasure – to request deletion under conditions in Article 17 GDPR.
  4. Right to object – to object, for legitimate reasons, to distribution, transmission or storage.
  5. Right to restriction – to limit processing to what is necessary.
  6. Right to data portability – to obtain some data in a machine‑readable format.
  7. Right to withdraw consent at any time (when processing is based on consent).

Note: These rights are not absolute. In some cases (legal obligation, public interest, commitments to you) we may refuse and will communicate reasons.

If you withdraw consent, request deletion, or object to processing, we can no longer send notifications and you will not be able to use all features (e.g. geolocation). You may still use the app in consultation (view-only) mode without consenting to geolocation or notifications.

17. How can I exercise my rights and who should I contact?

To exercise your rights, contact Colas’ Chief Privacy Officer (CPO):

Colas SA
ATT: Chief Privacy Officer
1, Rue du Colonel Pierre Avia
75015 Paris, France
Email: dataprivacy@colas.com

For UK residents:

Colas Ltd
ATT: Chief Privacy Officer
Wallage Ln, Rowfant, Crawley Down, Crawley RH10 4NF
Email: dataprivacy@colas.com

If you believe your data protection rights have been breached, you can lodge a complaint with your national Data Protection Authority:

1 Sensitive or special data: personal data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, sex life or sexual orientation; and data relating to criminal convictions and offenses.

2 Profiling: any form of automated processing of personal data to evaluate certain personal aspects (e.g. performance at work, economic situation, health, preferences, interests, reliability, behavior, location or movements).