Information clause of the Head of the National Revenue Administration

Information clause concerning the processing of personal data of the users of the SPOE NRA system and data obtained through the website supporting the SPOE NRA¹ system or the Phone Customer Service Centre (TCOK) by the Head of the National Revenue Administration

In accordance with Article 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as “GDPR”, please be informed as follows:

1. Identity and contact details of the Controller

The Controller of your personal data is the Head of the National Revenue Administration with its seat in Warszawa, 00-916, ul. Świętokrzyska 12, who, in matters of exercising your rights under RODO in relation to the processing of personal data, can be contacted by directing correspondence to the following address:

ul. Świętokrzyska 12, 00-916 Warszawa,
to an electronic mailbox on the ePUAP platform: /bx1qpt265q/ESP box,
or via e-mail: kancelaria@mf.gov.pl.

2. Contact details of the Data Protection Officer

The Controller has appointed a Data Protection Officer, who can be contacted by directing correspondence to the e-mail address: iod@mf.gov.pl.

3. Purpose of personal data processing and legal basis

The Controller processes your personal data for the purpose of:

collection of a toll, i.e. an electronic toll within the meaning of the Act on Public Roads, by means of mobile devices - performance of a legal obligation incumbent on the Controller (Art. 6 sec. 1(c) of the GDPR),
monitoring of the carriage of goods within the Polish System for Electronic Transport Supervision (SENT) on the basis of the Act on the System of Monitoring Road and Railway Carriage of Goods and Trading in Heating Fuels with the use of the SPOE NRA² for this purpose - performance of a legal obligation incumbent on the Controller (art. 6 sec. 1(c) of the GDPR),
sending information materials and providing additional explanation on the toll system and on the road infrastructure - on the basis of your consent, i.e. that of the data subject (Art. 6 sec. 1(a) of the GDPR),
sending messages via the contact form available on the etoll.gov.pl website (related to the question asked in the form) - on the basis of your consent, i.e. the data subject (Art. 6 sec. 1(a) of the GDPR),
registration and handling of requests relating to the SPOE NRA received through the TCOK - on the basis of your consent, i.e. the data subject (Art. 6 sec. 1(a) of the GDPR).

4. Information on recipients of data

The recipients of your personal data will be entities entitled to obtain personal data under the law. A separate category of recipients of your personal data are entities that process personal data on behalf of the Controller, in particular those with whom the Head of NRA has concluded agreements for the provision of maintenance and servicing services for the IT systems in use.

If you use a fleet card system, the fleet card providers will also be the recipients.

5. Source of personal data

The Controller informs that the personal data of the persons handling the accounts of the entities obliged to pay the toll for the use of toll roads, i.e. the electronic toll within the meaning of the Act on Public Roads, in the SPOE NRA have been provided to him by the aforementioned entities.

The categories of personal data provided to the Controller are as follows: country of residence, PESEL No. (in the case of Polish citizens), identity document no., fleet card no., name, email address, telephone, role.

6. Data storage period

Personal data will be processed for the period necessary to fulfil the purposes for which they were obtained or until the consent given is withdrawn. In the event of the establishment, investigation or defence of claims, they will be archived until the statute of limitations for such claims, after which time they will be archived in accordance with the period provided for by law. In particular:

data processed on the basis of Article 13ia item 17(1) of the Public Roads Act shall be stored for no longer than 36 months, counting from the end of the calendar year in which the owner, holder or user of the vehicle ceased to drive on the national roads or their sections on which the Head of NRA collects electronic toll,
- unless, prior to the expiry of this deadline, there are legal prerequisites obliging the Controller to process the personal data for a longer period of time, and in particular, prior to the expiry of the aforementioned deadline, an administrative or misdemeanour proceeding has been initiated in which the data are necessary, and in this case the data shall be stored until the end of the proceeding,
geolocation data processed on the basis of Art. 13ia sec. 17(2) of the Public Roads Act - shall be kept for no longer than 9 months, counting from the date of completion of the national road journey in question,
- unless administrative or infringement proceedings are instituted before the expiry of that period, and in such a case the data shall be stored until the conclusion of the proceedings concerned;
personal data recorded during a telephone call using the TCOK (including information about the call, in particular: telephone number, date and time of the start and end of the call, and duration of the call) are stored for 9 months, starting from the last day of the month in which the call took place,
data processed on the basis of your consent - will be processed until you withdraw your consent to their processing.

7. The rights of data subjects

The data subject has the right to:

access their personal data (Art. 15 of the GDPR), provided that the exercise of this right may not involve classified information or violate legally protected secrets that the Controller is required to keep, and subject to Art. 5 of the Data Protection Act;
rectification of data (Art. 16 of the GDPR),
deletion of data (Art. 17 of the GDPR),
restriction of data processing (Art. 18 of the GDPR), subject to the cases referred to in Art. 18 sec. 2 of the GDPR,
withdrawal of consent to the processing of data covered by the consent, without affecting the processing that took place until the withdrawal of this consent (Art. 7 sec. 3 of the GDPR). Consent may be withdrawn at any time by sending a statement of withdrawal of this consent to the Controller's postal address indicated in point 1.

If the processing of personal data by the Controller is considered to be in breach of the law, the data subject has the right to lodge a complaint with the President of the Data Protection Authority.

8. Information on the obligation or voluntariness of providing personal data

Under Art. 13ia of the Public Roads Act, providing personal data when registering in the register of electronic toll payers for the collection of toll roads is a statutory requirement - failure to do so will result in the inability to pay the electronic toll at SPOE NRA.

The provision of an e-mail address is necessary in order to send correspondence via the contact form (failure to do so will result in inability to use the form).

The provision of data necessary to send information material regarding the possibility of using the Electronic Toll Collection System of the National Revenue Administration to pay the electronic toll or the toll fee (email address and/or telephone number) is voluntary (failure to do so implies the impossibility of receiving the aforementioned materials by telephone and/or email).

The provision, during a telephone call using TCOK, of contact data (telephone, e-mail address, mailing address) and, in the case of users registered in SPOE NRA, of data identifying your Customer Account number in the SPOE NRA system, as well as the provision of your voice, is voluntary, but necessary in order to undertake activities related to the registration and handling of requests concerning SPOE NRA.

9. Information on the existence of automated decision-making, including profiling

The personal data processed by the Controller will not be used to make automated decisions in individual cases, including profiling as referred to in Art. 22 of the GDPR.

10. Information about the intention to transfer personal data to a recipient in a third country or an international organisation

The Controller has no intention of transferring your personal data to a recipient in a third country or an international organisation on its own initiative.

Your data will only be transferred to third countries if you use a fleet card provider based outside the European Economic Area.

11. Legal basis

The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal J of the EU L 119 of 4 May 2016, pp. 1, as amended).

ACT of 21 March 1985 on public roads (Dz. U. of 2024, item 320), referred to as the Public Roads Act.

ACT of 9 March 2017 on the monitoring system for road and rail transport of goods and trade in heating fuels (Dz. U. of 2023, item 104), referred to as the Act on the Monitoring System for Road and Railway Carriage of Goods and Trade in Heating Fuels

ACT of 10 May 2018 on the protection of personal data (Dz. U. of 2019, item 1781), referred to as the Personal Data Protection Act.

NOTE: in case your data is obtained before 1 July 2023 and processed on the basis of Art. 37a sec. (30) of the Act of 27 October 1994 on toll motorways and the National Road Fund (Dz. U. of 2022, item 2483, as amended), in the wording in force until 1 July 2023, i.e. in the case of realisation of a toll using a 'e-ticket' for travelling on a motorway on which a toll was collected by the Head of NRA - data shall be collected and stored for no less than 12 months and no more than 24 months, counting from the end of the calendar year in which the motorway or its section was travelled. However, in the event that a summons referred to in Art. 37ge sec. 7 of the above-mentioned Act on Toll Motorways and the National Road Fund, to pay an additional toll for driving on a motorway without paying the required toll, administrative, enforcement or administrative court proceedings have been initiated in which the data is necessary, in which case the data is stored until the proceedings in question are concluded.

^{1 SPOE NRA - the ICT system by means of which the Head of NRA collects the electronic fee pursuant to Art. 13hb sec. 1bb of the Act of 21 March 1985 on public roads (Dz. U. of 2024, item 320), hereinafter referred to as the 'Public Roads Act'; in addition, one of the system's modules (the e-TOLL PL mobile application) can also be used to monitor the carriage of goods within the Polish System for Electronic Transport Supervision (SENT) on the basis of the Act of 9 March 2017 on the monitoring system for road and rail carriage of goods and trade in heating fuels (Dz. U. of 2023, item 104) (i.e. the functionalities of the e-TOLL PL mobile application allow for marking the start and end of transport monitored in SENT).}

^{2 See footnote 1}