E-CPD System Data Privacy Notice

Download the E-CPD System Data Privacy Notice

The purpose of this Data Privacy Notice (hereinafter referred to as the "Notice") is to inform data subjects (hereinafter referred to as the "Subjects") about how we collect, store and process their personal data in connection with the E-CPD portal (the E-CPD portal, including all related domains, the “E-CPD System”).

1. Entity Responsible for Processing and Principles

The Federation International de l’Automobile and Alliance Internationale de Tourisme (hereinafter collectively referred to as "FIA") recognize the importance of keeping Subjects’ data confidential and protecting their privacy rights. Therefore, all personal data and information (hereinafter referred to as "Data") provided in connection with the E-CPD System will be processed lawfully, fairly, transparently and confidentially.

2. Consent

FIA will seek Subjects’ prior and explicit approval via the E-CPD System when collecting, and before processing, Subjects’ Data for the purposes of keeping Subjects informed of FIA activities and for any purposes in connection with the E-CPD System where Subjects’ consent is required and FIA is unable to use any other legal basis for such processing.

3. Legal Basis and Purposes of Data Collection and Processing

3.1 Legal Basis

The Subject acknowledges that the collection and processing of Data by FIA is necessary for providing specific services the Subject might be using in connection with the E-CPD System, but also for the preservation of the legitimate interests of FIA and for the fulfilment of legal obligations incumbent upon FIA.

3.2 Purposes

The Data is collected and processed by FIA for the following purposes (hereinafter referred to as "Purposes"):

FIA collects and processes the Data of individuals who represent organizations in the FIA/AIT CPD network (“Relevant Organizations”) and administer applications for a Carnet de Passages en Douane (a “CPD”) on behalf of Relevant Organizations, including any individuals who interact with FIA in respect of the E-CPD System (“Relevant Personnel”). This processing is for the purpose of administering and operating the E- CPD System.
FIA collects and processes the Data of individuals who apply for a CPD through the E- CPD System (“Applicants”). This processing is for the purpose of administering and operating the E-CPD System and providing such Data to Relevant Organizations.
FIA processes Applicants’ Data for CPD tracking and claims-handling purposes and may engage third parties to carry out such functions on its behalf.
Technical data, on the other hand, is processed automatically and anonymously to improve your browsing experience and collect use statistics.

4. What Data is Collected?

4.1 Type of Data

As part of the E-CPD System, FIA collects the following Data (contemplative, non-exhaustive list) from Subjects:

Identification data: personal identification data (such as name, surname, title, date of birth, country of birth, nationality, resident status, contact details, passport, driving licence, ID card details and reference details).
Identification data: the data referred to above, but in respect of the relevant vehicle owner (if not the same person as the Applicant).
Professional data: such as job title, function.

4.2 Data Collected from Third Parties

As part of its services in connection with the E-CPD System, FIA may also collect Data from third parties. For example, FIA may collect Data from Relevant Organizations in relation to Relevant Personnel and Applicants. Where FIA is considered as a controller of such Data, Data collected from third parties is treated in the same way as Data collected directly from the Subjects (see paragraph 4.1 above). In other cases, FIA may be considered as a processor of personal data in the context of Data collected from third parties, according to the applicable regulations. Should this be the case, FIA will enter into a data processing agreement with the third parties concerned to ensure compliance with this Notice.

5. Methods of Data Processing and Retention Schedule

Data is processed by FIA - or by third parties selected on the basis of their reliability and competence, as well as by duly appointed data controllers - solely for the Purposes.

FIA will retain the Data for as long as necessary for the fulfilment of the Purposes for which it was collected. In particular, FIA will keep the Data for up to five years in order for any insurance claims in respect of CPD to be processed. FIA shall delete or anonymize Data (or take equivalent measures) as soon as the Data are no longer necessary to achieve the Purposes, subject however (i) to legal or regulatory requirements applicable to the data retention for a longer period of time, or (ii) to ascertain, exercise and / or defend actual or potential rights in legal proceedings, investigations or similar proceedings, including legal restrictions that FIA might impose to preserve relevant information.

Security measures are applied to prevent the risk of loss of data, unlawful or improper use and unauthorized access (see paragraph 8 (Privacy, Security and Data Protection) below).

6. Profiling

FIA does not profile or use automated decision making in relation to Subjects in connection with the E-CPD System.

7. Access to Data and Data Transfers

The Data transmitted to FIA will be used by FIA personnel and the personnel of third parties for the sole purpose of administering and operating the E-CPD System, including CPD tracking and claims-handling.

As part of the administration and operation of the E-CPD System, the CPD application process and the administration and issuance of CPDs, FIA may transmit the Data to third parties including Relevant Organisations. The transmission of data to third parties abroad is alternatively based on (i) an adequacy decision based on the list of countries whose data protection legal standards are approved by the European Commission, (ii) appropriate safeguards or (iii) a waiver for specific situations (execution of a mandate related to the services offered by FIA, in particular).

FIA will not sell or rent the Data to any third party. Finally, FIA may have to share the Data:

To put the relevant elements of the E-CPD System at the Subjects’ disposal or provide those elements to the Subject;
Where permitted or required by law to comply with a valid legal process;
To protect and defend FIA's rights or property, including the security of its products and services;
To protect the personal safety, property or other rights of the public, FIA or its personnel.

When FIA has the legal obligation to disclose Data to third parties, FIA will take all reasonable steps to notify the Subjects in advance, unless otherwise required by law.

8. Privacy, Security and Data Protection

FIA undertakes to ensure that there are adequate levels of protection of Data.

Subjects’ Data will be transmitted to and stored on secure servers, access to which is strictly limited. FIA has taken appropriate technical and organizational measures designed to protect the integrity and security of Subjects’ Data.

9. Rights of the Subjects

In accordance with the applicable regulations, Subjects may exercise the following rights with respect to their data in connection with the processing of Data:

Right to request access to stored Data;
Right to request the rectification of stored Data;
Right to request the deletion of stored Data, subject to the applicable legal provisions on data retention;
Right to request a limitation of the processing of stored Data, subject to the applicable legal provisions regarding the processing of data;
Right to request a prohibition on the processing of stored Data, withdrawing their consent, subject to the applicable legal provisions regarding the processing of data; and
Right to request the deletion of all stored Data, subject to the applicable law.

Even if a Subject contests the processing of its Data, FIA is entitled to continue such processing if it is (i) legally binding, (ii) necessary for the performance of an Agreement to which the Subject might be party, (iii) necessary for the performance of legal obligations in compliance with proceeding of public interest or (iv) necessary for the legitimate interests that FIA pursues, including the finding, exercise or defense of a right in justice.

The exercise of any right set forth in the paragraph shall be carried out in accordance with the communication provisions of paragraph 10 (Communication and Remarks) below.

10. Communication and Remarks

If you have any questions or complaints about FIA's data protection, a detailed message can be sent to dpo@fia.com and FIA will address them as soon as possible.

You may exercise any of your rights related to Data (paragraph 9) by sending your request to the aforementioned address.

FIA is constantly evolving and this Notice may change. Unless otherwise stated, the Notice applies to the use of all Data collected about any Subject.