General personal data protection policy

Foreword

Respect for fundamental rights and for the rules on personal data protection is an integral part of the ethical values of TAXI TL.

The General Data Protection Regulation, hereinafter "GDPR"¹, applicable in all Member States since 25 May 2018, strengthens the rights of natural persons over their personal data through a harmonised set of protection principles within the European Union.

The GDPR introduces a new principle of "accountability" for private and public sector actors, who must demonstrate that they have implemented appropriate measures to ensure compliance with the protection rules.

These new requirements take the form, in particular, of the appointment of a data protection officer, hereinafter "DPO", the keeping of a register documenting the compliance of personal data processing operations and the implementation of enhanced security measures.

Failure to comply with these rules may lead to heavy financial penalties and damage the image of TAXI TL.

Faced with these new challenges, the Group has decided to adopt a policy (the "Policy") intended to guarantee the protection of the personal data of employees, customers and suppliers, in accordance with its Code of Ethics.

Personal data protection is an asset serving our digital transformation and helps to sustain the trust of our employees, customers and partners.

It is a significant issue for the sustainable conduct of our business.

The Management of G.T.L., as data controller, remains responsible for compliance with the GDPR. The DPO, where appointed, advises the Management, monitors compliance and performs their duties independently, without receiving instructions on how to carry them out (Articles 38 and 39 of the GDPR).

We therefore ask all employees to commit themselves to ensuring that it is properly applied.

1. Objectives

This Policy, approved by the Management, defines the protection rules that TAXI TL must implement when processing personal data² in Europe.

The Policy comprises all the principles intended to ensure that personal data processing is lawful, fair and transparent. It lays down governance rules specifying the roles and responsibilities of those involved in personal data protection.

Every employee, as well as any person or entity outside TAXI TL that processes personal data³, is required to behave in accordance with the principles defined below.

For any request relating to the exercise of the rights of access and rectification, and for any question or complaint concerning the processing of their personal data, employees must consult their DPO, either by post or by e-mail, at the dedicated address given on the intranet.

For any question relating to how the Policy is applied, or any other question, the DPO may be contacted at the following address: privacy@tl.fr

2. Scope

2.1 Entities, employees and processors subject to the Policy

This Policy applies to the legal entities of TAXI TL carrying out their activities in France and, more generally, within the territory of the European Union, hereinafter "EU", whether or not the personal data processing is carried out in the EU.

This Policy applies to all employees, including occasional ones, and to all processors⁴ (data processors within the meaning of the GDPR) who process personal data.

Where national regulations require higher personal data protection standards than those laid down by the GDPR, those national regulations take precedence over the Policy.

Legal entities of the Group that are subject to specific national regulations adopt, where necessary, additional implementing documents, in compliance with this Policy.

2.2 Personal data and processing covered by the Policy

The Policy covers personal data held on any paper or electronic medium, hosted or processed in particular:

• on any IT medium: a server in a data centre or in the cloud, a workstation or a smartphone;
• through applications, databases or data warehouses;
• through portals exposed on the internet or on the intranet;
• through connected objects or smart grids, as well as digitalisation projects.

The Policy applies to all processing of the personal data of employees, customers, suppliers or partners collected, used or transferred by the entities of the Group.

3. Steering and governance

Every employee must comply with the Policy.

The legal representative of each legal entity of the TAXI TL Group ensures that this Policy is circulated within their perimeter and their teams. They are responsible for its implementation, with the assistance of the DPO.

The DPO sets up a governance framework designed to roll out the organisational measures provided for by the GDPR and to enable the Policy to be deployed effectively within each legal entity of the TAXI TL Group.

The implementation of and compliance with the Policy are supervised within each entity by the Management of each entity of the TAXI TL Group, after consulting the DPO and the Chief Information Officer (CIO).

The DPO reports hierarchically to each legal representative. The main duties of the DPO are those provided for in Article 39 of the GDPR and are specified in the Governance. As part of their main duties, the DPO designs and supervises the application of this Policy and coordinates the Data Controllers⁵.

Under the GDPR, each legal entity is responsible for the personal data processing it carries out. It is therefore up to the legal representative of each of these entities to ensure that the Policy is properly applied by their employees, in compliance with the GDPR.

Officers are appointed under the responsibility of the legal representative of each entity of the TAXI TL Group and report functionally to the DPO. The Data Controller defines and monitors compliance with the GDPR and the Policy within their perimeter. The Data Controller or, failing that, the legal representative provides help and advice to employees who have questions or who raise concerns about personal data protection, and ensures that employees adopt practices that comply with the Policy, the GDPR and the applicable national regulations.

4. Protection principles set out by the GDPR

4.1 Accountability principle

Under the accountability principle laid down by the GDPR, each legal entity of the TAXI TL Group must:

• be able to document at any time how it ensures the protection of personal data;
• implement appropriate technical and organisational measures in order to be able to demonstrate that each personal data processing operation complies with the GDPR and the applicable national legislation.

In practice, this principle is implemented through the following measures:

• appointment of a DPO, where such appointment is mandatory under the GDPR or the applicable national regulations;
• keeping of an internal register of personal data processing operations mapping the processing carried out by the entities;
• data protection impact assessments, in the mandatory cases provided for by the GDPR;
• protection of personal data by design for any new project concerned;
• implementation by the entities of appropriate procedures in the event of risks generated by the personal data processing linked to their activities.

4.2 Specified, explicit and legitimate purposes

Personal data must be processed lawfully, fairly and transparently. It must be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with the original purposes.

Each entity must pay particular attention to the processing of special categories of personal data (sensitive data) revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, data concerning health, or a person's sex life or sexual orientation.

Each entity may process this type of personal data only with the explicit consent of the data subject or in the cases expressly authorised by national legislation and the GDPR.

4.3 Relevance, proportionality and minimisation of the personal data collected

The personal data processed by the entities must be accurate, relevant and limited to the purposes for which it is collected.

4.4 Lawfulness of personal data processing

Each entity remains responsible for the lawfulness of the personal data processing it carries out.

Lawful personal data processing, within the meaning of the GDPR, must be based on one of the following grounds:

• compliance with a legal obligation to which the entity is subject;
• performance of a contract to which the data subject is a party;
• legitimate interests pursued by the entity, unless overridden by the interests or fundamental rights and freedoms of the data subject;
• express consent of the data subject for one or more specific purposes, in the cases provided for by the GDPR.

4.5 Transparency and right to information

Each entity must ensure that the persons concerned by personal data processing are informed, by means of the notices required by the GDPR, on any medium allowing concise, transparent, intelligible and easily accessible communication.

Where data is collected directly from the data subject, the information must be provided at the time the personal data is obtained.

Where data is collected indirectly, for example through the purchase of files, the persons concerned must be informed within a reasonable period not exceeding one month from collection and, in any event, at the latest at the time of the first communication with the data subject or before any disclosure to a third party.

4.6 Rights of access, rectification, restriction, erasure and objection

The persons concerned by personal data processing have a right of access to, rectification of and restriction of the personal data concerning them, a right to erasure of their personal data (right to be forgotten) as well as a right to object to processing and a right to the portability of their personal data, under the conditions laid down by the GDPR.

These rights may be exercised at any time, upon presentation of proof of identity:

• by post: TAXI TL, Data Protection Officer, 83, rue Jean Jaurès, 69500 BRON, France;
• electronically: at privacy@tl.fr or through the website's contact form, stating "Personal data" as the subject.

In the event of any difficulty concerning the management of your personal data by TAXI TL, you may contact the TAXI TL DPO (e-mail address: privacy@tl.fr) or lodge a complaint with the competent French data protection authority (CNIL: 3, place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).

Each entity of TAXI TL must ensure that the persons concerned by its personal data processing are actually able to exercise their rights.

4.7 Classification, confidentiality level and security of personal data

Personal data is classified in accordance with the "TAXI TL Confidentiality Policy", which can be consulted on the TAXI TL intranet under the "Policies and procedures" section.

Documents containing ordinary personal data are to be classified at the "internal" level.

Documents containing special categories of personal data (sensitive data) are to be classified at the "confidential" level.

In addition, each entity must take the necessary measures according to the nature of the personal data, the context and the purposes of the processing, so as to guarantee a level of security appropriate to the risks identified.

The level of security must make it possible to guarantee the confidentiality, integrity and availability of personal data and to limit any risk of destruction, loss, alteration, disclosure of or unauthorised access to personal data.

The personal data processed must be protected in accordance with the Security Directives and the Information Systems Security Governance, which can be consulted upon written request addressed to TAXI TL at the following address: Société GROUPE TRANSPORT LYONNAIS, 83, rue Jean Jaurès, 69500 BRON, France, and on the TAXI TL website.

4.8 Integration of personal data protection into project management

Personal data protection must be integrated into project management and, from the design stage, into new services.

4.9 Data protection impact assessment

Each legal entity of the Group, acting as data controller, carries out a data protection impact assessment before implementing any new personal data processing operation where the criteria laid down by the GDPR are met, in particular in the event of large-scale processing of special categories of personal data (sensitive data) or the use of new technologies.

4.10 Relations with processors

Entities of the Group that entrust the collection, use or processing of personal data to processors, within the meaning of the GDPR, remain responsible for the protection of that data. These entities must ensure that the processors offer sufficient guarantees with regard to this Policy and the GDPR. Every contract concluded with a processor must define the processor's obligations, including security and confidentiality measures, in accordance with the requirements of the GDPR.

4.11 Transfers of personal data outside the EU

Transfers of personal data outside the EU may take place only in the following cases:

• the country of destination of the personal data is deemed to provide an adequate level of protection, under the conditions set by the European Commission;
• the recipient of the personal data can demonstrate appropriate safeguards enabling the effective exercise of the rights of data subjects, within the meaning of the GDPR;
• under the derogations provided for by the GDPR: explicit consent of the data subject, transfer necessary for the performance of a contract or for reasons of public interest, transfer necessary for the establishment, exercise or defence of legal claims, or for the protection of the vital interests of the data subject.

4.12 Limited retention period

Each entity of the Group must not keep the personal data it processes for longer than is necessary for the purposes for which the data is processed, in compliance with each applicable national legislation.

When personal data is no longer necessary for the purposes justifying its processing, it must be erased or anonymised.

4.13 Geolocation

TAXI TL requires its member taxis to be fitted with a geolocation system in order to ensure, on the one hand, the monitoring, responsiveness, speed and safety of the services and, on the other hand, where applicable, the invoicing of the transport services it provides. The system is not intended to monitor the driving time of taxi drivers and does not make it possible to monitor their movements outside their working hours.

Persons who use the services of TAXI TL accept that they are temporarily (namely for the time needed to perform the transport service) in a taxi vehicle that may be geolocated, and that they may therefore be geolocated.

The legal basis for this processing is legitimate interest (Article 6.1.f of the European General Data Protection Regulation). The data collected is as follows:

• identification of the taxi driver: surname, first name, professional contact details, internal identification number, vehicle registration number;
• data relating to the taxi driver's movements: location data from the use of a geolocation device, number of kilometres travelled, history of journeys made.

The recipients of this data are: the person in charge of accounting, the person in charge of the sales department and the Management of TAXI TL.

This geolocation data may be kept for one (1) year, as the data may be retained as evidence of the proper performance of the services; in the event of a dispute over the services performed, the retention period may be longer, until the dispute is settled.

You may access the data concerning you or request its erasure. You also have a right to object, a right to rectification and a right to restriction of the processing of your data. To do so, you may follow the procedure and use the contact details set out in section 4.6 of this Policy. You may also refer the matter to the CNIL via its website www.cnil.fr for more information on your rights.

5. Operational implementation

The DPO, the Management and the Information Systems Manager assist the entities in implementing the Policy.

The following actions are implemented in order to achieve its objectives:

5.1 Awareness and training

The DPO or, failing that, the legal representative of each entity must ensure that employees have sufficient knowledge to fulfil their obligations under the GDPR and the applicable regulations, according to their degree of involvement in personal data processing.

Given the issues associated with personal data protection, all the staff concerned take part in the awareness-raising actions organised by the DPO.

5.2 Provision of procedures and deliverables

The Policy is rolled out through methodologies, procedures and awareness-raising actions adapted to the specific features of the applicable national regulations.

TAXI TL regularly publishes thematic guides intended to disseminate good practices and to enable the operational implementation of the objectives pursued by the GDPR.

5.3 Traceability of security events

In accordance with the security rules in force within the Group, automated traceability of security events is in place. Each entity may decide which events to trace, depending on the context, the media (workstations, network equipment, servers, etc.) as well as the risks and the requirements of each applicable legislation.

5.4 Management of security incidents and personal data breaches

Each entity of the Group sets up a procedure for reporting security incidents and managing personal data breaches, including crisis management, in compliance with the GDPR and the applicable regulations.

The DPO and the legal representative of the entity are informed without delay of any personal data breach within the meaning of the GDPR. If the breach is likely to seriously affect the rights and freedoms of the persons concerned, the DPO notifies the competent supervisory authority (and, where necessary, the persons concerned) as soon as possible (if possible, within 72 hours of becoming aware of it).

5.5 Compliance review, controls, audits and penalties

The technical and organisational measures bringing personal data processing into compliance are tested, analysed and assessed in order to verify their effectiveness.

Internal controls of compliance with the GDPR, local regulations and the Policy are carried out regularly.

Processors must provide the information necessary to demonstrate compliance with legal obligations.

The actual performance of internal controls may, where necessary, be reviewed by the Management, with the possible support of the Information Systems Manager.

The results of these controls may be communicated to the entity concerned and to the Ethics and Sustainable Development Committee. They may be made available to the competent supervisory authority, in accordance with the GDPR.

The corrective measures adopted in the event of shortcomings identified during the compliance review are documented and regularly updated.

Each legal entity directly bears the penalties that may result from non-compliance with the GDPR and the applicable regulations in respect of its personal data processing.

Exercising your rights, contacting us

To assert your rights over your personal data, you can contact us via the www.tl.fr website or from our customer apps by filling in the contact form. You can also contact us by sending a signed letter, together with a copy of an identity document, to the following address:

Contact

E-mail: commercial@tl.fr

G.T.L. GROUPE TRANSPORT LYONNAIS, TAXI TL. General personal data protection policy, updated 29 October 2026.