Privacy

Privacy Policy for Motorway Users

In compliance with the obligations set forth by EU legislation (European Data Protection Regulation No. 679/2016) and national legislation (Legislative Decree No. 196 of 30 June 2003, Personal Data Protection Code including subsequent amendments).

Dear user,

We hereby inform you that, as Data Subject, pursuant to Articles 13 and 14 of EU Regulation 2016/679 on personal data protection (hereinafter referred to as the “GDPR”), the information and data collected by and/or communicated to AUTOSTRADA ASTI-CUNEO S.p.A. (hereinafter referred to as the “Company” and/or the “Data Controller”) will be processed in accordance with the aforementioned GDPR Regulation and Legislative Decree 196/2003 (Privacy Code), as most recently amended.

This Privacy Statement is intended for all users who interact with the Company, whether directly or through its official website and/or call centres and/or the Platform and App for payments and transit display managed with the free flow system, as well as for users who contact the Company to handle any complaints and/or use the Platform for toll reimbursement following roadworks/traffic jams (hereinafter the “Reimbursement Platform”), and concerns all data processed as independent Data Controller. For information regarding the data processed by the Company in its capacity as Joint Holder of the Reimbursement Platform, please refer to the specific Privacy Statement published on the aforementioned Reimbursement Platform.

1. Types of Data collected

The Company may collect certain personal data including (but not limited to) name, surname, date of birth, address, gender, nationality, e-mail address, motorway travel, and other data (hereinafter referred to as “Personal Data”) that may be necessary for the management of the motorway service and other services generally provided through the Company’s website and/or Reimbursement Platform (hereinafter referred to as the “Services”). This may also include photographic images of the vehicle and licence plates (captured by cameras or video cameras located on the respective motorway section, at toll stations and at free flow portals), relevant for the allocation and calculation of the toll for the free flow system and/or in cases of anomalies detected in the traditional toll collection system at stations and any other data that may be necessary for motorway service management.

Please note that the images taken by the cameras do not permit the identification of the persons on board the vehicles in any way.

It should also be noted that the free flow toll collection system, present on part of the relevant section of the motorway, necessarily presupposes the acquisition of images of vehicles in transit under the appropriately signposted free flow portals that also enable licence plate recognition for the purposes of its operation.

Moreover, the Company wishes to inform you that, in order to provide Quality Services and carry out all relevant assessments in case of complaints or disputes, and/or provide traffic and toll reimbursement process information, in full compliance with the Transport Regulation Authority’s (ART) Resolution 132/2024, as amended by the ART Resolution 211/2025 (hereinafter referred to jointly as the “ART Resolutions”), and this Privacy Policy, it will record all phone calls to the users call centres.

The company also provides users a live chat with a physical operator to address their queries. This chat and the personal data it contains will be handled in full compliance with the GDPR and the Privacy Code. Any data provided through such recordings and/or in the live chat falls into the Personal Data category, as specified above.

Personal Data may be entered voluntarily by the user when browsing the Company’s website and/or the Reimbursement Platform and/or the online payment platform and when displaying the transits managed with the free flow system, accessible from the Company’s website or App, or may also be acquired during the use of the Services, if the conditions requiring its collection occur (e.g. correct allocation of tolls, complaints, accidents, etc.).

The Company’s cookie and/or browsing data policies can be found at the following link: https://www.asticuneo.it/en/cookies/

The user is responsible for the accuracy and truthfulness of Personal Data, including that of third parties, provided through the website and/or the Reimbursement Platform or other means made available by the Company, relieving the Data Controller from any liability arising from inaccuracies in the data provided.

2. Purpose of processing

The processing of Personal Data collected – including all recordings of user phone calls to the call centres provided by the Company – is intended for the proper management of the Services, with specific reference to the obligations arising from the user’s use of the Service and related to the functions carried out by the Company in an institutional capacity. Such purposes include:

• Calculation and toll allocation, including the acquisition of data to manage the relationships with accredited electronic toll service providers;
• Toll payment, including the use of the platform and App for online payments;
• Proper handling of toll reimbursement claims, in accordance with the ART Resolutions, also submitted through the Reimbursement Platform;
• Proper handling of any reports and/or complaints and/or queries from users;
• Communications with the user concerning the use of the service and infrastructure as well as toll transactions and any related requests (payment and Company’s recovery of toll credit, toll reimbursement) managed by the Company in its capacity as concessionaire of the A33 Asti-Cuneo motorway stretch, also through the call centres made available to users, the Platform and App for payments and displaying transits managed with the free flow system and the Reimbursement Platform, including communications relating to any complaints;
• Quality assurance of the services provided to users, as referred to, inter alia, in the ART Resolutions;
• Activities for the prevention and detection of infringements relating to the obligation to pay tolls pursuant to Article 176 of Italian Legislative Decree 285/1992, as amended;
• User communications, including those forwarded through the relevant call centre, concerning safety, traffic, and use of the infrastructure managed by the Company;
• Compliance with the administrative, tax, and legal obligations generally applicable to the Company;
• Proper fulfilment of the obligations arising from the Services provided to the user;
• Proper operation of manned live chat that provides information concerning the Service to support users;
• At the user’s request, sending reminders and notification e-mails;
• Measures to ensure the proper operation of the website and/or the Complaints Platform and/or the Reimbursement Platform;
• Interventions on the website.

3. Legal bases for processing

The legal basis for processing is:

• Legal obligation: the need to follow up/execute legal obligations the Company is subject to as a motorway company (technical-administrative management and toll collection; requests from competent authorities; user reimbursement/clarification requests/complaints; legal publications); pursuant to Article 6(1)(c) of the GDPR Regulation;
• Reasons of public interest: need to properly implement the motorway service, prevention of motorway toll evasion, pursuant to Article 6(1)(e) of the GDPR Regulation;
• Legitimate interest: the need to pursue the legitimate interest of the Company of collecting motorway tolls and using the motorway infrastructure it manages properly, pursuant to Article 6(1)(f) of the GDPR Regulation;
• Data Subject’s consent: expressly provided pursuant to Article 6(1)(b) of the GDPR Regulation, and concerning the recording of phone calls to the call centre made available by the Company, for the purposes specified above;
• Upon the data subject’s express consent to processing their data to receive reminder e-mails and notifications of transit for the stretch managed with the free flow system, in accordance with Article 6, paragraph 1, letter a) of the GDPR.

4. Processing methods

Personal Data may be processed in a hard-copy, computerised and digital format and entered in the relevant databases that may be accessed and therefore become known by data processing operators, pursuant to Article 29/GDPR, who may carry out consultation, use, processing, comparison and any other appropriate operation, including automated operations, in compliance with the provisions of the law necessary to guarantee, among other things, the confidentiality and security of the data as well as their accuracy, updating and relevance to the stated purposes, in accordance with the applicable data protection legislation (including the GDPR Regulation and Legislative Decree 196/2003).

In accordance with the provisions of Regulation 2024/1689 (AI Act) and Law 132/2025 on artificial intelligence, it should be noted that the Reimbursement Platform also utilises artificial intelligence systems for certain functions, designed to better verify the consistency of the data entered and declared by the user against the documentation provided.
Artificial intelligence systems are used in full compliance with the applicable regulations specified above and with the GDPR.

5. Nature of data provision

The provision of data is:

• Compulsory, to achieve the purposes related to the obligations provided for by laws, regulations or Community legislation, including the regular collection of tolls, including the proper functioning of the free flow collection system and managing the reimbursement claims;
• Optional, although sometimes necessary for the correct establishment and/or continuation of the relationship with our Company, and for the correct navigation of the site.
• Optional, to receive reminders and notifications of completed transit.

Any refusal to provide the data or incomplete data may prevent the Data Controller from carrying out its institutional duties and fully delivering the services, as well as from complying with legal obligations.

Please note that the user’s consent to data processing is not required if it relates to the correct use of the motorway service and the consequent payment of the toll.

6. Scope of data communication

As Data Subject, your data may be communicated, where necessary for the provision of Services including the proper management of the toll, to duly authorised and appointed personnel of our Company, to parties required to process such data on behalf of the Company for the same purposes as above, who are, for this purpose, appointed “Data Processors” pursuant to Art. 28 of the GDPR Regulation, to interconnected concessionary companies, to providers of the European and national electronic toll service in relation to the data of their respective customers (including, unless there are requests for exclusion, transit data, recorded only by reading the licence plate, in the free flow system) to third party companies, including those providing debt collection services on behalf of the Company and/or access control and/or surveillance services, to companies providing IT and plant engineering services in relation to the activities carried out, with whom the Company has entered into special agreements on data processing, as well as to comply with requests from competent Authorities or for the protection of the Company.

The full list of entities designated as Data Processors pursuant to Article 28 of the GDPR can be requested from the Company by sending a formal request to the following email address: privacy@asticuneo.it.

The aforementioned areas of communication do not require your authorisation as Data Subject, as they are functional to the provision of the Services, to defend a right in court or to pursue a legitimate interest of the Data Controller. Where necessary, in the cases referred to above, the Company shall request your prior consent, as Data Subject.

All the aforementioned Personal Data shall not be disclosed or communicated to unauthorised third parties.

Personal Data shall be managed and stored on servers located in Italy or within the European Union and will not be transferred outside the European Union.

7. Data retention period

The Personal Data collected, also taking into account any choices made by the data subjects regarding cancellation or revocation during the course of processing, will be processed for a period corresponding to the needs for which it was collected, in compliance with the applicable legal or regulatory provisions and/or for a period deemed appropriate to ensure the right of defence in the event of litigation or tax compliance, in compliance with the principle of minimisation pursuant to Article 5.1.c) of the GDPR Regulation.

8. Data Controller – DPO

The Data Controller is AUTOSTRADA ASTI-CUNEO S.p.A. with secondary offices in Turin, Via Bonzanigo 22 – 10144, who can be contacted by writing to the address: privacy@asticuneo.it

The Data Controller has also appointed a Data Protection Officer (“DPO”), who can be contacted at the following email address: dpo@asticuneo.it

The Data Processors responsible for debt collection activities on behalf of the Company are NIVI S.p.A. and RO.S.S. S.r.l.

9. Rights of the data subject

As Data Subject, you may exercise your rights at any time as outlined by Articles 15 et seq. of the GDPR, by contacting the Data Controller, at the contact details provided in this Privacy Statement.

Specifically, the Data Subject has the right to know which personal data is being used, where it came from, to check its accuracy or to request that it be supplemented or updated, or corrected or restricted. You also have the right to request the deletion, transformation into anonymous form or blocking of data processed in breach of the law, as well as to object in any case, for legitimate reasons, to its processing and to modify or revoke previously given consents, without prejudice to the lawfulness of the processing based on the consent given before the revocation.

Furthermore, the Company would like to inform you that you have the right to object to the processing of your data at any time, in accordance with Article 21 of the GDPR, by sending an email to privacy@asticuneo.it.

Furthermore, you are entitled to lodge a complaint with the Data Protection Authority, whose contact details you will find at the following link www.garanteprivacy.it

Società Autostrada Asti-Cuneo S.p.A.

Last updated: May 2026

PRIVACY NOTICE PURSUANT TO PERSONAL DATA PROTECTION LEGISLATION FOR EMPLOYEES AND COLLABORATORS OF ECONOMIC OPERATORS

Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter the “GDPR“), AstiCuneo S.p.A., with registered office at Via Bonzanigo 22, 10144 Turin (TO), Italy (hereinafter the “Company” or the “Data Controller“), hereby wishes to inform economic operators interested in registering (and in the subsequent updating and maintenance of their registration) in the Company’s List of Economic Operators (hereinafter the “List“), to be completed in accordance with the instructions available on the website www.asticuneo.it through the electronic procurement platform provided by DigitalPA S.r.l., that any personal data supplied to the Company for the purpose of registration in the List may be processed under the terms and conditions set out below.

In compliance with the GDPR, the Company shall process such data in accordance with the principles of fairness, lawfulness, transparency, and the protection of the confidentiality and rights of data subjects.

Pursuant to Article 13 of the GDPR, the Company, acting as Data Controller, therefore provides the following information regarding the processing of personal data.

Please note that, under the GDPR:

• “Data Controller” means the natural or legal person that determines the purposes and means of the processing of personal data, including matters relating to security;
• (ii) “Data Subject” means the natural person to whom the personal data relate, thereby excluding legal persons.

With regard to the personal data of the employees and collaborators of the Economic Operator (hereinafter the “Data Subjects“) transmitted for registration in the List and for the management of the relationship with the Economic Operator, the Company acts as the Data Controller of such data pursuant to the GDPR. With regard to the personal data transmitted by the Economic Operator for registration on the electronic platform, DigitalPA S.r.l. acts as the Data Processor pursuant to the GDPR.

The Data Controller is required to inform the Data Subject, in advance, and the person from whom the personal data are collected, about the processing of such data. These obligations are therefore fulfilled separately by the Company and by DigitalPA S.r.l.

In the case of relationships between legal entities, the privacy notice for any Data Subjects involved in the relevant processing—where they perform work or professional activities or otherwise collaborate with the Supplier, and whose data may be communicated to, accessed by and/or processed by the Data Controller in connection with the performance and execution of the principal contractual relationship—is provided by the Data Controller through the Economic Operator itself.

By means of this Privacy Notice, the Company, acting as Data Controller, informs the Data Subjects of the purposes and methods of processing the personal data collected, the scope of their communication and disclosure, as well as the nature of the provision of such data.

Where the Economic Operator is a legal entity, it undertakes to ensure that the Data Subject is fully informed of the contents of this Privacy Notice.

PURPOSES OF THE PROCESSING AND MANDATORY PROVISION OF DATA

The data provided by you are necessary for registration in the above-mentioned List and will be processed not only to comply with obligations arising from laws, regulations, or European Union legislation, but also for the following purposes:

• a) to obtain preliminary information enabling the assessment of whether the Economic Operator meets the requirements for registration in the List and for the subsequent management and updating of the List;
• b) to select Economic Operators to be invited to individual procurement procedures for the award of works, supplies and/or services;
• c) to perform any contracts that may be entered into with the Economic Operator, where it is awarded a contract;
• d) to comply with the legal obligations connected with the management of procurement procedures for works, supplies and/or services, including those carried out through electronic systems;
• e) to conduct statistical, historical, scientific research, or market research activities;
• f) to carry out audit, review, and any due diligence activities concerning the Company and/or its parent companies;
• g) to carry out audit activities that the Company may deem necessary with respect to the Economic Operator.

Failure to provide, or the partial or inaccurate provision of, the above-mentioned data will prevent the Economic Operator from being registered in the List and will consequently prevent the Company from engaging the Economic Operator in future procurement procedures carried out through the List.

CATEGORIES OF PERSONAL DATA PROCESSED

The processing concerns identification and contact data, as well as other personal data relating to employees and/or collaborators of the Economic Operator and/or natural persons holding positions or roles within the Economic Operator’s organisation, for the purposes referred to in Section 1 above.

For the purposes referred to in Section 1(a), (b), (c) and (d), the processing may also involve judicial data where required by the applicable legislation and by the legal obligations to which the Company is subject.

METHODS OF PROCESSING

Personal data are processed by electronic means as well as by non-automated means. They are collected in electronic archives, including cloud-based systems, and, where appropriate, in paper files. The subsequent processing is carried out predominantly by automated means, including the use of electronic tools designed to store, manage and transmit such data, according to procedures strictly related to the purposes described above and always in compliance with the applicable data protection legislation.

SCOPE OF DATA PROCESSING

The data may be processed by the Company’s personnel who have been assigned specific responsibilities and have received appropriate operational instructions, as well as by third parties carrying out activities on behalf of the Data Controller.

Such third parties act as Data Processors pursuant to specific data processing agreements entered into in accordance with Article 28 of the GDPR.

An updated list of the Data Processors is available upon request by writing to privacy@asticuneo.it.

DISCLOSURE OF PERSONAL DATA

Without prejudice to disclosures required by law, regulations or European Union legislation, and within the limits of the purposes described above, personal data may be disclosed to:

• a) persons appointed as members of the commissions responsible for procurement procedures relating to works, supplies and/or services;
• b) persons having a legitimate interest, within the limits permitted by the applicable legislation;
• c) the Italian National Anti-Corruption Authority (ANAC) and the Public Contracts Observatory;
• d) external collaborators, professionals and/or consultants providing advisory or assistance services to the Data Controller;
• e) the Company’s parent companies, exclusively for the purposes referred to in Section 1 above.

The personal data collected may also be disclosed to judicial authorities, administrative authorities or other public bodies legally entitled to request them, in the cases provided for by law or under the concession agreement between the Italian Ministry of Infrastructure and the Company concerning the operation, management and construction of the Turin–Milan motorway.

Each of the above-mentioned recipients shall process the data, within the scope of its respective responsibilities, as an independent Data Controller pursuant to the GDPR.

TRANSFER OF DATA ABROAD

The personal data of the Data Subjects may be transferred to countries within the European Union.

Further information may be obtained by contacting privacy@asticuneo.it.

DATA RETENTION PERIOD

The data will be retained for the duration of the Supplier’s registration in the List and for the duration of any contractual relationship established between the Company and the Supplier. In any event, the data will not be retained for more than ten (10) years following the termination of such contractual relationship or from the date of registration in the List, without prejudice to any longer retention periods required by applicable limitation periods or by law.

DATA CONTROLLER

The Data Controller is AstiCuneo S.p.A., with secondary offices in Turin (TO), Tax Code and VAT No. 08904401000.

EXERCISE OF DATA SUBJECTS’ RIGHTS

Pursuant to Article 15 of the GDPR, the Data Subject has the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, to obtain access to the personal data and the following information:

• a) the purposes of the processing;
• b) the categories of personal data concerned;
• c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
• d) where possible, the envisaged period for which the personal data will be stored or, where this is not possible, the criteria used to determine that period;
• e) the existence of the right to request from the Data Controller the rectification or erasure of personal data or the restriction of processing concerning the Data Subject, or to object to such processing;
• f) the right to lodge a complaint with a supervisory authority;
• g) where the personal data have not been collected from the Data Subject, any available information as to their source;
• h) the existence of automated decision-making, including profiling referred to in Article 22(1) and (4) of the GDPR and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.

Where applicable, the Data Subject also has the rights provided for in Articles 16 to 21 of the GDPR (right to rectification, right to erasure, right to restriction of processing, right to data portability, and right to object), as well as the right to lodge a complaint with the competent Data Protection Supervisory Authority.

Furthermore, the Data Subject has the right to withdraw his or her consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, in accordance with Article 13(2)(c) of the GDPR.

These rights may be exercised by submitting a written request to the Data Controller by e-mail to: privacy@asticuneo.it.

10. DATA PROTECTION OFFICER (DPO)

The Company has appointed a Data Protection Officer (DPO), who may be contacted by e-mail at the following address: dpo@asticuneo.it.

Turin, July 2026

INFORMATION NOTICE FOR CANDIDATES PURSUANT TO DATA PROTECTION LEGISLATION

1. Processing of personal data

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of personal data (“GDPR”), we hereby inform you that AstiCuneo S.p.A. (the “Company” or the “Data Controller”), as data controller, processes your personal data provided by you and also collected from third-party sources, in connection with the recruitment and selection procedures initiated by the Company.

2. Purpose of this information notice

This information notice allows you to understand the nature of the personal data concerning you and subject to processing, the purposes and methods of processing, any recipients of such data, as well as the rights granted to you.

Also taking into consideration any future changes that may occur in the applicable personal data protection legislation, the Company may supplement and/or update this information notice, in whole or in part, on the Company’s website (www.asticuneo.it).

3. Purposes of data processing

Your personal data are processed for recruitment and selection purposes, in particular to verify the requirements for recruitment and/or the commencement of a collaboration relationship and to follow up on the candidate’s request.

4. Nature of the provision of data

The provision of data is optional and is left to the discretion of the candidate who, without any solicitation from the Data Controller, submits their curriculum vitae.

With regard to any additional data subsequently and possibly requested by the Data Controller, failure to provide such data will make it impossible to verify the requirements for the selection procedures, recruitment and/or commencement of the collaboration relationship and, therefore, any possible establishment of a relationship with the Data Controller.

5. No requirement for consent

Your consent to the processing of your personal data is not required, as the processing concerns data contained in curricula vitae voluntarily submitted by the data subjects for the possible establishment of an employment and/or collaboration relationship.

6. Personal data subject to processing

In particular, the personal data concerned include: name and surname, address or other personal identification details, employment-related data, social security data, educational background and professional experience.

On an occasional and exceptional basis, such as where, due to the establishment of an employment relationship, the Company becomes aware of the possible belonging of the data subject to protected categories, additional personal data falling within the category of “special categories of personal data” pursuant to applicable legislation may be collected (data suitable for revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of political parties, trade unions, associations or organisations of a religious, philosophical, political or trade union nature; as well as personal data capable of revealing health status and sex life).

7. Methods of data processing

Personal data may be processed not only through electronic means but also through non-automated tools. Processing is carried out exclusively through operations, as well as procedures, organisational methods and data management processes that are strictly necessary in relation to the obligations, tasks or purposes indicated above.

8. Data circulation

8.1 Data are used by personnel of the Data Controller who have been assigned a specific role and who have received appropriate operational instructions.

Your personal data will be accessible only to those individuals within the Company’s organisation who need to access them due to their duties or hierarchical position.

8.2 Your personal data may also be processed by third parties to whom the Company entrusts activities and services (or part thereof) in order to pursue the purposes indicated in this information notice.

Such parties will operate, depending on the circumstances, either as data processors or as independent data controllers and include the following categories:

• a) companies belonging to the same group as the Company;
• b) entities providing information system management and maintenance services;
• c) entities providing personnel recruitment and selection services;
• d) entities providing administrative services for obtaining consular visas.

8.3 The above-mentioned third parties may also be established abroad, in EU or non-EU countries.

In the latter case, the transfer of data is carried out on the basis of the existence of an adequacy decision adopted by the European Commission concerning the level of data protection ensured by the non-EU country, or on the basis of appropriate safeguards provided for under Articles 46 or 47 of the GDPR (e.g. execution of the “standard contractual clauses” for data protection adopted by the European Commission), or on the basis of other lawful grounds for transfer provided for under Article 49 of the GDPR.

For further information regarding any transfer of your personal data outside the European Union, you may contact privacy@asticuneo.it.

9. Data retention period

Data will be retained for the period necessary to fulfil the requirements related to the candidate selection process and, in any case, for no longer than five years from their collection, without prejudice to the possible establishment of an employment and/or collaboration relationship.

10. Data Controller

The Data Controller is AstiCuneo S.p.A., with secondary offices in Turin (TO), Via Bonzanigo 22, registered with the Turin Companies Register, tax code and VAT number 08904401000.

11. Data Protection Officer

The Company has appointed a Data Protection Officer (also known as “Data Protection Officer” or “DPO”).

The DPO may be contacted through the following communication channel: dpo@asticueno.it.

12. Exercise of rights

Where the relevant conditions are met and within the limits provided for by applicable legislation, you may exercise the following rights in relation to the processing of your personal data:

(i) the right to access your personal data and information relating to their processing;

(ii) the right to rectification where personal data are inaccurate or incomplete;

(iii) the right to obtain the erasure of personal data;

(iv) the right to object to the processing of personal data;

(v) the right to restriction of processing of personal data;

(vi) the right to obtain the transfer of personal data to other companies or organisations and/or to receive personal data in a structured, commonly used and machine-readable format.

The above-mentioned rights may be exercised by contacting privacy@asticueno.it.

If you believe that your personal data have been processed unlawfully or improperly, you may lodge a complaint with the Italian Data Protection Authority (“Garante per la protezione dei dati personali”), following the procedures indicated on the Authority’s website (www.garanteprivacy.it).

Turin, 27/07/2026