Data Privacy

 

1. Purpose

ViaPlus is committed to protecting the privacy, confidentiality, integrity, and availability of personal data entrusted to it by employees, applicants, customers, consumers, business partners, vendors, service providers, and other individuals.

This Policy is part of an overall ViaPlus Data Privacy Framework and establishes the enterprise-wide principles, responsibilities, and requirements governing the collection, use, access, storage, disclosure, transfer, retention, protection, and disposal of personal data processed by or on behalf of ViaPlus.

This Policy serves as the foundation of ViaPlus’s privacy governance program and establishes the minimum global requirements applicable to all processing of personal data across the organization. This Policy applies to ViaPlus and its subsidiaries.

Where applicable law imposes requirements that are more restrictive than those contained in this Policy, the stricter requirement shall apply.

2. Scope

This Policy applies to all ViaPlus directors, officers, employees, contractors, consultants, temporary personnel, and interns (collectively “Representatives”); all subsidiaries; all business processes, products, services, systems, applications, databases, and technologies that process personal data; artificial intelligence, machine learning, analytics, and automated processing activities involving personal data; and third parties processing personal data on behalf of ViaPlus.

This Policy applies regardless of whether ViaPlus acts as a data controller, business, processor, service provider, data fiduciary, or similar role under applicable law.

This Policy is supported by the Data Privacy Framework, Information Security Policy, AI Governance Policy, Privacy Procedures, Document Retention Policy, Cross-Border Data Transfer Standard, EU-U.S. Data Privacy Framework Addendum, India Digital Personal Data Protection Act Addendum, and other regional privacy requirements.

3. Employee Requirements

Representatives, including Employees must:

• access and use personal data only when necessary for authorized job responsibilities;
• collect and retain only the personal data necessary for an approved business purpose;
• use approved Company systems, storage locations, communication channels, and AI tools;
• follow applicable retention schedules and legal-hold instructions;
• obtain required Privacy, Legal, Information Security, Procurement, or AI-governance review before beginning a materially new use of personal data; and
• immediately report suspected loss, misuse, unauthorized access, unauthorized disclosure, or other incidents involving personal data to dpo@viaplus.com.

Representatives, including Employees must not:

• place personal data in Representative’s personal email, personal cloud storage, unapproved applications, or unofficial repositories;
• enter personal data into an unapproved AI tool or use a personal AI account for Company personal data;

4. Policy Statement

ViaPlus shall process personal data in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, security and confidentiality, and accountability. These principles apply throughout the entire lifecycle of personal data.

5. Key Definitions

Personal Data means information relating to an identified or identifiable individual, whether maintained electronically or in paper form.

Sensitive Personal Data means personal data requiring heightened protection under applicable law or Company policy, including health, biometric, genetic, financial, government identification, precise location, and other specially protected information.

Processing means any action involving personal data, including collecting, accessing, using, storing, sharing, analyzing, modifying, transferring, or deleting it.

6. Lawful Processing

Personal data shall only be processed for legitimate and authorized business purposes and where an appropriate legal basis exists under applicable law. Business units shall ensure processing activities support a legitimate business objective, do not collect data merely because it may be useful in the future, remain consistent with the original collection purpose, and that new categories of processing are reviewed before implementation.

No employee may introduce a materially new use of personal data without appropriate review and authorization. Example: Using license plate images originally collected to process toll transactions for a substantially different purpose, such as creating driver travel profiles for targeted advertising, would constitute a materially new use of personal data and require appropriate review and authorization.

7. Fairness, Transparency, and Individual Expectations

ViaPlus shall process personal data in a manner that is transparent, fair, and consistent with the reasonable expectations of affected individuals. ViaPlus shall maintain privacy notices and disclosures, communicate how personal data is collected, used, shared, retained, and protected, and avoid deceptive, misleading, or unexpected uses of personal data. Processing shall remain aligned with applicable notices, customer commitments, and contractual obligations.

8. Purpose Limitation

Personal data shall be collected and used only for specified, legitimate, and authorized purposes. Personal data shall not be used in a manner inconsistent with privacy notices, processed for unrelated business purposes, shared beyond authorized business needs, used in violation of contractual obligations, or used to train artificial intelligence models without appropriate review and authorization. Where a new purpose is identified, ViaPlus shall determine whether additional notice, authorization, consent, or governance review is required.

9. Data Minimization

ViaPlus shall collect, access, use, disclose, and retain only the personal data reasonably necessary to accomplish an approved business purpose. Representatives shall limit collection, restrict access to persons with a legitimate business need, avoid unnecessary duplication, and avoid creating unofficial repositories containing personal data.

10. Data Quality, Accuracy, and Integrity

ViaPlus shall take reasonable measures to ensure that personal data is accurate, complete, relevant, reliable, and current. Known inaccuracies shall be corrected in a timely manner.

11. Retention and Disposal

Personal data shall not be retained longer than necessary to fulfill business objectives, meet contractual obligations, comply with legal requirements, support litigation or investigations, defend legal claims, or meet documented operational requirements. Upon expiration of the applicable retention period, personal data shall be securely deleted, destroyed, anonymized, or otherwise disposed of using approved methods. Representatives must not delete or alter personal data that is subject to a legal hold, investigation, audit, incident response, or privacy-rights request, even if the ordinary retention period has expired. Representatives receiving a subpoena, warrant, court order, law-enforcement request, regulatory request, or other government demand involving personal data must immediately forward it to the legal@viaplus.com and dpo@viaplus.com and must not disclose personal data or respond on behalf of ViaPlus unless authorized.

12. Security and Confidentiality

ViaPlus shall implement and maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, loss, destruction, misuse, or other unauthorized processing. Representatives shall use approved systems, protect credentials, maintain confidentiality obligations, and report actual or suspected security incidents immediately through the Help Desk.

13. Sensitive Personal Data

Sensitive personal data shall only be processed for approved and legitimate purposes, under an appropriate legal basis, with enhanced safeguards, by authorized representatives, and subject to any additional approvals required by law or company policy. Representatives handling sensitive personal data shall exercise heightened diligence regarding access, transmission, storage, retention, and disclosure. Processing involving children’s personal data requires prior Privacy and Legal review and any additional safeguards required by law.

14. Privacy by Design

Privacy considerations shall be integrated into the design, development, acquisition, implementation, and modification of products, services, applications, technologies, business processes, vendor relationships, artificial intelligence solutions, and new processing activities. Privacy risks should be identified and addressed as early as possible within project lifecycles.

15. Individual Rights

Employees who receive a request from an individual to access, correct, delete, restrict, obtain, or otherwise exercise rights concerning personal data must promptly forward the request to the Data Protection Officer (dpo@viaplus.com). Employees must not independently respond to the request, promise an outcome, delete responsive information, or delay escalation.

16. Data Sharing, Third Parties, and Vendors

Personal data shall only be shared with third parties when a legitimate business purpose exists, due diligence has been completed, required privacy and security reviews have been performed, appropriate contractual protections are in place, and applicable legal requirements have been satisfied. The Data Protection Officer, in consultation with the Legal Department where appropriate, is the ultimate decision maker for the release of this data. ViaPlus remains accountable for personal data transferred to third parties acting on its behalf to the extent required by law, contractual obligations, and recognized privacy frameworks.

17. Cross-Border Data Transfers

Transfers of personal data across national borders shall be conducted in accordance with applicable legal requirements and approved organizational processes. Appropriate safeguards and transfer mechanisms shall be implemented where required by law.

18. Artificial Intelligence and Automated Processing

Representatives, including Employees must consult the Data Protection Officer before implementing or materially changing an AI activity involving:

• a new category or use of personal data;
• sensitive personal data or children’s personal data;
• monitoring, profiling, or significant automated decisions;
• a new vendor, service provider, platform, system, integration, or data-sharing arrangement;
• transfer of personal data to a new country;
• AI training, model development, testing, tuning, or evaluation using personal data; or
• other processing that may create a heightened risk to individuals.

19. Incident Reporting and Data Breach Management

All representatives must immediately report suspected privacy violations, unauthorized access, unauthorized disclosures, lost or stolen devices containing personal data, security incidents involving personal data, improper use of personal data, and violations of this Policy to dpo@viaplus.com. Failure to report a known incident may constitute a violation of this Policy.

20. Reporting Concerns and Non-Retaliation

ViaPlus encourages representatives to raise privacy concerns, seek guidance, and report suspected violations in good faith. Retaliation against individuals acting in good faith is prohibited and may result in disciplinary action.

21. Roles and Responsibilities

The Data Protection Officer oversees the privacy program and monitors compliance. Information Security maintains safeguards and supports incident response. Employees and Contractors must comply with this Policy and complete required training.

22. Training and Awareness

Representatives with access to personal data shall receive privacy awareness and training appropriate to their role and responsibilities. Training shall address privacy obligations, security responsibilities, incident reporting requirements, proper handling of personal data, and AI-related privacy risks.

23. Accountability, Monitoring, and Assurance

ViaPlus may monitor and audit compliance with this Policy and require corrective action where deficiencies are identified

24. Compliance and Enforcement

Compliance with this Policy is mandatory. Violations may result in corrective action, disciplinary measures, termination of employment or engagement, contractual remedies, regulatory reporting obligations, civil liability, or other legal consequences.

25. Policy Governance

The Data Protection Officer is responsible for maintaining this Policy and coordinating periodic reviews. This Policy shall be reviewed at least annually and whenever significant legal, regulatory, operational, or business changes occur. Exceptions must be approved through established governance processes and shall never authorize conduct that violates applicable law.

 

 

ViaPlus EU-U.S. Data Privacy Framework Addendum

Effective Date: August 1, 2026

A.1         General

This EU‑U.S. Data Privacy Framework Addendum (“DPF Addendum”) supplements the ViaPlus Privacy Policy and applies solely to personal data received from the European Union. It also applies to ViaPlus subsidiaries, TollPlus, LLC and Cofiroute USA, LLC.

A.2         DPF Participation and Commitment

ViaPlus has applied for the EU‑U.S. Data Privacy Framework and is awaiting feedback. This paragraph will be updated should ViaPlus be approved. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit Data privacy framework website. ViaPlus commits to annually re-certify its adherence to the EU–U.S. Data Privacy Framework Principles.

A.3         DPF Scope

This Addendum applies to personal data received in the United States from the European Union in reliance on the EU-U.S. DPF and covered by ViaPlus’s certification. This Addendum applies to personal data collected, received, stored, used, shared, or otherwise processed by ViaPlus, including but not limited to:

1. a) ViaPlus employees and contractors (including applicants for employment with ViaPlus);
2. b) All users of the ViaPlus website(s) and ViaPlus social media pages and apps;
3. c) ViaPlus business contacts and suppliers; and
4. d) Service users i.e. individuals whose Personal Data is processed by ViaPlus in the course of delivering projects for our clients.

The types of personal data covered by this Addendum may include identification and contact information; account and authentication information; vehicle and license-plate information; tolling, trip, and transaction information; payment and billing information; customer-service communications; website, device, and usage information; business-contact and supplier information; and the human resources information described in Section A.11. The specific information processed depends on the individual’s relationship with ViaPlus and the services involved.

A.4         DPF Purpose Limitation and Use of Personal Data

ViaPlus processes personal data covered by this DPF Addendum for purposes consistent with those described in the ViaPlus Privacy Policy, including providing and improving services, responding to inquiries, ensuring security, complying with legal obligations, and enforcing agreements.

Personal data will not be further processed in a manner incompatible with those purposes.

A.5         DPF Onward Transfers and Accountability

ViaPlus may transfer covered personal data to third parties acting as independent controllers or to service providers acting as agents on ViaPlus’s behalf. ViaPlus discloses covered personal data to IT and cloud service providers for hosting, security, maintenance, and technical support; operations service providers for customer support, communications, payment administration, and business operations; and tolling operations providers for account administration, transaction processing, interoperability, enforcement, and related transportation services.

Transfers to Independent Controllers. When ViaPlus transfers covered personal data to a third party acting as an independent controller, ViaPlus complies with the Notice and Choice Principles and enters into a contract providing that the personal data may be processed only for limited and specified purposes consistent with the consent provided by the individual, that the recipient will provide the same level of protection as the DPF Principles, and that the recipient will notify ViaPlus if it determines that it can no longer meet this obligation. The contract will require the recipient, upon making such a determination, to cease processing the personal data or take other reasonable and appropriate steps to remediate the situation.

Transfers to Agents. When ViaPlus transfers covered personal data to a third party acting as an agent on ViaPlus’s behalf, ViaPlus transfers the personal data only for limited and specified purposes; ascertains that the agent is obligated to provide at least the same level of privacy protection required by the DPF Principles; takes reasonable and appropriate steps to ensure that the agent processes the personal data in a manner consistent with ViaPlus’s obligations under the DPF Principles; requires the agent to notify ViaPlus if it determines that it can no longer provide the required level of protection; and, upon notice or otherwise becoming aware of unauthorized processing, takes reasonable and appropriate steps to stop and remediate that processing. ViaPlus remains liable under the DPF Principles if a third‑party agent processes personal data in a manner inconsistent with the DPF, unless ViaPlus proves that it is not responsible for the event giving rise to the damage. Third parties are required to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the DPF Principles. Onward transfers of human resources personal data may include service providers supporting payroll, benefits administration, human resources information systems, recruiting platforms, background screening, compliance, IT, and professional services, and are subject to the same contractual and accountability requirements under the DPF Principles.

A.6         Individual Rights Under the DPF

In compliance with the EU-U.S. DPF, ViaPlus commits to resolve DPF Principles-related complaints about our collection and use of your personal information.  EU individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF should first contact ViaPlus at dpo@viaplus.com.

Individuals whose personal data is processed under the DPF have the right to:

–              access personal data about them;

–              correct, amend, or delete personal data where it is inaccurate or has been processed in violation of DPF Principles; and

–              limit or object to processing where permitted by the DPF Principles.

Requests may be submitted to dpo@viaplus.com

ViaPlus provides individuals with an opportunity to opt out when personal data covered by this Addendum would be disclosed to a non-agent third party or used for a purpose materially different from the purpose for which it was originally collected or subsequently authorized. ViaPlus will obtain affirmative express consent before disclosing sensitive personal data to a non-agent third party or using sensitive personal data for a materially different purpose where required by the DPF Principles. Individuals may exercise these choices by contacting dpo@viaplus.com. ViaPlus will respond to DPF-related inquiries or complaints within 45 days of receipt.

Where ViaPlus processes personal data solely on behalf of and under the instructions of a client or other controller, ViaPlus will assist that controller in responding to requests or will direct the individual to the appropriate controller, as applicable.

A.7         Independent Dispute Resolution

In compliance with the DPF Principles, ViaPlus commits to resolve complaints about its collection or use of personal data.

For complaints involving non-human-resources personal data that cannot be resolved directly with ViaPlus, individuals may submit the complaint, free of charge, to ViaPlus’s designated independent recourse mechanism: JAMS International Privacy Dispute Resolution. JAMS is based in the United States and is available to individuals free of charge.

Complaints concerning human resources personal data received from the European Union in the context of an employment relationship are subject to the cooperation mechanism described in Section A.11.2.

A.8         Binding Arbitration

Under certain conditions and as a last resort, individuals may invoke binding arbitration pursuant to Annex I of the DPF Principles, provided that they have first exhausted other available dispute resolution mechanisms.

A.9         Regulatory Oversight

The Federal Trade Commission has jurisdiction over ViaPlus’ compliance with the EU-U.S. DPF.

 A.10      Disclosure to Public Authorities

ViaPlus may be required to disclose personal data covered by this DPF Addendum in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

A.11       Human Resource Data

A.11.1   General

ViaPlus processes certain human resources personal data transferred from the European Union to the United States in reliance on the EU‑U.S. Data Privacy Framework for employment‑related purposes. This includes personal data of job applicants, employees, former employees, contractors, and other personnel, such as identification data, contact information, employment history, payroll and benefits information, performance and disciplinary records, compliance and training records, and other data necessary for human resources administration.

ViaPlus processes HR personal data solely for legitimate employment‑related purposes, including recruiting, hiring, onboarding, workforce administration, compensation and benefits administration, performance management, legal and regulatory compliance, security, and internal business operations, and consistent with the disclosures provided to individuals in applicable employee privacy notices.

A.11.2   Cooperation with EU Data Protection Authorities for HR Data

With respect to human resources personal data received from the European Union in reliance on the EU‑U.S. Data Privacy Framework, ViaPlus commits to cooperate with and comply with the advice of the competent European Union data protection authorities (“EU DPAs”) regarding the processing of such data in the context of the employment relationship.

A.12 Ensuring Commitments

If ViaPlus leaves the relevant part(s) of the DPF program, it will annually affirm to the U.S. Department of Commerce’s ITA its commitment to apply the DPF Principles to information received under the relevant part(s) of the DPF program if it chooses to keep such data; otherwise, ViaPlus must provide “adequate” protection for the information by another authorized means.