Privacy policy

The company Keolis S.A. (“Keolis S.A.”, “We”, “our”, “us”) makes every effort to protect your personal data, in compliance with applicable European and French legislation. This privacy policy (the “Privacy Policy”) aims to inform you as to the purposes and conditions in which we process personal data that we may collect through our various channels, and in particular: the Keolis S.A. website [], our social media accounts or any event that we may organise. Our Cookie Policy, which can be consulted at, comes in addition to this Privacy Policy and provides information on the purposes and conditions of use of cookies or web browsing data that Keolis may deploy. We invite you to take a moment to read this Privacy Policy so as to have all the information you need to understand how your personal data is used and so as to allow you to freely and fully exercise the rights granted to you by law and by this Privacy Policy.

1. General provisions

The entity responsible for processing your personal data is the company Keolis S.A. 

Terms & Conditions of Use  
The Privacy Policy is an integral part of the Terms and Conditions of Use of our website and should be read in conjunction with them (these can be consulted by following this link:

Applicable law and competent administrative authority
The Privacy Policy is governed by the General Data Protection Regulation n°2016/679 (“GDPR”) and by the French Data Protection Act no.78-17 of 6 January 1978 subsequently amended, under the regulatory supervision of the French data protection authority CNIL (Commission Nationale de l’Informatique et des Libertés –

Links to third-party site

Our website may contain or use links to websites, mobile apps, products or services operated by third parties (in particular sites of advertisers, partners of Keolis S.A. or social media sites). We remind you that the Privacy Policy does not apply to these third parties over which Keolis S.A. has no control and for which we cannot be held liable.

We recommend that you consult the privacy policies, procedures and practices of these third parties.

2. The personal data that we collect

The Privacy Policy applies to the personal data that we may collect from you or about you (see below) from the following sources:

  • Your browsing history on the Keolis S.A. website (in particular when using a functionality, completing a registration form or survey, consulting resources available on the website);
  • The exchange of e-mails, text messages or any other electronic messages between Keolis S.A. and you.

3. Use of your personal data

We collect and use your personal data for the main purposes described below:

  • To understand your needs and expectations, in particular to improve the way you use our website and its functionalities;
  • To answer your questions and deal with your requests;
  • To comply with the law, regulations and legal requirements and instructions.


4. Data transmission

Keolis S.A may disclose your personal data:

Within the Keolis Group
If you have given your consent, we may share your personal data with certain entities with the Keolis Group, or partners; in order to maintain continuity of our services or of our relations with our customers, sales prospects or website users;

With third-party providers
We may transfer your personal data to trusted third parties located within the European Union, notably in order to keep our website working correctly;

With business partners
We may share certain pseudonymous data which do not contain any items of direct identification, for the purposes described in Article 3 “Use of your personal data” above;

With third parties on legal grounds
If we were to be compelled to observe laws and regulations and legal requirements and instructions, or if permitted by law (i.e. to protect and uphold rights, a situation posing a threat to life, health or safety, etc.).

In all events, we always require that these recipients provide sufficient privacy and security guarantees and that they take the necessary physical, organisational and technical measures to protect and safeguard your personal data in accordance with current legislation.

5. Data security

Keolis S.A. safeguards your personal data by implementing the adequate physical, organisational and technical measures to prevent any unauthorised access, use, disclosure, modification or destruction, in accordance with current legislation.

These measures specifically include:  

  • Storing data on secure servers in the European Union;
  • Safeguarding your data in particular through pseudonymisation processes, the encryption of data transmitted and the implementation of means to guarantee the confidentiality, integrity and availability of your data;
  • Limiting access to your data on a “need to know” basis.

While Keolis S.A. takes every possible measure to protect your personal data, we cannot guarantee the security of the information transmitted to our website when your terminal or browser is affected by a security breach.

6. Your rights with regard to your personal data

Pursuant to the GDPR and the French Data Protection Act, you are entitled to several rights, including:

Access, modification, updating and deletion of your personal data
You may ask to be granted access to your personal data which are held and processed by Keolis S.A.; you may consult them, obtain a printed or electronic copy of them and ask for them to be corrected, updated or deleted.

You may at any time ask that some of your data be no longer processed.

You may request to have your processed data sent to you in an open and machine-readable format, whether it be for your personal use or to transfer them to another controller.

Restriction of processing
In certain cases, you may request that the processing of your personal data be restricted.

Claims to a Supervisory Authority
Without prejudice to any other legal remedy, you are entitled to lodge a complaint with the supervisory authority of the European Union country in which you reside, work or in which you deem that your rights might have been infringed upon.


You may exercise all of these rights by sending a written request together with a copy of proof of identity to the contacts set out in Article 9 “How to contact us”. We will try to deal with your request at our earliest opportunity and in accordance with the conditions provided for by the applicable legislation. Notwithstanding, it may occur that due to our binding legal or contractual obligations, we are unable to grant your request.

7. Storage period for collected data

We keep your personal data for only as long as is needed to fulfil the different purposes set out in Article 3 “Use of your personal data”, except when we are allowed or required by law to keep them for longer.
The table below gives a summary of the maximum storage periods applicable to or required of Keolis S.A. depending on the purposes for which your personal data may be processed. These maximum durations apply unless you ask for your data to be erased or no longer used before their expiry on grounds consistent with any legal obligation which Keolis S.A. may be required to observe.



Response to your requests

Time required to deal with your request

Measurement of audience, personalisation of website and cookie management

13 months following the deposit of the cookie

identifiers

1 year following each new session

Management of data access and rectification requests

1 year following receipt of request

Management of objections to data processing

3 years following the date at which the right to object is acted upon

8. Changes to the Privacy Policy

Keolis S.A. reserves the right to make changes to the Privacy Policy.
We invite you to regularly consult this page to learn of any changes and stay up to date on the measures we take to protect your personal data.

9. How to contact us

To exercise your rights or for any queries relating to the Privacy Policy, please contact our Data Protection officer at or by post at:

Keolis SA

Data Protection Officer

20 rue le Peletier,

75009 Paris, France.


This Privacy Policy was last updated on 23/08/2018