Privacy Policy of the Automobile Club of Luxembourg (ACL)

Courtesy translation – for information purposes only. This English version is a non-binding translation of the French original and is provided solely for convenience and information purposes. Only the French version is authoritative and legally binding. In the event of any discrepancy, inconsistency or difference in interpretation between this translation and the French version, the French version shall prevail.

1. Identity of the data controller

This privacy policy is provided to you by the Automobile Club du Luxembourg (ACL), a non-profit association registered with the Luxembourg Trade and Companies Register (R.C.S. Luxembourg) under number F630, in its capacity as controller of the personal data collected. The ACL’s registered office is located at 54, route de Longwy, L-8080 Bertrange, Luxembourg.

Data Protection Officer (DPO): The ACL has appointed an external data protection officer, the company Luxgap Sàrl (2, Rue de l’École, L-8376 Kahler Garnich, Luxembourg), who can be contacted at dpo@acl.lu.

The DPO is responsible for monitoring compliance with the applicable personal data regulations and acts as the point of contact for any question relating to the data processing carried out by the ACL.

2. Personal data collected (online and offline)

The ACL takes care to collect only the personal data that is strictly necessary for the purposes described below. This data may be collected online (when you use our acl.lu website, the ACL mobile application, forms or e-mails) or offline (when joining or making requests at a branch, by telephone via our Contact Center, during events or on-site services, etc.). The categories of data collected include in particular:

• Identification data: surname, first name, date of birth, gender, nationality, ACL membership number where applicable.
• Contact data: postal address, e-mail address, telephone number (landline and/or mobile).
• Member account data: login credentials (for example membership number or e-mail), preferences and profile settings in the MyACL member area.
• Vehicle information: for motorist, cyclist or motorcyclist members, the ACL may record data such as the make, model, registration number, chassis number (VIN) or other technical characteristics of the vehicle. This information may be necessary to provide you with certain services (e.g. roadside assistance, technical diagnostics, insurance or vehicle-related benefits).
• Location data: as part of the 24/7 roadside assistance service, we may collect your exact geographical position (e.g. GPS location transmitted by the eCall mobile application or coordinates provided by telephone) in order to dispatch assistance to your location.
• Billing and financial data: information required for the payment of membership fees and services (e.g. history of memberships and renewals, invoices, chosen payment method, bank details such as IBAN or bank card information). Note: The ACL does not retain your payment card data beyond the transaction, as such data may be processed directly by secure payment providers.
• Content of requests and communications: when you fill in an online form (request for a customised itinerary, event registration, contact, newsletter subscription, etc.) or contact the ACL (by e-mail, post or via the telephone Contact Center), we collect the information you provide on that occasion. For example, this may include the desired destinations and travel constraints provided for mobility/travel advice, the nature of the breakdown reported during a roadside assistance call, your questions submitted to the advisory service, or the details of a complaint. This information may be recorded in our systems in order to follow up on your request. Please note: telephone calls to our contact center may be recorded for quality and training purposes, or to keep evidence of the instructions given (which is useful for responding to subsequent requests or clarifying any ambiguities).
• Data relating to sports and leisure services: if you take part in ACL Sport activities (competitions, races, rallies, etc.), karting sessions or Maison du Motard training courses, we may process information such as your sports licence number, your age category, your competition results, your karting lap times, or any other data necessary for the organisation and follow-up of these events (e.g. medical certificate of no contraindication to sports practice, where required).
• Data relating to travel and insurance: as part of our mobility/travel advisory services or when booking trips through the ACL, you may be asked to provide additional information such as the surnames and first names of travellers, dates of birth, travel preferences, special needs (accommodation, mobility), or even copies of identity documents (passport) depending on the requirements of third-party providers (travel agencies, airlines, hotels, etc.). Likewise, if you take out insurance through the ACL, the data necessary for the management of these contracts and of any claims will be collected.
• Health data (special category data): exceptionally, the ACL may have to process certain sensitive data concerning you, only if you provide it yourself and if this is essential to the provision of a service. This may be the case, for example, if, in connection with a request for assistance abroad or for reimbursement of medical expenses, you send us medical certificates or health-related supporting documents that we may need to forward to an insurance company in order to enable your compensation. Likewise, participation in certain events (sports competitions, organised trips, etc.) may require limited medical information (e.g. allergies, particular conditions) in order to ensure your safety. This health data is collected and used only with your explicit consent and only for the specific purpose for which you provided it.
• Browsing data and cookies: when you visit our website and use the mobile application, we may collect data relating to your device and your browsing. This includes, for example, the IP address of the device, the unique device identifier, the type and version of the browser, the language, the pages viewed, the date and time of connection, as well as information collected by cookies and trackers (see the Cookie Policy below). This browsing data is generally used for anonymous statistical purposes or to improve your online experience.

Accuracy of data: You undertake to provide accurate, complete and up-to-date information and to update it in the event of any change. The ACL may, at reasonable intervals, invite you to verify and update your data (e.g. confirmation of your contact details or of your registered vehicle fleet).

Data of minors: The ACL’s services are primarily aimed at adults. However, certain services may concern minors (e.g. YoungACL membership for young drivers, cycling courses for children, karting sessions for accompanied minors, etc.).

Sensitive data: With the exception of the limited cases mentioned above (health data provided for assistance or sport), the ACL does not wish to collect special categories of personal data concerning you (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data or data concerning sex life or sexual orientation). You are therefore asked not to provide such information unless strictly necessary. If, however, you spontaneously provide sensitive data (e.g. by attaching a document containing this type of information), we will consider – unless you indicate otherwise – that you consent to this information being processed in accordance with your specific request. This data will be given enhanced protection and deleted as soon as possible after the purpose concerned has been fulfilled.

3. Purposes of processing and legal bases

The ACL processes your personal data only for specified, explicit and legitimate purposes and will not use it in a manner incompatible with those initial purposes. For each processing operation, the ACL ensures that it has a valid legal basis within the meaning of the General Data Protection Regulation (GDPR). The main purposes and applicable legal bases are as follows:

• Provision of the requested services (performance of a contract) – The main reason we process your data is to provide you with the services you request as part of your membership or your one-off requests. This includes the management of your membership (registration, renewal, benefits), the delivery of assistance and mobility services (e.g. roadside breakdown assistance, repatriation, technical diagnostics, vehicle rental via ACL Location, provision of rental bicycles or motorcycles, etc.), the organisation of trips or customised itineraries, the sending of the member magazine and other benefits linked to member status, mobility/travel advice, or participation in events, leisure and sports activities (ACL Sport competitions, Maison du Motard training, karting, etc.). Your data is then necessary to perform the contract concluded with you or to take pre-contractual steps at your request. For example, when you call for roadside assistance, the processing of your location data and vehicle identification is essential for us to fulfil our assistance obligation under your membership contract. Likewise, your payment data is used to invoice the membership fee or the paid services you have ordered. Without this information, we would not be able to register you, assist you, invoice you correctly or provide the expected service.
• Administrative and accounting management and compliance with legal obligations – Certain processing is carried out because the law requires us to. For instance, we retain billing data (e.g. invoices, payment details, accounting records) for the legally applicable periods in order to meet our tax and accounting obligations. Issuing invoices and keeping accounts involves processing your identity and billing data on the basis of our legal obligation (e.g. Article 16 of the Luxembourg Commercial Code, which requires records to be kept for 10 years from the end of the financial year). Likewise, the ACL may process or disclose certain data in order to comply with other legal or regulatory obligations: responding to a request from police or judicial authorities, managing safety recalls or mandatory campaigns concerning your vehicle, complying with insurance law (e.g. transmission of relevant data to the insurer in connection with legal assistance or the travel insurance provided), or meeting the requirements of the motorsport federation regarding licences and official rankings. In all these cases, the legal basis for the processing is compliance with a legal obligation to which the ACL is subject (Article 6(1)(c) GDPR).
• Communication to members and information about ACL services (legitimate interest or performance of the contract) – The ACL, as a mobility club, is keen to keep its members informed of the services, events and benefits that may interest them. As part of your membership, you will therefore receive communications relating to the life of the Club and your benefits (e.g. invitations to the general meeting, new services offered to members, changes to conditions, the “ACL Infos” newsletter on mobility news, the Autotouring magazine, etc.). These mailings may be considered an integral part of your membership contract (information and support for the member) or be justified by the ACL’s legitimate interest in promoting the mobility and safety of its members. The ACL ensures that these communications remain proportionate and in line with your expectations as a member. You may also object to them at any time if you consider these communications unwanted (see the “Rights of data subjects” section).
• Loyalty and management of commercial gestures (legitimate interest) – In order to maintain and improve the relationship with its members and customers, the ACL may grant commercial gestures (loyalty discounts, benefits, compensation gestures following a complaint, etc.). The processing of the associated data aims to retain the member and strengthen the quality of the customer relationship. This processing is based on the ACL’s legitimate interest (Article 6(1)(f) GDPR) in maintaining a lasting relationship with its members. You may then object to it on grounds relating to your particular situation.
• Prospecting and promotion towards non-members (consent or legitimate interest) – The ACL may also contact people who are not yet members (e.g. prospects who have requested a brochure, website users who have consented to receive the newsletter, non-member participants in a public event, etc.) in order to present its services, events or promotional offers. In accordance with the regulations, such commercial prospecting by e-mail or SMS is carried out only with your prior consent (for example, by ticking a box to subscribe to ACL communications on a form) or, in certain limited cases, on the basis of the ACL’s legitimate interest in making its mobility- and tourism-related services known. The latter case applies only if you have already shown an interest in our services (e.g. information request, participation in a mobility action) and the subject of the communication is directly related to them. In all cases, each prospecting message includes a simple unsubscribe link allowing you to withdraw your consent or to object to receiving further solicitations.
• Improvement of services and statistics (legitimate interest) – The ACL constantly seeks to improve its services and to better understand the needs of its members and customers. To do so, we may analyse certain data: number of assistance calls and response times, rate of use of benefits, satisfaction survey results, website traffic, etc. These analyses are carried out using aggregated or anonymised data as far as possible, without seeking to profile members individually. For example, the ACL produces overall statistics based on all the services provided in order to adapt its offers to members’ requests. Likewise, we may record telephone calls to the assistance centre and keep these recordings temporarily to assess the quality of our service and train our staff. The legal basis for this processing is the ACL’s legitimate interest in ensuring a high level of service quality, innovating and remaining competitive, as long as your rights and freedoms do not override this interest. If you have questions or objections regarding these analyses, you may of course object to them (see “Rights of data subjects”).
• Safety of persons and property, fraud prevention (legitimate interest) – Your data may be processed in order to guarantee the security of the ACL’s services and facilities, and to prevent possible abuse. For example, when accessing the karting tracks or the workshops of the Maison du Motard, you may be asked to show your membership card or an identity document in order to verify your right of access. The ACL may also put in place fraud control and prevention measures (e.g. to avoid misuse of assistance services or identity theft). Some of these activities may involve data processing (access logging, video surveillance of ACL premises with on-site signage, etc.) based on our legitimate interest in protecting our members, our staff and our resources.
• Visitor management and security of premises (legitimate interest) – When accessing its premises, the ACL may keep a visitor register and collect for that purpose several items of your personal data, collected directly via a QR code to be scanned upon arrival at the reception. The purpose of this management is to ensure the safety of persons and property within the premises and to be able to identify the persons present in the event of an incident during your visit to our premises (evacuation, accident, disaster). The processing is based on the ACL’s legitimate interest (legal basis of Article 6(1)(f) GDPR) in protecting its premises, its staff and its visitors. The data collected is deleted on the evening of the visit.
• myACL online member area (performance of the contract, consent and legitimate interest) – The ACL provides you with the myACL platform (iOS/Android mobile application and website), which allows you to view and update your personal data, manage your communication preferences (e-mails, receipt of the magazine), pay your membership fee online if you do not have a direct debit mandate, request the disassociation of an attached member whose fee you were paying, and trigger a guided assistance request by sending the assistance centre the first information relating to your need. Connection to myACL is made using a LuxID account, which you create independently of the ACL and which verifies your e-mail address and telephone number. Use of myACL is optional: you benefit from the ACL’s services whether or not you use the application. This processing is based on the performance of your membership contract (Article 6(1)(b) GDPR). The registration of your payment method for future payments and the sending of e-mail communications according to your preferences are based on your consent, which you may withdraw at any time. Finally, where the data communicated by LuxID differs from that recorded in our systems, a reconciliation screen allows you to choose which information to keep; this verification is based on the ACL’s legitimate interest (Article 6(1)(f) GDPR) in guaranteeing the accuracy of your data and the security of access to your member area.
• Service providers involved in myACL – Within myACL, your data is processed by a limited number of parties: LuxID, identity provider, for authentication; Mollie B.V., payment service provider, for the online payment of the membership fee (the ACL neither receives nor retains your full card or IBAN data, which is kept by Mollie in the form of a secure token); and Odoo S.A., publisher and host of the management system in which member data and invoices are held, which acts as a processor of the ACL within the meaning of Article 28 GDPR. LuxID and Mollie act as independent controllers for their respective services and inform you of their own processing in their privacy policies. Only strictly necessary data is transmitted to them (e.g. amount, currency and invoice reference for Mollie).
• Other legal bases and specific purposes – In specific cases, the ACL may process your data on the basis of your explicit consent (e.g. processing of health data for emergency medical assistance, use of certain analytical or advertising cookies – see the cookie policy, publication of testimonials with your agreement). Consent, where required, is collected clearly and may be withdrawn at any time (without retroactive effect). Finally, we may process data to safeguard your vital interests or those of another person (legal basis of Article 6(d) GDPR), but only in an emergency situation threatening life or safety (e.g. providing first responders with vital medical information if you are unconscious following an accident).

In any event, the ACL undertakes not to further process your data in a manner incompatible with the purposes for which it was originally collected or which you have accepted. If we wished to use your data for a new purpose not provided for in this policy, we would inform you beforehand and obtain your consent where necessary.

4. Data retention period

Your personal data is retained by the ACL for a period not exceeding that necessary for the purposes for which it is processed, subject to legal retention obligations. In general:

• Member management data: Information relating to your membership (identity and contact data, membership history and use of services) is retained for the entire period during which you are an active member. Upon termination of your membership (unsubscription, non-renewal), we archive your data for the time necessary to complete all termination formalities and the settlement of ongoing services. Beyond that, this data may be retained in an intermediate database for 10 years after the end of the membership, in order to preserve the ACL’s legitimate interests (e.g. keeping a record of the services rendered, facilitating possible re-joining) and for any claims or disputes (contractual limitation period). After this period, the data is either deleted or genuinely anonymised.
• Billing, accounting and insurance data: All documentary data relating to financial transactions (membership invoices, invoices for services such as car rental, assistance reimbursement documents, receipts, etc.) is retained for 10 years from the close of the financial year concerned, in accordance with Luxembourg legal requirements in commercial and tax matters. Likewise, if an insurance claim has been handled, we retain the files and supporting documents for the corresponding legal period (often aligned with 10 years, or longer if a dispute is ongoing).
• Contact Center data (calls, requests): Telephone call recordings, where they exist, are retained for a limited period (generally 6 months), unless a particular incident justifies longer retention (e.g. if a call concerns a dispute or an accident under investigation). Tickets and requests sent via our forms or by e-mail are retained for the time necessary to process them, and then deleted.
• myACL account data: The data of your myACL account (LuxID identifier, profile data and preferences) is retained for the duration of your membership and of your use of your account, then, after closure of the account or the end of the membership, according to the periods applicable to member management data described above (intermediate database of 10 years at most, then deletion or anonymisation). Connection logs and technical logs are retained for twelve months for security and incident-handling purposes. The payment token recorded at your request is retained until you withdraw your consent or until the end of your membership, the accounting records relating to your payments being retained for 10 years in accordance with the paragraph above. Disassociation requests and information transmitted to the assistance centre via guided assistance are retained for three years from the request. Deleting your myACL account has no effect on your membership.
• Data relating to assistance and mobility services: Roadside assistance reports (breakdown assistance, towing, etc.) and associated data (breakdown location, vehicle assisted, etc.) are retained for an average of 10 years after the closure of the assistance file. This allows us to analyse the quality of our interventions and to have a history in the event of subsequent disputes. Vehicle technical diagnostic reports are retained for as long as necessary to provide you with the follow-up service (e.g. comparison of history during a subsequent diagnostic) and according to technical recommendations (generally a few years), unless you request otherwise.
• Data relating to sports activities and events: Information about your participation in ACL Sport competitions (results, rankings, penalties) or in events/leisure activities (registrations for tourist rallies, workshops, etc.) may be kept for historical archives for as long as sporting or statistical relevance justifies it. For example, competition rolls of honour may be published and remain accessible on the website or in our archives beyond the year of the competition, in the legitimate interest of preserving the club’s sporting memory. If you wish your name to be erased from a published result, you may make a request, which will be assessed on a case-by-case basis (taking into account the public interest in the sporting roll of honour).
• Prospecting and newsletter data: If you are not a member and have entrusted us with your contact details to receive newsletters or offers, we will retain this data until you unsubscribe or for a period of 3 years after your last contact with us. If during this period you show no further interest (no interaction, no response to solicitations), your data will be deleted or archived in anonymised form. For members, contact data is retained for as long as the membership lasts for the sending of communications relating to the club’s services, unless you object.
• Application data: In the event of an application for a position within the ACL (via our website or otherwise), your data (CV, cover letter, etc.) is retained for the duration of the recruitment process. If the application is unsuccessful, unless you consent to our keeping it for longer, we will destroy your data no later than 6 months after the end of the recruitment. In the event of hiring, your data becomes part of your personnel file and is retained in accordance with the rules applicable to HR (outside the scope of this policy).

At the end of the periods mentioned above, personal data is either deleted from our systems or irreversibly anonymised so that it can be used for purely statistical purposes. In certain cases, specific legal obligations may require us to retain data for longer periods than those indicated (e.g. retention of a document linked to a dispute until the end of the court proceedings, which may exceed the ordinary limitation period). In any event, the ACL undertakes to limit the retention period of your data and to carry out regular deletions or anonymisations in accordance with the regulations.

5. Recipients of the data (sharing and disclosure)

Within the ACL: Access to your personal data is strictly limited to the ACL’s staff and departments who need to know it for their duties. For example, the accounting/billing departments, the roadside assistance service, ACL Sport, communication/marketing, travel advice or the IT department may receive some of your data, each for their own purposes. The ACL ensures that these persons are bound by a duty of confidentiality and trained in data protection. Internal access to your information is compartmentalised according to authorisation rules so that each employee sees only the data necessary for their function.

Within the ACL group and affiliated entities: The ACL works with trusted subsidiaries and partners to offer certain services. For example, ACL Services S.A. is a related entity that may be involved in the management of the professional Call Center or other “business” services. Likewise, the ACL may call on sister companies or partners for organised trips, events (e.g. co-organisation of a rally with another automobile club), or for the provision of certain negotiated member benefits. In such cases, data may be shared between the ACL and the affiliated entity concerned, always in compliance with the intended purpose and with confidentiality. Where these entities act as processors on behalf of the ACL, a contract compliant with Article 28 GDPR is in place to govern the processing. Where they act as joint controllers (e.g. joint organisation of an event), you will be informed and each party’s responsibilities will be determined transparently.

External service providers (processors): The ACL uses several external service providers to assist it in providing its services. These processors, acting on our instructions, may have access to some of your personal data to the extent necessary for their mission. They include in particular:

• IT and hosting providers: for example, the host of the website and of our databases, the publisher of our member management software, IT maintenance providers, or the cloud solutions we use. They may process your data (storage, backup, etc.) solely for the purpose of ensuring the proper functioning and security of our systems.
• Secure payment provider: for online payments (membership, ACL Location booking, etc.), your bank details may be processed directly by a certified payment provider (e.g. a PayPal- or Stripe-type service or another bank) acting as a recipient of your transaction data. This provider guarantees the security of transactions and communicates to the ACL only non-sensitive information (confirmation of payment, provided or not).
• Printers and mailing houses: for the postal dispatch of the member magazine (Autotouring) or of letters to members, the ACL may use a printing or postal routing provider. The latter receives only the necessary data (e.g. the list of recipients’ names and addresses) and must process it confidentially and delete it after dispatch.
• Marketing and communication providers: these may be companies that handle for us the sending of electronic newsletters, satisfaction surveys or promotional campaigns. For example, if the ACL uses an external e-mailing platform to distribute its newsletter, your e-mail address and possibly your name are uploaded to this secure platform. These providers are not permitted to use your data for other purposes.
• Audience analysis providers and online tools: as detailed in the Cookies section, we use tools such as Google Analytics or Hotjar to understand how the site is used, as well as Intercom to offer an online chat function. These services may involve the transmission of certain data (mainly technical or pseudonymous) to these providers. For example, Google Analytics collects information via cookies and generates statistical reports on site traffic for the ACL; Hotjar analyses browsing behaviour anonymously (mouse movements, clicks) to improve ergonomics; Intercom processes the data you enter in the chat and technical information to enable live messaging. These companies act as processors or as separate controllers depending on the case, and their own privacy policies apply in addition (see Cookie Policy). The ACL contractually ensures that these providers guarantee a level of data protection compliant with the GDPR, in particular where transfers outside the EU are involved (see the section on transfers).
• Other specialised processors: these may include, for example, an events agency helping to organise a member event, a provider handling the Contact Center service outside office hours, a debt collection company in the event of non-payment, or any external expert linked to a particular service (for example an independent instructor leading a cycling course – in which case they could have access to the list of registrants). In all cases, these recipients use your data only for the service entrusted to them and may under no circumstances use it on their own behalf.

Partners and third parties linked to the services requested: Depending on the services you use, the ACL may also share certain data with third-party partners who then act as independent controllers (or joint controllers), because they directly provide you with part of the service. This includes:

• Roadside assistance partners: the ACL is a member of the European network ARC Europe and works with many other automobile clubs and local tow operators around the world. Thus, if you break down abroad, your relevant data (identity, membership number, location, vehicle, nature of the breakdown) will be transmitted to the partner club or local provider to carry out the assistance on site, including outside the EU if necessary (see international transfers). Likewise, in Luxembourg, the ACL calls on approved tow operators: they receive the information necessary to locate and assist you (vehicle, breakdown, contact details). All these parties are bound by a contract with the ACL that includes confidentiality clauses.
• Garages, dealers and technical specialists: following a breakdown assistance or a diagnostic, you may be offered to take your vehicle to a partner garage. With your agreement, the ACL may transmit to this garage the basic information about the case (fault detected, type of vehicle, etc.) to prepare for handling it. As part of the Diagnostic Center, if more extensive repairs are necessary, a technical report on your vehicle may be given to a third-party repairer of your choice.
• Insurance companies and brokers: several ACL services include an insurance dimension (e.g. repatriation or medical expenses insurance when travelling, cancellation insurance on an organised trip, private civil liability insurance offered to members in certain cases, or driver legal protection). When you call on these guarantees, the ACL must provide the insurers concerned with the information required to open and manage the claim file. For example, in the case of a request for reimbursement of medical expenses abroad advanced by the ACL, the supporting documents (invoices, medical certificates, etc.) will be sent to the insurance company covering this risk so that the ACL can be reimbursed. These recipients then process your data under their own responsibility (as insurers) and inform you of their conditions where applicable.
• Travel organisers, hotels, carriers: if you book a trip, accommodation or a ticket via our mobility/travel advice services, we often act as an intermediary with other providers (tour operators, partner travel agencies, airlines or rail companies, hotels, etc.). Your necessary data (names of travellers, passport details where applicable, preferences) is then transmitted to these third-party providers to carry out the booking on your behalf. They will receive only the essential data and are themselves bound by professional secrecy (in particular licensed travel agencies) and by the GDPR where they are subject to it.
• Sports authorities and federations: as part of ACL Sport, if you take part in official competitions, the ACL may have to communicate certain data concerning you to the competent national or international sports bodies (e.g. licence registration with the FIA federation via the ACL, transmission of race results for national rankings, etc.). These bodies will then process your data in accordance with their own regulations (you will be informed when taking out a sports licence).
• Commercial partners offering member benefits: the ACL negotiates discounts and benefits for its members with partners (hotels, shops, leisure parks, etc.). In general, these benefits are granted by presenting the membership card directly to the partner, without any exchange of personal data from the ACL. However, if a benefit requires verification with us (e.g. a partner campaign requiring confirmation that a promo code corresponds to an active ACL member), we may confirm limited information to the partner (e.g. validity of the membership, without any other personal details). This is done only if necessary and with security measures (often via an automated system rather than a manual exchange of personal data). In addition, via forms, and with your consent, certain data such as your ACL membership number, surname, first name, mobile number, e-mail address and country of residence may be communicated to our partners so that you can benefit from advantages. The list of commercial partners is available on the ACL website under the section “https://www.acl.lu/club/fr/” and is updated regularly.

Outside these cases, the ACL never sells or rents your personal data to third parties for marketing or other purposes. Any transmission not listed here would be carried out only with your explicit consent or pursuant to a legal/administrative obligation. For example, the ACL could be compelled to disclose certain information to the police or a judicial authority upon legal requisition (e.g. in connection with an investigation following a serious accident). In such a case, we would ensure that we provide only the data specifically requested by the authority, in accordance with the law.

Finally, the ACL may communicate data to its external advisers (lawyers, accountants, auditors) where necessary for the defence of its rights (e.g. management of a dispute with a member or a supplier) or for audit obligations. These recipients are also bound by professional confidentiality.

6. Transfers of data outside the European Union

In general, the ACL favours the storage and processing of your personal data within the European Union, where the GDPR applies. However, certain processing operations may involve a transfer of data to countries outside the European Economic Area (EEA), in particular in the following situations:

• Assistance abroad: If you request help outside the EU (e.g. breakdown during a trip to Russia, the United States or elsewhere in the world), the ACL will have to transmit your relevant data to the local provider or partner automobile club providing assistance, even if it is established in a country not covered by a European Commission adequacy decision. This transfer is necessary for the performance of the assistance contract you have with us (Article 49(1)(b) GDPR) and will be limited to essential information (identity, location, problem encountered). Likewise, in the event of a medical emergency abroad, we may communicate vital data to local emergency services (Article 49(1)(f) – protection of vital interests).
• Travel bookings outside the EU: When the ACL helps you book tourist services in third countries (hotel, transport, excursion outside the EU), your required data (civil status, contact details, passport number if requested, etc.) will be transmitted to the providers or authorities of these countries, in accordance with your request. For example, if you book a hotel in Switzerland or the United States through our services, we will have to transmit your name and booking details to that hotel (this transfer is necessary for the performance of your booking). These providers are required to use this information only to provide the requested service.
• IT tools and services: Some of our IT processors or online tools may store or access data outside the EU. This is the case of Google or Hotjar (which may transfer data to the United States), Intercom (whose servers may be outside the EU), or other cloud service providers (e.g. Microsoft/Azure, Amazon AWS) that may have global infrastructures. The ACL ensures that, in these cases, appropriate safeguards are in place: either the destination country benefits from a European Commission adequacy decision, guaranteeing an equivalent level of protection (e.g. Switzerland, Canada, or the new EU-US Data Privacy Framework if applicable), or we have concluded with the recipient the Standard Contractual Clauses adopted by the European Commission, supplemented by additional measures if necessary. These contractual mechanisms oblige the recipient to protect your data according to European standards. In addition, where possible, we ask for your informed consent to such transfers. For example, by accepting analytical or interaction (chat) cookies on our site, you consent to certain associated data being processed by our providers located in third countries, such as the United States, despite possible risks to your data (government access, etc.). You can of course refuse these cookies if you prefer to avoid these transfers (see the Cookie Policy below).

In any event, data transfers outside the EU remain limited to the needs of the services you use or to the obligations mentioned. The ACL documents and governs each transfer in accordance with Chapter V of the GDPR. If you would like to know more about the transfers of your data to a given country (in particular to obtain a copy of the safeguards implemented, such as standard contractual clauses), you may contact our DPO (see section 1).

7. Your rights as a data subject

In accordance with data protection regulations, you have rights relating to the personal data we process about you. These rights may be exercised, within the limits provided by law, under the conditions described below:

• Right of access: You have the right to obtain confirmation that we hold personal data concerning you, and to receive a copy of it together with information about the processing (purposes, categories of data, recipients, retention periods, etc.). Upon simple request from you, the ACL will also provide you with a copy of the data being processed, in an intelligible form, unless otherwise required (e.g. so as not to affect the rights of others).
• Right to rectification: You may request the correction or updating of inaccurate or incomplete data concerning you. The ACL will correct any erroneous information as soon as possible once your identity has been verified (e.g. correction of your name, address, contact details or update of your vehicle model). In addition, in your online customer area, you can directly modify and update some of your basic personal data.
• Right to erasure (right to be forgotten): In certain cases, you may obtain the deletion of your personal data, for example if it is no longer necessary for the purposes for which it was collected, if you withdraw your consent (for processing based solely on consent), or if you object to processing and there is no overriding legitimate ground for keeping it. This right is, however, not absolute – the ACL may have to retain certain data despite your request, in particular to comply with a legal obligation (e.g. not erasing an invoice before the end of the tax period), or for the establishment, exercise or defence of legal claims. In that case, we will inform you of the reasons for this partial or total refusal.
• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to processing of your data based on the ACL’s legitimate interest. If you exercise this right, we will cease the processing concerned, unless we demonstrate that there are compelling legitimate grounds to continue (e.g. overriding legitimate interest or need for the defence of legal claims). Important: you may object without giving any reason to the processing of your data for commercial prospecting or direct marketing purposes. In other words, whether you are a member or not, if you no longer wish to receive our newsletters, magazines or commercial invitations, you simply need to let us know and we will stop all mailings (an unsubscribe link is included in each newsletter e-mail to make this easier). The ACL will respect your choice as soon as possible.
• Right to restriction of processing: This right allows you to request the temporary suspension of processing in certain situations, for example while the accuracy of data that you contest is verified, or in the case of unlawful use of your data where you do not wish erasure (just a freeze). Where restriction is granted, we may retain the data but no longer process it (other than storing it) without your consent, with the exception of certain legitimate processing (defence of rights, etc.). If the restriction is subsequently lifted, you will be informed beforehand.
• Right to data portability: For data that you have provided to us directly and that is processed by automated means on the basis of your consent or a contract, you may request to receive it in a structured, commonly used and machine-readable format, in order to be able to transmit it to another controller. Where technically feasible, you may also ask us to transfer it directly to that third party. This right does not, however, apply to most of the ACL’s processing (as it is often based on legitimate interest or legal obligation), but could concern, for example, your online account data or the information provided for registering for an online event.

Exercising your rights: The rights listed above may be exercised free of charge (except for manifestly unfounded or excessive requests) by contacting us as follows: by post to Automobile Club du Luxembourg – GDPR Officer, 54 route de Longwy, L-8080 Bertrange, Luxembourg, or by e-mail at dpo@acl.lu. For security and confidentiality reasons, we may ask you to prove your identity (e.g. copy of an identity document) in order to avoid any communication of your data to an unauthorised person. We will endeavour to respond to your requests as soon as possible and in any event within the one-month period provided by the GDPR (extendable by two months if necessary due to the complexity or number of requests – in which case you will be informed of the extension).

8. Data security

The Automobile Club du Luxembourg implements appropriate technical and organisational security measures to guarantee a level of security appropriate to the risk presented by the processing of your data. In practical terms, the ACL notably takes the following precautions:

• Logical and IT security: use of firewalls and intrusion detection systems to protect the ACL network, communication of the website via an encrypted HTTPS/TLS protocol, robust password policies and secure storage (user and member passwords stored in hashed form), anti-virus software and regular software updates. Sensitive data (e.g. payment information, medical documents) benefit from additional protection measures (field encryption, restricted access).
• Access control and confidentiality: strict limitation of access to personal data to only those persons who need it, through individualised user rights and access traceability. ACL staff and our service providers are bound by confidentiality agreements and contractual data protection obligations. Internal training is provided to raise employee awareness of good security and data protection practices.
• Physical security: protection of ACL premises and of the data centres hosting the servers (building access control systems, video surveillance of certain sensitive areas, anti-intrusion and fire protection devices). Paper archives containing personal data are kept in secure cabinets or rooms.
• Testing and maintenance: the ACL ensures that its information systems are regularly tested, analysed and updated to prevent security flaws. Security audits and penetration tests may be carried out periodically by specialised entities.
• Incident management: despite all precautions taken, no system is infallible. The ACL has therefore put in place an internal procedure for managing personal data incidents/breaches. In the event of a proven breach of your data likely to result in a high risk to your rights and freedoms (e.g. leak of sensitive data), we undertake to inform you as soon as possible, and to notify the competent data protection authority (CNPD) within 72 hours as required by the GDPR. We will provide you with the necessary information on the nature of the data concerned and the measures taken to mitigate its effects.

The ACL wishes to stress that the security of your data is a permanent priority. However, everyone also has a role to play: it is your responsibility to keep your access credentials confidential (e.g. the password of your MyACL account) and to remain vigilant, in particular against phishing attempts or other scams aimed at obtaining your information. The ACL will never ask you for your password by e-mail or telephone. If you have any doubt about the authenticity of a communication purporting to come from the ACL, please do not hesitate to contact us directly.

9. Cookie and tracker policy

When you visit our acl.lu website or use the ACL mobile application, cookies and similar technologies may be placed on your device (computer, smartphone, etc.). A cookie is a small text file stored in your browser that allows your device to be recognised during subsequent visits. Cookies perform different functions: some are necessary for the functioning of the site, others facilitate navigation by remembering your preferences, and still others are used to analyse site audience or to offer you personalised content. A cookie in itself does not contain directly identifying information, but it may associate your browsing with a unique identifier linked to other information stored on the server.

Your choice: When you first visit our site, a cookie banner is displayed to inform you of the use of cookies and to ask for your preferences. You can accept all cookies, refuse them (except strictly necessary cookies) or configure them in detail. At any time, you can change your choice using the Cookie Management module available at the bottom of the page, or by configuring your browser (see “How to refuse or delete cookies” below). Please note that if you accept cookies by continuing to browse (implied consent), we will consider that you consent to the use of cookies until you change your settings. If you refuse non-necessary cookies, the site will remain accessible but certain optional features may be degraded.

Cookies that we use: Our site uses several types of cookies:

• Strictly necessary cookies (technical cookies): These cookies are essential for navigating the site and using its basic features. Without them, certain services (e.g. access to the secure member area, the content of the shopping cart in the e-shop) could not function properly. They are used, for example, to remember your chosen language from one page to another, to keep your session open during your visit (session cookie), or to balance the load on our servers. These cookies do not exploit personal data for marketing purposes and do not require your prior consent (their use is based on the legitimate interest in providing the service you request).
• Functional and personalisation cookies: These are non-essential cookies that improve your experience. For example, a cookie may remember certain choices you make on the site (font size, display preferences) in order to offer them by default on your next visits. In the context of the ACL site, this type of cookie is quite limited (essentially the language, already covered by the necessary cookies).
• Audience analytics cookies: These cookies (analytics) collect information on how visitors use our site (number of visits, most viewed pages, navigation paths, error rate, etc.). The ACL uses in particular Google Analytics, a service provided by Google, Inc. Google Analytics places cookies on your browser and collects information (such as the IP address, which is anonymised, the type of device, the pages visited, the duration of browsing) in order to provide us with statistical reports on site traffic. This data helps us understand how the site is used and improve its content. Analytics cookies will be placed only with your consent. If you refuse them, your visit will not be counted in our statistics. You may also choose to install the Google Analytics opt-out add-on available for your browser in order to block any collection by this tool, regardless of the site you visit.
• User experience measurement cookies: In addition to Google Analytics, we use Hotjar, a browsing behaviour analysis tool. Hotjar installs cookies that tell us how you interact with the site (mouse movements, clicks, scrolling). This allows us to improve the ergonomics of pages based on observed behaviour. Hotjar stores your IP address in anonymised form and does not provide us with personal data about you, only aggregated information on interactions. Hotjar cookies are treated as analytics cookies, subject to consent. Hotjar also offers an option to refuse all tracking (opt-out), available on its site, which we respect if you activate it.
• Chat and support cookies: We use an online chat service via the Intercom platform to allow you to talk live with our support teams from the site. When the chat is activated, Intercom may place cookies to remember you from one page to another, keep the conversation history and detect whether you are an already known user (e.g. if you are logged in to the member area, Intercom may link your chat session to your account in order to help you better). These cookies relate to the site’s functionality (customer support) and are activated only when the chat is used. Conversation data is processed in accordance with Intercom’s privacy policy.
• Social network cookies: Our site may integrate social network modules (share buttons, links to our Facebook, Twitter, LinkedIn, YouTube pages, etc.). If you interact with these modules, cookies may be placed by the corresponding social networks, even outside our site. For example, the Facebook “Like” plugin or sharing via AddThis (third-party sharing tool) may collect information about your browsing and associate it with your user profile on those platforms. These third-party cookies are subject to their own privacy policies; the ACL has no direct control over them and does not receive personally identifiable information from these cookies (except aggregated statistics possibly provided by the platform). We invite you to consult the policies of Facebook, Twitter, Google/YouTube, LinkedIn, etc. to find out how your data is used via these cookies. You can refuse these cookies by not clicking on the share buttons or by logging out of your social accounts while browsing our site.

Your consent: When you first visit, as long as you have not accepted or configured cookies, no non-essential cookie is placed on your device. If you choose “Accept all”, you consent to all the cookies described above. If you choose to refuse analytics and personalisation cookies, only the basic technical cookies will function. You can change this choice at any time via the “Cookie Management” page (link in the footer). Please note that withdrawal of your consent has effect only for the future: cookies already installed will remain until they expire unless you delete them manually from your browser.

How to refuse or delete cookies: You have several means of controlling cookies:

• Browser settings: Most browsers (Chrome, Firefox, Safari, Edge, etc.) allow you to manage cookies on a case-by-case basis or globally. You can configure your browser to systematically refuse cookies (or only third-party cookies), or to warn you before a new one is stored. You can also delete all or some of the cookies already stored. As each browser has its own settings, we invite you to consult the corresponding help section (generally the “Privacy” or “Cookies” heading of the settings). Please note that blocking all cookies may disrupt the functioning of some sites, including ours – for example, if you block session cookies, you will not be able to log in to the member area. The ACL cannot be held responsible for the consequences on your user experience of refusing or deleting necessary cookies.
• Online tools: In addition to browser settings, you can use online services to manage your choices regarding targeted advertising and audience measurement cookies. For example, the YourOnlineChoices site (www.youronlinechoices.com/fr) offered by the EDAA brings together many advertising networks and allows you to refuse their cookies in one go if you wish. Similarly, Google offers an “Opt-out” extension for Analytics. These tools have their limits (they too rely on cookies to remember your refusal…), but may be useful.
• Configuration via our site: As indicated, we provide a cookie management module on our site, allowing you to review your initial preferences. By clicking on “Cookie Management” at the bottom of the page, you can display the list of cookies used and adjust your consents (activate/deactivate certain categories). This relies on an integrated technical solution compliant with the GDPR.

For more detailed information on the cookies we use and their characteristics (lifespan, precise purpose, origin), we invite you to consult our dedicated page or to contact our DPO.

10. Management of member profiles and the MyACL customer area

The ACL provides its members with a secure online customer area, called MyACL, accessible via our website or the mobile application. This personal area allows you, as a member, to manage your information more easily and to benefit from our digital services. Here are some points concerning the processing of your data in this area:

• Account creation and access: When you join, a MyACL account is created and associated with your member profile. You receive or choose login credentials (for example, your e-mail address or membership number and a password). These credentials are personal and confidential. It is your responsibility not to disclose them and to choose a sufficiently robust password. The ACL does not have access to your password in clear text (it is stored encrypted) and will never ask you for it through any channel. In the event of loss, a secure reset procedure is available.
• Data displayed in your profile: Once logged in, you can view and modify certain information in your profile: your contact details (address, e-mail, telephone), your communication preferences (newsletter subscription, language choice, etc.), information about your registered vehicles, the membership plan taken out and its expiry date, the history of your online orders (e.g. motorway vignettes, e-shop products), or your service history (e.g. the list of breakdown assistance you have benefited from, the diagnostic appointments made, etc.). This data comes from our member database and is updated in real time. The customer area is an interface that allows you to verify the accuracy of your information and keep it up to date.
• Modification of your data: Via MyACL, you can directly modify certain personal data concerning you. For example, you can correct your telephone number, change your postal address if you move, add or remove a vehicle from your list of covered vehicles, etc. The changes you validate are immediately recorded in our internal systems, without the need to contact us separately. For other, more sensitive types of data (e.g. change of name following marriage, modification of date of birth, etc.), or in case of difficulty, you may be asked to contact our services in order to provide supporting documents before the update, in order to avoid any error or fraud.
• Online services: The MyACL area also allows you to access various online services without re-entering your information: itinerary request, service booking (e.g. booking a karting session or a diagnostic), online payment of your membership fee, download of useful documents (general terms and conditions, insurance certificates, etc.). Each use of a service via MyACL generates processing of data as described in this policy, exactly as if you had done so through another channel, the difference being that the digital channel facilitates processing. For example, if you order a motorway vignette via your area, we will process your identity, address and vehicle data to carry out the order, as we would have done by post or at the counter. All these interactions via the portal are traced and secured.
• Security of the customer area: MyACL is protected by reinforced security measures: encrypted connection (HTTPS), mechanisms to prevent unauthorised access (lock-out after several failed login attempts, anti-robot captcha), logging of connections to detect any suspicious activity, etc. It is nevertheless essential that you contribute to this security by using a unique and complex password, and by logging out after use, especially if you are using a public computer. If you suspect that an unauthorised third party has accessed your account, please notify us immediately so that we can take measures (account blocking, password reset, etc.).
• Profiling: The member area does not in itself carry out profiling, in the sense that no automated decision concerning you is taken solely on the basis of your profile data. Your account information is used essentially to present it to you and to facilitate your procedures. The ACL may at most use certain profile data to better target its communications (e.g. not offering you motorcycle offers if you have only registered cars, or inviting you to an event near your region of residence), but these segmentations remain manual or basic and do not produce any significant legal effect on you. In particular, we do not practise automatic scoring of our members or automated refusal of service. Any important decision (e.g. suspension of your membership for abuse) would involve human intervention and an individual examination of your situation.
• Closing your profile: If you cease to be a member or if you expressly request it, your MyACL account may be deactivated or deleted. In practice, at the end of a membership, the account is first deactivated (you no longer have access, but the data remains stored during the post-membership retention period indicated above). Then, the data is archived or deleted as provided. If you request deletion of your account during your membership while remaining a member, please note that we will nevertheless have to retain the information necessary for the administration of your offline membership. Furthermore, deleting the account will prevent the use of online services, but does not terminate the membership itself.

In summary, the MyACL member area is a tool made available to you for your convenience, and its use is optional. If you prefer not to use it, you can still interact with the ACL through traditional channels (telephone, counter, post) to obtain the same services. As the data in the customer area comes from the central member database, not using MyACL does not prevent the ACL from processing your data in the normal course of membership. However, the customer area gives you more control and transparency over your own data. We encourage you to use it and to regularly verify the accuracy of your information.

11. Specific processing linked to certain ACL services

In order to give you a complete picture, we detail below the particularities of processing specific to certain flagship ACL services. These elements supplement the general information already provided:

• Contact Center (call center): The ACL operates a contact center to respond to requests from its members and customers 24 hours a day. When you call our numbers (general or specific), Call Center staff may access your member record (if you provide your membership number or other identification information) in order to handle your request in a personalised way. An audio recording of the call may be made, as mentioned, for quality reasons. Contact Center agents also enter a summary of your call in our system, in order to ensure follow-up or traceability. This data includes the date/time of the call, the reason (request for information, complaint, assistance, etc.), and the response or action taken. If your call concerns a specific service (e.g. lodging a complaint), the data may be transmitted to the competent internal department (here, our quality department), which will contact you again. Please note that the ACL also offers call center services on behalf of professional customers (B2B) via ACL Services S.A. – in this case, the data processed belongs to the customer concerned, the ACL acting as processor. This does not concern your member data, unless you work for a company that is a customer of the Call Center. In addition, the Contact Center may involve booking additional services for you (taxi, hotel, replacement vehicle) if your plan provides for it: in this case, your identity data may be communicated to the third-party providers delivering these services (see recipients section).
• Roadside Service (24/7 mobility assistance): This emblematic ACL service involves the processing of data in emergency situations. When you call the Contact Center for assistance (via 26 000 or via the eCall mobile app), we collect your real-time location data (breakdown address, GPS coordinates) as well as details about your broken-down vehicle (make, model, registration) and the nature of the breakdown or accident. This information is transmitted to our in-house patrol officers or partner tow operators to enable a rapid intervention. Geolocation can be done either through the information you provide orally or – if you use the application – through the automatic sending of your GPS position to ACL teams. Location data is used only to organise on-site assistance and is not retained beyond the handling of the incident (except where mentioned in the assistance report, e.g. “breakdown assisted at such-and-such location”). The call to the roadside service or contact center may be recorded as mentioned above, and the ACL may contact you again afterwards for a satisfaction follow-up. Finally, note that for the safety of our teams, ACL tow operators’ vans are equipped with geolocation systems, but this falls under the internal management of staff and not the processing of your data.
• ACL Sport (sports events and competitions): The ACL, via its sports commission, organises and supervises various motorsport activities (rallies, slaloms, competitive karting, etc.) and represents the FIA at national level. If you take part in these activities, we process specific data: registrations for events (contact details, sometimes a copy of the driving licence to verify eligibility, category of vehicle entered), issuing of sports licences (information transmitted to the national/international federation, including a medical fitness certificate if required for the type of licence), management of rankings and penalties (points obtained, times achieved, rank in the competition). This data serves to ensure sporting fairness and performance monitoring. Competition results (containing your name, race number, nationality, ranking, etc.) may be published on our website, our social networks or in the specialised press, as part of the promotion of motorsport. This is generally expected in the sporting context (legitimate interest in the transparency of results) – however, if you are a simple unlicensed participant who does not wish to appear publicly, please let us know. ACL Sport may also keep a history of your participations and titles obtained, in particular to feed national statistics and the club’s history. In addition, as part of certain competitions, geolocation systems of racing vehicles may be used for safety purposes (rally) – this data is not used outside the context of the event. Finally, ACL Sport complies with the sporting regulations in force: for example, in the event of disciplinary proceedings or anti-doping control, the necessary data will be processed and transmitted to the competent authorities, in accordance with federal and legal obligations.
• Cycling & Maison du Motard: These ACL initiatives aim to promote soft mobility and two-wheeler safety. We offer in particular cycling training (learning or getting back in the saddle, technical workshops) and community cycling events, while the Maison du Motard offers motorcycle training (advanced riding, safety) and brings together the motorcyclist community. If you take part in these activities, we collect your registration data: identity, contact details, level of experience, and possibly practical information (e.g. height to provide a suitable bicycle, type of motorcycle owned to guide the training, etc.). This data is used to manage the session logistically (forming level groups, preparing equipment). You may also be asked to complete a brief health questionnaire or to mention physical constraints in order to adapt the supervision (e.g. indicating whether you have heart problems for intensive outings – purely voluntary). This information remains confidential and is intended only for qualified instructors. After the training, we may keep a record of your participation and assess your feedback (satisfaction questionnaire) to improve our offers. With your agreement, we may also contact you again for new sessions or include you in the community (e.g. via a dedicated cycling or motorcycle newsletter). Finally, during public events (e.g. guided rides, mechanical workshops), photos/videos may be taken. The ACL takes care to respect image rights: we avoid close-ups of individuals without authorisation. If a published photo depicts you and you wish it to be removed, you may make a request.
• Promotion of mobility (projects and municipalities): The ACL is actively involved in promoting sustainable and innovative mobility in Luxembourg. This involves pilot projects (e.g. testing of electric vehicles, carpooling solutions, etc.), studies and surveys on travel habits, public or private conferences, or partnerships with municipalities to improve local traffic. In this context, the ACL may collect and process data from the public or from participating volunteers. For example, we may launch an online survey among the residents of a municipality about their modes of transport: the responses, possibly combined with socio-demographic information (age bracket, postal code), are analysed in aggregate form to formulate recommendations. Individual data from this type of study is anonymised as soon as possible. If you take part in a pilot project (e.g. loan of an electric bicycle for X weeks), we will collect your contact details for project management, usage monitoring (e.g. mileage readings, weekly feedback) and possibly geolocation data (if the project includes GPS tracking of the journey to analyse typical routes, always with your consent). These projects are voluntary and carried out within a precise framework (information form and specific consent). Results are generally published in statistical form and no personal data is publicly disclosed without authorisation. Finally, as part of actions with municipalities, the ACL may process data provided by the municipality (e.g. local accident data, road plans) – these do not in principle contain personal data, or only in anonymised form.
• ACL Location (vehicle rental): The ACL offers a car rental service (“ACL Location”) for its members and the general public, with vehicles available at a preferential rate. When you make a vehicle reservation via ACL Location, we collect the data necessary for managing the rental contract: details of the main driver and additional drivers (surname, first name, date of birth, address, telephone, e-mail), a copy of the valid driving licence, as well as payment and security deposit information (e.g. credit card imprint). This data is essential to draw up the rental contract properly (verify that you meet the conditions, minimum age, valid licence, etc.) and to comply with legislation (keeping a register of vehicle renters). During the rental, we may record information on the use of the vehicle: mileage driven, dates and times of pick-up and return, condition of the vehicle (condition reports), any incidents or fines. If the vehicle is equipped with a telematics or GPS system (e.g. to find the car in the event of non-return), this is used only where necessary and not to track your movements in real time. After the rental, your data is retained for the legal period (rental contracts = accounting documents) and to manage any disputes (damage discovered afterwards, fines received late – in the latter case, we will transmit your details to the authorities on request, in accordance with the highway code).

As part of the “Experience Drive” experience, certain personal data of the member (surname, first name, e-mail address, telephone number) is transmitted to the vehicle brand when the vehicle is made available. At the end of the experience, the answers to the evaluation questionnaire (relating in particular to comfort, performance and overall experience), as well as the ACL membership number, are also communicated to the brand. This transmission and the resulting processing are based exclusively on the explicit consent of the member, collected by means of a dedicated form. This consent covers the analysis of the user experience, the possibility for the brand to contact the member again to obtain further information, and the use of the data for commercial prospecting purposes. The member is clearly informed of the purposes pursued, the identity of the recipients and their right to withdraw consent at any time, without consequence for their participation in the experience. The brand processes this data as a separate controller for its own purposes.

• Communication (newsletter, magazine, events): The ACL communicates regularly with its members and subscribers via different channels. For the electronic newsletter (monthly or thematic newsletter), we use your e-mail address and possibly your preferred language. We track in aggregate form the effectiveness of these mailings (open rates, clicks on links) and, if you are a member, we may link this information to your member profile in order to adapt our content. Important: this tracking of reactions to newsletters serves only to improve the general quality of the content (topics that interest readers most, optimal formatting, etc.) and not to profile you individually for advertising purposes. For example, if we find that a large proportion of members never click on “motorcycle” articles, we might decide to highlight them differently, but we will not target or exclude recipients individually on that basis. You may unsubscribe from the newsletter at any time via the link provided or by contacting us, in accordance with the section on the right to object. For the “Autotouring” magazine (or other current title), sent by post, we use your name and address. Printing and dispatch are entrusted to a provider as indicated above, under our control. If you no longer wish to receive the paper magazine, please let us know (some members choose to read it online only). Finally, when we organise promotional or social events (e.g. an open day, a mobility roadshow, etc.), we may use your contact details to invite you if you match the target audience (e.g. residents of a region for a local event, electric vehicle owners for an e-mobility event, etc.). These targeted mailings are based on objective criteria from your profile data, and you can of course refuse to receive this type of invitation. At events, we may ask you to register in advance (processing of your identification data) and possibly to sign a liability waiver if necessary (this is the case, for example, for vehicle trials). These documents are kept for the duration of the event and archived afterwards as evidence in case of an incident (limitation period).
• Mobility/travel advice: This service covers the help the ACL provides in preparing your journeys: itinerary advice, tourist information, hotel booking, travel insurance, etc. When you request a tailor-made itinerary, you can do so via a web form or at a branch. We then collect your journey data (starting point, destination, desired stops) and your preferences (motorways yes/no, desired visits, etc.), in addition to your contact details to send you the result. This travel information is not really “personal”, but we process it with the same confidentiality. If you come to a branch for travel advice, the agent may consult your history of past trips with the ACL (if any) to guide you better. Regarding travel insurance (cancellation, assistance, etc.), if you take out these products through us, the necessary data (civil status, travel dates, insured amounts, persons to be covered) is shared with the partner insurer as explained earlier. We keep a copy of the insurance policy and your related declarations for the duration of the insurance and beyond if a claim occurs. Finally, if you take part in an ACL organised trip (e.g. group excursion), in addition to the data already mentioned for any booking, you may be asked for specific trip-related information: dietary habits or restrictions (for meal organisation), passport number and expiry date (for group formalities), name of a person to contact in case of emergency during the trip. This data is collected in your interest, with your consent, and transmitted only to the providers concerned (accompanying guide, hotel for menus, etc.). It is deleted after the end of the trip, unless it reappears on contractual documents (the list of travellers may be archived with the trip file).
• Diagnostic Center (vehicle technical diagnostics): The ACL has a car diagnostic center where members can have their vehicle tested and checked (battery, brakes, etc.) without waiting for the official technical inspection. If you use this service, we record your appointment booking (date, time, type of diagnostic requested), associated with your contact details for confirmation. During the diagnostic, technicians collect the vehicle’s technical data using electronic tools (measured values, error codes, condition of components). A diagnostic report is drawn up, possibly containing the chassis number (VIN) and registration of the vehicle tested, as these elements often appear on reports to identify them. This report is given to you and the ACL keeps a copy. This technical information, although linked to a vehicle, is treated as personal data because it is attached to you (owner/user). The ACL uses this data only to: advise you on maintenance/repairs to be carried out, carry out overall statistical analyses (e.g. “X% of the vehicles tested show such-and-such a fault” – anonymously), and, if you wish, remind you of future checks (e.g. a reminder may be scheduled to check your battery again in 6 months). No communication of this data to third parties takes place, unless you request it (e.g. forwarding the report to your garage) or in an exceptional safety case (critical defect affecting road safety – in which case, with your agreement, we could inform a competent body).
• Karting (ACL Karting in Mondercange): The ACL operates a karting track open to the public and members, with leisure sessions and friendly competitions. When you book a karting slot or take part in a race, we collect your identification data (surname, first name, date of birth to verify the minimum age or classify by age category, e.g. junior/adult) and your contact details (telephone/e-mail) for managing the booking. A liability waiver may be presented to you for signature before taking to the track, especially for new participants, to certify that you are fit to drive and to inform you of the safety rules. If you are a minor, parental authorisation is required and the parent/guardian therefore provides and signs with their contact details. During the activity, a timer records your lap times; at the end, a ranking of the session is drawn up. These results (with your first name or pseudonym if provided) may be displayed on site and sometimes published on a screen or internal website to attract participants (ranking of the day, track record, etc.). If you take part in a karting championship or tournament organised by the ACL, specific rules will be communicated to you regarding the use of your data (publication of rankings, podium photos, etc., similar to what is described for ACL Sport). Booking data is retained for commercial follow-up and statistics (attendance rate, number of laps completed), as well as to be able to contact you again if necessary (e.g. lost property, or Covid health alert if applicable). The track regulations also require responsible behaviour; in the event of an incident (accident, non-compliance with the rules), a report may be drawn up with your information for internal management and insurance purposes.
• Accounting & invoicing: This is not a “service” as such for you, but an unavoidable part of our processing. Whether for membership, participation in a trip or any paid service, the ACL generates accounting entries and invoices. This involves processing your data for invoicing purposes: issuing the invoice in your name (or in the name of your company if it is a B2B contract), mentioning your address, your membership number if applicable, the details of the service and the amount due. We also record the payments received (date, method, transaction reference). If you choose to pay by direct debit (SEPA direct debit), we process your IBAN and SEPA mandate to automatically collect the annual membership fee: this data is secured and transmitted to our banking partner at the due dates. For online card payments, as mentioned, we do not store card numbers ourselves; however, we keep the transaction confirmation and possibly the last 4 digits for reference. The ACL may also, at your request, register certain payment methods for next time (e.g. link your member account to a SEPA mandate or a bank card token) – this is done with your consent and the data is stored with the payment provider in tokenised form. All accounting operations are retained for 10 years (see retention). Please note that for the management of unpaid amounts or debt collection, if you do not pay a sum due despite reminders, the ACL reserves the right to transfer your file to a debt collection service or a lawyer, which involves communicating your contact details and the nature of the debt. Fortunately this remains rare and proportionate (legitimate interest + obligation to perform the contract).

In summary, each of the specific ACL services mentioned above falls within the general purposes described in section 3. We wished to provide these details in order to be transparent about what each service concretely involves in terms of data. If you would like more details about a particular service, you may consult the specific general terms and conditions of that service (available on our website or on request) or contact the person in charge of the service concerned directly. The ACL endeavours to document its processing clearly in each area of activity.

Furthermore, the ACL has recently been deploying artificial intelligence (AI) solutions as part of its member loyalty analyses, commonly known as churn analysis. The aim of this approach is to anticipate the risks of membership non-renewal by identifying, from objective and measurable data, the factors likely to influence member satisfaction or loyalty. The algorithmic models use various indicators such as the frequency and nature of use of services (assistance, events, trips, training), interactions with the ACL’s communication channels, renewal times, and the evolution of the usage profile over time. These analyses make it possible to adapt communication actions, optimise service offers and improve the overall quality of the relationship with members.

The data processing carried out in this context is based on the ACL’s legitimate interest (Article 6(1)(f) of Regulation (EU) 2016/679 – GDPR), consisting in ensuring the continued satisfaction of its members, strengthening the relevance of its services and guaranteeing the sustainability of its associative model. This processing is governed by the fundamental principles of the GDPR, in particular purpose limitation, data minimisation, accuracy of the data processed and transparency towards data subjects (Article 5 GDPR). The data used comes exclusively from the ACL’s internal management systems and is neither resold nor exploited for commercial purposes by third parties.

In order to guarantee exemplary compliance and an ethical use of artificial intelligence, the ACL applies strict governance measures: access control and traceability, detailed documentation of the algorithmic logic, regular monitoring of model performance and continuous evaluation of their relevance with regard to the objectives pursued. Furthermore, no automated decision is taken on the exclusive basis of the results generated by AI: the analyses produced serve only as a decision-support tool, enabling the ACL to focus its action on a better understanding of its members’ expectations.

12. Changes to the privacy policy

This privacy policy may be amended to reflect changes in our processing practices or to comply with legal/regulatory changes. In the event of a substantial update (e.g. new purpose, significant new recipients, etc.), the ACL will inform you through the usual channels (e.g. announcement on the site, information in the newsletter or direct e-mail) and/or at your next login to the member area. We encourage you to consult this page regularly to take note of the latest version in force.

Last updated: 2 November 2026