Privacy Policy
The company KEOLIS PAYS NORMANDS ("KEOLIS PAYS NORMANDS" or "We") makes every effort to protect your personal data in compliance with applicable European and French regulations.
This privacy policy ("Privacy Policy") is intended to inform you about the purposes and conditions under which we process the personal data we may collect through our various channels, such as our commercial services, our bybus.Ibili website, our social media, or our potential events.
Our Cookie Management Policy, available at [Cookie Management Policy | Bybus], supplements this Privacy Policy to inform you about the purposes and conditions of use of cookies or browsing data that may be deployed on our websites and mobile applications.
We invite you to take the time to read this Privacy Policy so that you have all the information you need to understand how your personal data is used and to freely and fully exercise your rights as guaranteed by applicable laws and this Privacy Policy.
1. General provisions
Data controller
The data controller for your personal data is KEOLIS PAYS NORMANDS, except when we act on the instructions and for the exclusive account of our clients. In this case, we will inform you (i) either when collecting your personal data, (ii) or in this Privacy Policy, (iii) or when you wish to take steps with us related to the protection of your personal data.
General Terms of Use
The Privacy Policy is an integral part of the General Terms of Use of the Site, the General Terms of Sale and Use (CGVU) of our services, or the General Terms of Use (CGU) related to some of our sites and must be read in conjunction with them. The CGVU are accessible via this link by-mobilite-bayeux-intercom.fr/mentions-legales. For non-commercial applications, the applicable terms of use can be found on the application.
Applicable law and competent administrative authority
The Privacy Policy is governed by the General Data Protection Regulation No. 2016/679 ("GDPR") and by the French Data Protection Act No. 78-17 of January 6, 1978, as amended ("Data Protection Act"), under the regulatory supervision of the French data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés – www.cnil.fr).
Links to third-party websites
Our site may contain or use links to websites, mobile applications, products, or services that are operated by third parties (including advertising sites, our partners, or social networks). We remind you that the Privacy Policy does not extend to these third parties over whom we have no control and for whom we cannot be held responsible.
We encourage you to familiarise yourself with the privacy policies, procedures, and practices of these third parties.
Protection of minors
For the purposes of digitally providing KEOLIS PAYS NORMANDS' products and services, we may collect personal data from minors under the age of 16, under the supervision and with the consent of their legal representatives (parents or guardians). Les usagers de nos services numériques qui nous informent être âgés de moins de 16 ans disposent d’un droit discrétionnaire à l’effacement de leurs données (sous réserve de nos obligations légales de conservation décrites à l’article 3 « Utilisation des données collectées et délais de conservation » ci-après), qu’ils peuvent exercer directement ou par l’intermédiaire de leur représentant légal, à tout moment et sans motif, en nous contactant à l’adresse donneespersonnelles.kpn@keolis.com
2. The personal data we collect
The Privacy Policy applies to the personal data that we are notably likely to collect from you or about you (see below), from the following sources:
Filling out our subscription or collection forms on paper or electronic media or on the occasion of operations or events organised by KEOLIS PAYS NORMANDS in which you participate;
Visit to one of our physical points of sale and/or purchase of one of our services;
Request for contact or exchanges by email / mail and/or by phone with our customer relations services;
Receipt and management of your application via the "Contact" tab on our Site, as well as by email, and creation of a CV library;
Receipt of supplier/prospect information in the context of managing pre-contractual and contractual relationships;
Processing video protection images from cameras installed in our facilities open to the public (commercial agencies, transport vehicles);
Processing images and sound from mobile cameras in accordance with Law No. 2019-1428 of December 24, 2019, on mobility orientation, to Decree No. 2021-543 of April 30, 2021;
Validation of tickets, access control to our services (urban, interurban, collective or individual transport, medicalised, vehicle rental or parking, etc.) or processing of offences and collection of fines;
Use of our services, including our ticketing systems and applications as well as on-demand transportation services, transportation for people with reduced mobility, and/or bicycle mobility services;
Processing of offences and collection of fines;
Use of the bybus.ibili website;
Receipt and sending of emails, text messages, and other electronic messages between KEOLIS PAYS NORMANDS and you;
Telephone or vocal exchanges between you and KEOLIS PAYS NORMANDS or one of its service providers;
Exercise of your rights under the GDPR addressed by mail and/or email to KEOLIS PAYS NORMANDS.
3. Use of collected data and retention periods
We collect and use your personal data for the main purposes described below. We retain your personal data only for the duration necessary to fulfil the various purposes, except in cases where the law allows or requires us to keep them longer.
The table below summarises the different maximum retention periods applicable:
|
Purpose |
Types of Data Collected |
Shelf lives |
||||||
|
Management of your user accounts on our Websites and/or applications |
• Login details |
3 years from user inactivity |
||||||
|
Management of commercial prospecting and sending news to customers and prospects |
3 years from the end of the contractual relationship for the customer and from the last contact initiated by the prospect |
|||||||
|
School transport service management and registration |
• Identification data |
Registration data is retained for the duration of the application review and approval process. |
||||||
|
Management and registration for the on-demand transport service |
• Identification and login details |
The data will be deleted/anonymised no later than two years after the last booking. |
||||||
|
Management and registration for transport services for people with reduced mobility |
• Identification details |
Données d’inscription conservées le temps de l’étude de la demande et de sa validation. |
||||||
|
Management, issuance and use of transport tickets (customer relationship management, distribution of media and transport tickets, management of sales channels and management of ticket validation) |
• Identification details |
Customer relationship data is retained for the duration of the contractual relationship and for three years after its termination for customers and prospects. |
||||||
|
Conducting satisfaction surveys |
• Identification data |
Anonymization of responses after completion of survey |
||||||
|
Answering your requests for information / questions |
• Identification data and elements on the application |
Duration required to process your request and maximum 1 year |
||||||
|
Management and recording of purchases and services, guarantees, collections |
• Identification data |
10 years from the last event, except for data concerning payment methods, which are processed by payment providers of KEOLIS NORMAN COUNTRIES only for the limitation period of payment transactions |
||||||
|
Claims Management |
• Identification data |
5 years from the closing of the claim |
||||||
|
Follow-up of the minutes issued and corresponding fines La détection du délit d’habitude L'émission de bulletins de régularisation, le traitement des relances et des réclamations consécutives à un constat d’infraction |
• Identification data |
Until the fine is paid 12 months maximum 1 year in active base then 2 years in archiving
|
||||||
|
Cookie management: audience measurements |
• Cookies |
To know the retention periods of your data related to the management of cookies, we invite you to consult our cookie management policy |
||||||
Prevention of incidents, detection of offences through the use of body cameras
|
•Videos/images and sounds |
In accordance with Decree No. 2021-543 of 30 April 2021: |
||||||
|
Use of body camera recordings for training and educational purposes for officers |
•Videos/images |
In accordance with decree no 2021-543 of April 30, 2021: |
||||||
|
Management of video protection in commercial premises and transport vehicles |
• Images |
1 month maximum |
||||||
|
Facility management / CCTV system |
• Pictures • Identification data • Location data |
1 month maximum |
||||||
|
Recording of emergency calls at stations |
• Sounds of calls |
6 months maximum |
||||||
|
Management of your recruitment and creation of a CV database |
• Identification data |
The duration of the application review and then a maximum of 2 years from the date of the response, if you are not selected, in order to contact you again for other opportunities. |
||||||
|
Conducting statistical analyses on network usage |
• Anonymised statistics |
Anonymous |
||||||
|
The management of contests |
• Data required for participation in the contest and the selection of winners |
Preserve the duration of the contest until the prizes are awarded. |
||||||
|
The management of found objects |
• Anonymised data (photos) |
Conservation of found objects for 10 days. |
||||||
|
Management of requests for the exercise of rights and information under the GDPR |
• Identification data including identity documents • Request received • Responses provided |
5 years from the receipt of the complete application The identity document is only kept for the duration of the verification. |
||||||
|
Management of pre-litigation and litigation, gathering of evidence |
• Data required for the ongoing procedure |
|
||||||
|
Incident reporting management
Management of reports of obstacles for persons with reduced mobility |
• Identification data • Incident data
• Identification data • Data relating to accessibility barriers |
1 year from the date of notification
5 years from the date of notification |
4. Legal bases for the processing of personal data
In accordance with applicable regulations, we process your data when we have a legal basis that allows us to do so. This may include contractual performance (a), your consent (b), legitimate interest (c), or a legal obligation (d).
a) The purposes of processing based on the foundation of contractual (or pre-contractual) execution • The management, issuance, and use of transport tickets; • The registration and management of KEOLIS PAYS NORMANDS services; • The management and historical tracking of purchases and service provisions, warranties, collection, invoicing; SEPA mandate management; • The management of your recruitment; • The management of complaints; • Management and registration for the school transport service; • Management and registration for the on-demand transport service; • Management and registration for transport services for people with reduced mobility.
• Management of online purchases
b) The purposes of processing based on your consent
The management of commercial prospecting and the sending of news to clients and prospects; • Conducting satisfaction surveys; • The management of cookies and trackers on our websites and applications, excluding technical cookies and trackers necessary for operation.
• Management of SMS alerts; • Newsletter management; • Management of your user accounts on our Sites and/or applications;
c) The purposes of processing based on the legitimate interest
• The management of your information requests / questions; • The recording of calls to the customer relations centre; • The management of found objects; • The management of pre-litigation and litigation, the gathering of evidence: data necessary for the ongoing procedure; • The recording of calls on station intercoms (emergency calls); • The conducting of statistical analyses on network usage; • The creation of a CV database; • The organisation of contests and the awarding of prizes;
• The implementation of video surveillance for premises management; • Incident report management
• The implementation of body cameras on an experimental basis in accordance with Law No. 2019-1428 of December 24, 2019, on mobility orientation, and Decree No. 2021-543 of April 30, 2021; • The implementation of video protection of spaces for the purpose of securing goods and people in accordance with the internal security code;
d) The data collected on the basis of legal obligation
The management of fraud and the recovery of fines, as well as the detection of habitual offences; • The management of your requests to exercise your rights (access, rectification, opposition, etc.) under the GDPR; • The implementation of video protection of spaces for the purpose of securing goods and people in accordance with the internal security code; • Management of reports of accessibility obstacles for people with reduced mobility
5. Data transmission
Your personal data may be disclosed:
Internally
To the authorised departments of KEOLIS PAYS NORMANDS and those who need to know within the framework of the aforementioned purposes, including the customer service, human resources department, security and fraud department, and sworn agents, authorised personnel from the security department, agents, legal department, etc.
Within the Keolis Group
We may share your personal data with certain entities of the Keolis Group (Keolis SA and Keolis Solution), in order to ensure the continuity of our services, our website, and our mobile applications;
If you apply through the Keolis Group's recruitment portal, your account and application data will be processed by Keolis SA, as a separate data controller, who will forward your application for processing by KEOLIS PAYS NORMANDS, as a separate data controller.
To service providers, subcontractors
We may share your personal data with trusted third parties, located within the European Union (hereinafter "EU"), to help us operate our services and in particular to ensure the proper functioning of KEOLIS PAYS NORMANDS' websites and mobile applications;
To the Organising Authority and the transport operators of the Region/Department
In the context of the interoperability of certain tickets and subscriptions, ticketing customer data may be transmitted to the Organising Authority and/or other operators exclusively to ensure this interoperability of tickets.
At the end of the Public Service Delegation, your Customer data will be transmitted to the Organising Authority and/or the new transport operator of the NETWORK to ensure the continuity of public service.
With your consent, your customer data may be transmitted to the Organising Authority in order to contact you for surveys and/or send you information about the region.
To business partners
We share certain pseudonymous data, containing no direct identification elements, within the framework of the purposes described in Article 3 "Use of Your Personal Data" above, regarding cookies and trackers collected with partners who collect and process these cookies/trackers. The latter being distinct/joint data controllers regarding the processing carried out.
To third parties for legal reasons
In the event that we are required to comply with laws and regulations and legal requests and orders or if it is permitted by law (i.e., for the protection and defence of rights, situations that threaten life, health, or safety, etc.), such as the transmission of unpaid records to the Public Prosecutor's Office, or the transmission of video protection images and/or body cameras to the Judicial Police in case of a judicial requisition.
If you have formally consented, some of your data may be transmitted to third-party commercial partners and/or the Organising Authority exclusively for the intended purposes.
In any case, we always require these recipients to provide sufficient guarantees of confidentiality and security and to take the necessary physical, organisational, and technical measures to protect and secure your personal data, in accordance with current legislation.
All of your data is processed and primarily hosted within the EU. However, data transfers outside the EU may occur. Any transfer of your data outside the EU is carried out with appropriate safeguards that comply with the applicable regulations in this regard, either because the recipient countries benefit from an adequacy decision, or because these transfers are governed by the implementation of Standard Contractual Clauses validated by the European Commission. For more information on the framework for these transfers, you can contact us at the contact addresses indicated in Article 9.
6. Data safety
KEOLIS PAYS NORMANDS secures your personal data by implementing adequate physical, organisational, and technical measures to prevent any unauthorised access, use, disclosure, modification, or destruction, in accordance with current regulations.
These measures notably include: . Storage on secure servers within the European Union; . Securing your data, notably through pseudonymization processes, encryption of transmitted data, and the implementation of means to ensure the confidentiality, integrity, and availability of your data; Limited access to your data on a "need-to-know" basis; The implementation of internal organisational measures to protect your data.
Although KEOLIS PAYS NORMANDS implements all possible measures to protect your personal data, we cannot guarantee the security of information transmitted on our websites or on one of our mobile applications when a security flaw affects your device or browser.
7. Your rights over your personal data
Under the GDPR and the Data Protection Act, you have various rights, including:
Access, modification, updating, and deletion of your personal data
You can request access to your personal data held and processed by KEOLIS PAYS NORMANDS, view it, obtain a paper or electronic copy, and request its correction, update, or deletion.
Opposition
You can, at any time, request that some of your data no longer be processed.
Portability
You can request that your data being processed be communicated to you in an open and machine-readable format, whether for your personal use or to transfer them to another data controller.
Limitation of processing
In some cases, you can request that the processing of your data be limited. You can also determine the fate of your data after your death.
Complaint to a Supervisory Authority
Without prejudice to any other legal remedy, you have the right to lodge a complaint with the supervisory authority of the European Union country in which you reside, work, or where you believe a violation of your rights has occurred.
***
You can exercise all of these rights by sending a written request, accompanied by proof of identity (when this is necessary to verify your identity), to the contacts mentioned in Article 9 "Contact Us".
We will strive to respond to your requests as quickly as possible and under the conditions provided by the applicable regulations. Nevertheless, in some cases, we may not be able to respond favourably in order to comply with our legal or contractual obligations.
8. Modification of the Privacy Policy
KEOLIS PAYS NORMANDS may need to make changes to the Privacy Policy.
We encourage you to regularly check this page to stay informed about any changes and the measures we take to protect your personal data.
9. Contact us
Pour exercer vos droits ou toute question relative à la Politique de Confidentialité ou au traitement de vos données personnelles, veuillez nous contacter en utilisant l’adresse electronique donneespersonnelles.kpn@keolis.com ou à l’adresse postale KEOLIS PAYS NORMANDS, 19 chemin de Courcelles, 14120 MONDEVILLE.
The Privacy Policy was updated on Ocotober 22, 2025.
