Privacy Policy
Effective date: 06 July 2026
I. Who we are
Quick guide
Meet the organisations behind this notice.
This section explains which Applegreen Group company may act as controller and how to contact the relevant privacy team.
This Global Privacy Notice is issued on behalf of the Applegreen Group (“Applegreen”, “we”, “us”, “our”).
The Applegreen Group includes a number of companies operating customer-facing services across Ireland, the United Kingdom and Northern Ireland, and the United States. This includes:
- Petrogas Group Limited and Applegreen Electric IRL Service Areas Limited: Block 17, Joyce Way, Park West Business Park, D12 F2V3, Dublin, Ireland;
- Welcome Break Limited and Applegreen Electric UK Service Areas: 2 Vantage Court, Tickford Street, Newport Pagnell, MK16 9EZ, UK;
- Petrogas Group US Inc: 208 Harristown Road, Glen Rock, NJ, 07452, USA
Each of these entities may act as a data controller depending on the service you are using. References to “Applegreen”, “Welcome Break”, “we”, “us” or “our” in this Notice should be understood as referring to the relevant Applegreen Group company (or companies) responsible for the processing of your personal data in the context of the relevant service.
Contact details
Republic of Ireland and United States: dpo@applegreen.com
Please use this form for exercising privacy rights for Ireland: here
If you are a resident of Connecticut, Delaware, New Hampshire, New Jersey or Indiana, please use this form for exercising privacy rights for the USA: (here)
United Kingdom and Northern Ireland: dpo@welcomebreak.co.uk
Please use this form for exercising privacy rights: (here)
Please use this form for submitting privacy complaints if you are not satisfied with our answer to your privacy rights request: (insert the link here)
II. Purpose of this Privacy Notice
Quick guide
This section explains why the notice exists and when it applies - from website and apps to hotels, EV charging, loyalty programmes and more.
This is a global privacy notice which explains how we collect, use, share and protect personal data (or personally identifiable information) in connection with our customer-facing activities.
This Notice applies when you interact with us in any of the following contexts:
- visiting our premises, including service stations, travel plazas, retail sites, EV charging locations, hotels and other customer facilities;
- using our websites, mobile applications or other digital platforms;
- creating or using a customer account across our services, including EV charging, Wi-Fi access, loyalty programs and fuel card services;
- making hotel bookings, including individual and corporate/group bookings, purchases or using our services;
- enrolling in and participating in our loyalty and rewards programs, including legacy programs and partner programs such as Wyndham Rewards;
- using EV charging services, including initiating and completing charging sessions;
- using fuel card services, including account management, transactions and billing;
- receiving, accessing or redeeming personalized offers, promotions and vouchers;
- contacting our customer service teams or interacting with us via email, phone or social media;
- participating in surveys, promotions, prize draws, games rooms or customer feedback activities;
- interacting with our marketing communications, including newsletters and promotional messaging;
- visiting our sites where CCTV, vehicle monitoring or similar security systems are in operation; and
- interacting with our websites or services through cookies and similar technologies.
III. Sources of personal data
Quick guide
Here you can see where personal data comes from: directly from you, automatically through services, from trusted third parties and, where relevant, from public sources.
We collect personal data:
- directly from you, when you visit our premises, make a purchase or booking, sign up to newsletters or loyalty programs, contact us, or otherwise interact with our services;
- automatically when you use our services, including through our websites, apps, Wi-Fi services and EV charging infrastructure;
- from third parties, including booking platforms, EV charging providers, Wi-Fi providers, survey providers, parking providers and other Applegreen Group companies; and
- from publicly available sources, where relevant.
IV. How we use your personal data
Quick guide
This is the core section of the notice. It introduces the data categories we process and explains the main processing activities, purposes and lawful bases.
We use your personal data depending on how you interact with us. The categories below are the standard category names used in the processing activity tables in this section.
A. Categories of personal data we process
Category of personal data
Account and membership data
Customer account IDs, usernames, account identifiers, authentication data, login details, account status, linked services, membership IDs, program participation, linked users, and other account administration details
Address information
Billing, correspondence, postal and service addresses, including address details used for account administration, bookings, billing, delivery of services, or communications
Adult gaming access and alert data
Access alerts, attendance indicators, age-verification outcomes, self-exclusion indicators, access-control records and staff intervention alerts relating to adult gaming areas
Aggregated or de-identified insights
Aggregated, anonymized, pseudonymized or de-identified outputs, analytics and reports derived from personal data, including customer trends, usage insights and business planning information
Billing and payment information
Billing details, invoices, payment history, transaction records, bank or payment details, refunds, financial records, VAT information where applicable, and other payment administration data
Biometric and facial pattern data
Facial image data, facial pattern data, biometric templates or video-derived facial data used for age estimation, access control, limited identification, demographic estimation, visitor analytics or responsible gambling controls where applicable
Booking and stay information
Booking dates and times, booking source or channel, booking status, hotel ID and name, check-in and check-out dates, stay history, visit history, last visit date and location, and related hotel service details
Business information
Company name, business details, VAT information and other information used to verify eligibility, manage corporate or business accounts and administer business services
Charging and session data
EV charging session details, including charger ID, site location, charging start and end time, energy consumption, total cost, service usage and charging records
Communication and correspondence data
Emails, phone calls, social media messages, online form submissions, support communications, inquiry content, complaint correspondence, response records and customer service interactions
Complaint, investigation and outcome data
Complaint details, investigation notes, suspicious activity flags, internal notes, evidence, resolution records, outcome records, control records and dispute-related information
Contact details
Email address, mobile or telephone number, postal address and other contact information used to communicate with you about accounts, bookings, services, support, marketing or legal requests
Cookie and online identifiers
Cookie IDs, IP addresses, online identifiers, device/browser identifiers, consent management identifiers and similar technologies used on websites, apps and digital platforms
CCTV and video footage
CCTV footage, video recordings, video-derived data and imagery captured at sites, including footage of individuals, vehicles, incidents, site activity and security events
Demographic and profile data
Date of birth, approximate age range, broad gender categories, postcode, travel reason, customer profile information, stay preferences, interests and other profile information provided or estimated where applicable
Device and technical information
Device type, operating system, browser type and version, app or website log data, login timestamps, technical usage data, IP address, page response times, account security data and troubleshooting information
Feedback and survey data
Survey responses, customer comments, ratings, sentiment, satisfaction scores, NPS data, review data, service-specific feedback and survey participation information
Fuel card and account data
Fuel card number, fuel card account status, linked users, authorized user details, fuel card usage records and related account management information
Gaming session and intervention data
Session-level gaming machine data, duration and usage patterns, on-site observational data, intervention records and responsible gambling monitoring records
Identity information
First name, last name, surname, title, customer ID, account ID, identity details and other identifiers used to recognize, verify or administer customer relationships
Incident and security data
Security monitoring data, fraud-related data, risk flags, incident records, unauthorized activity records, evidence, misuse indicators and security investigation information
Location and movement data
Site location, redemption location, EV charger location, location-based app data, entry and exit times, vehicle movement data, heat mapping data and movement or attendance information
Loyalty and rewards data
Points, balances, tier level, benefits, reward activity, loyalty status, membership details, loyalty program participation and partner program data, including legacy and partner schemes
Marketing and advertising data
Marketing opt-ins and opt-outs, campaign interactions, advertising interaction data, email opens and clicks, push notification preferences, SMS preferences and marketing engagement information
Preferences and consent data
Communication preferences, cookie choices, consent records, saved settings, app preferences, opt-ins, opt-outs, interests and engagement preferences
Promotion, voucher and redemption data
Promotion IDs, voucher issuance and redemption records, voucher values, items purchased, offer eligibility, redemption date/time/location and campaign engagement data
Request and verification data
Privacy request details, type and scope of requests, proof of identity documentation, verification documentation and records needed to respond to legal or data subject rights requests
Service-related and contextual data
Information about the service you used or contacted us about, including booking, EV charging, hotel, fuel card, Wi-Fi, account, support and contextual details needed to provide or improve services
Transaction and usage data
Purchases, stays, visits, service use, booking activity, charging sessions, fuel purchases, transaction date/time/location, spend, voucher redemptions, account activity, app use and operational usage records
Vehicle information
Vehicle registration numbers, vehicle type, make, model, year, vehicle usage patterns, fuel usage patterns and vehicle-related records linked to EV charging, fuel cards, parking, access or site security
Wi-Fi and access data
Wi-Fi login details, access details, basic session data, connectivity records and technical access data required to provide and secure internet access and other on-site services
B. Processing activities
1. Digital interactions
Quick guide
Covers websites, cookies, app and digital platforms - including analytics, functionality, security and online preferences.
1.1 When you visit our website
When you visit our website, we automatically collect certain information about your device and browsing activity to ensure the website functions properly, remains secure, and provides an optimal user experience.
Personal data category
Device and technical information
Website security, fraud prevention, and basic functionality
Legitimate interests
Personal data category: Device and technical information
Purpose of processing: Website security, fraud prevention and basic functionality
Lawful basis: Legitimate interests
Personal data category: Device and technical information
Purpose of processing: Ensure compatibility and optimise website performance
Lawful basis: Legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Analyse website usage and improve content and structure
Lawful basis: Legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Maintain logs, troubleshoot issues and ensure system integrity
Lawful basis: Legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Improve usability and user experience
Lawful basis: Legitimate interests
1.2 Cookies and tracking technologies
We use cookies and similar technologies on our website and applications to enhance your browsing experience, analyze traffic, support functionality and, where applicable, marketing activities.
Personal data category: Cookie and online identifiers
Purpose of processing: Enable essential website functionality
Lawful basis: Legitimate interests
Personal data category: Preferences and consent data
Purpose of processing: Record and manage your cookie choices
Lawful basis: Legal obligation
Personal data category: Aggregated or de-identified insights
Purpose of processing: Analyse traffic and improve website performance
Lawful basis: Consent (for non-essential cookies); legitimate interests (for essential cookies)
Personal data category: Marketing and advertising data
Purpose of processing: Deliver and measure advertising effectiveness (where applicable)
Lawful basis: Consent (UK/EEA); applicable law (US jurisdictions)
Personal data category: Device and technical information
Purpose of processing: Ensure proper functioning and security of digital services
Lawful basis: Legitimate interests
1.3 When you use our apps or digital platforms
When you use our mobile applications or other digital platforms, such as EV charging apps or customer accounts, we collect and process personal data to provide functionality, manage your account and support service delivery.
Personal data category: Account and membership data
Purpose of processing: Create and manage your account
Lawful basis: Performance of a contract
Personal data category: Contact details
Purpose of processing: Communicate with you about services or support
Lawful basis: Performance of a contract
Personal data category: Transaction and usage data
Purpose of processing: Monitor performance and improve functionality
Lawful basis: Legitimate interests
Personal data category: Device and technical information
Purpose of processing: Ensure compatibility, security and troubleshooting
Lawful basis: Legitimate interests
Personal data category: Location and movement data
Purpose of processing: Provide location-based services (e.g. nearby EV chargers)
Lawful basis: Performance of a contract; consent (where required)
Personal data category: Preferences and consent data
Purpose of processing: Personalise your experience and remember choices
Lawful basis: Legitimate interests; consent (where applicable)
1.4 Social media links
Our websites may include social media links to our official social media channels, including LinkedIn, Instagram and Facebook.
These are links to third-party platforms. They do not, by themselves, mean that we collect personal data from those platforms while you are browsing our website. If you click a social media link, you will leave our website and be directed to the relevant third-party platform.
When you visit or interact with our social media pages or content on those platforms, the relevant platform may collect and use personal data about you in accordance with its own privacy notice, cookie policy and account settings. This may include information about your account, device, browser and interactions with our page or content.
We do not control how these third-party platforms process your personal data. We encourage you to review their privacy notices before interacting with them:
· Facebook / Meta Privacy Policy
Where you interact with us through our social media pages, for example by sending us a message, commenting on our posts, liking or sharing our content, tagging us or mentioning us, we may process information relating to that interaction to respond to you, manage our social media presence, understand engagement with our content, and protect our rights and reputation.
Personal data category: Social media interaction data; Communication and correspondence data
Purpose of processing: Manage and respond to comments, messages, tags, mentions or enquiries through our social media pages
Lawful basis: Legitimate interests; performance of a contract where the enquiry relates to a service
Personal data category: Social media interaction data
Purpose of processing: Manage our social media presence and understand engagement with our pages and content
Lawful basis: Legitimate interests
Personal data category: Communication and correspondence data; Complaint, investigation and outcome data
Purpose of processing: Investigate and respond to complaints, issues or service-related concerns raised through social media
Lawful basis: Legitimate interests
Personal data category: Aggregated or de-identified insights
Purpose of processing: Review platform-provided aggregated insights about engagement with our social media content and improve our communications
Lawful basis: Legitimate interests
2. Creating and managing your account and loyalty programs
Quick guide
Explains how we set up and manage accounts, authenticate users, administer memberships and operate loyatly and rewards schemes.
2.1 Creating and managing your account
When you create and use an account across our services, including EV charging, Wi-Fi, hotels or other digital services, we process personal data to set up your account, provide access to services and manage your ongoing relationship with us.
Personal data category: Social media interaction data; Communication and correspondence data
Purpose of processing: Manage and respond to comments, messages, tags, mentions or enquiries through our social media pages
Lawful basis: Legitimate interests; performance of a contract where the enquiry relates to a service
Personal data category: Social media interaction data
Purpose of processing: Manage our social media presence and understand engagement with our pages and content
Lawful basis: Legitimate interests
Personal data category: Communication and correspondence data; Complaint, investigation and outcome data
Purpose of processing: Investigate and respond to complaints, issues or service-related concerns raised through social media
Lawful basis: Legitimate interests
Personal data category: Aggregated or de-identified insights
Purpose of processing: Review platform-provided aggregated insights about engagement with our social media content and improve our communications
Lawful basis: Legitimate interests
2.2 Loyalty programs and rewards schemes
When you enroll in and participate in our loyalty or rewards programs, including legacy programs and partner programs such as Wyndham Rewards, we process personal data to administer your membership, provide benefits and enhance your experience.
Personal data category: Identity information; Contact details
Purpose of processing: Register and administer your loyalty membership
Lawful basis: Performance of a contract
Personal data category: Account and membership data
Purpose of processing: Manage your participation in the programme
Lawful basis: Performance of a contract
Personal data category: Transaction and usage data
Purpose of processing: Track purchases, stays and engagement
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Loyalty and rewards data
Purpose of processing: Allocate points, rewards and benefits
Lawful basis: Performance of a contract
Personal data category: Preferences and consent data; Marketing and advertising data
Purpose of processing: Personalise offers and improve programme experience
Lawful basis: Legitimate interests
Personal data category: Marketing and advertising data
Purpose of processing: Send relevant communications and manage opt-ins and opt-outs
Lawful basis: Consent; legitimate interests (where permitted)
Personal data category: Aggregated or de-identified insights
Purpose of processing: Analyse programme performance and customer engagement
Lawful basis: Legitimate interests
3. Core business services
Quick guide
Covers the services customers use most often, including fast charging, hotels on-site amenities, fuel cards, marketing offers, and surveys.
This section explains how we process personal data when you use our core services, including Fast Charge services, hotel services, amenities and fuel card services.
3.1 Fast Charge services
When you use Applegreen Fast Charge or other EV charging services, we process personal data to provide charging functionality, manage your account, process transactions and operate the service efficiently.
Personal data category: Identity information; Account and membership data
Purpose of processing: Create and manage your EV charging account
Lawful basis: Performance of a contract
Personal data category: Contact details
Purpose of processing: Communicate with you regarding your account, charging sessions and support
Lawful basis: Performance of a contract
Personal data category: Charging and session data
Purpose of processing: Deliver charging services and maintain usage records
Lawful basis: Performance of a contract
Personal data category: Billing and payment information
Purpose of processing: Process payments and manage financial transactions
Lawful basis: Performance of a contract
Personal data category: Vehicle information
Purpose of processing: Associate charging sessions with vehicles and ensure service functionality
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Location and movement data
Purpose of processing: Enable charging services and location-based features (e.g. nearby chargers)
Lawful basis: Performance of a contract; consent (where applicable)
Personal data category: Device and technical information; Transaction and usage data
Purpose of processing: Maintain, troubleshoot and improve service performance
Lawful basis: Legitimate interests
Personal data category: Preferences and consent data
Purpose of processing: Manage communication preferences and marketing choices
Lawful basis: Consent; legitimate interests (where permitted)
3.2 Hotels (bookings, stays and related services)
When you make a booking, stay at one of our hotels, including walk-ins and group bookings, or interact with our hotel services, we process personal data to manage your reservation, provide your stay and support service delivery and operations.
Personal data category: Identity information; Contact details
Purpose of processing: Create and manage bookings and customer records
Lawful basis: Performance of a contract
Personal data category: Booking and stay information
Purpose of processing: Manage reservations, stays and operational delivery
Lawful basis: Performance of a contract
Personal data category: Billing and payment information
Purpose of processing: Process payments, refunds and financial records
Lawful basis: Performance of a contract
Personal data category: Request and verification data
Purpose of processing: Verify identity and comply with legal requirements (where applicable)
Lawful basis: Legal obligation; performance of a contract
Personal data category: Preferences and consent data
Purpose of processing: Personalise your stay and improve service experience
Lawful basis: Legitimate interests
Personal data category: Communication and correspondence data
Purpose of processing: Provide customer support and respond to enquiries
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Account and membership data
Purpose of processing: Manage participation in loyalty programmes and allocate rewards
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Marketing and advertising data
Purpose of processing: Manage opt-ins and opt-outs and deliver marketing communications
Lawful basis: Consent; legitimate interests (where permitted)
Personal data category: Booking and stay information; Aggregated or de-identified insights
Purpose of processing: Analyse trends, improve services and support business operations
Lawful basis: Legitimate interests
3.3 Amenities and on-site services
When you use our on-site amenities and services, such as Wi-Fi, feedback surveys, games rooms or newsletter sign-ups, we process personal data to provide access to services, understand customer needs and improve your experience.
Personal data category: Identity information; Contact details
Purpose of processing: Provide access to amenities (e.g. Wi-Fi), manage registrations, and enable follow-up where required
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Wi-Fi and access data; Device and technical information
Purpose of processing: Enable and manage internet access, ensure network security, and maintain service functionality
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Demographic and profile data
Purpose of processing: Understand customer profiles and improve services and offerings
Lawful basis: Legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Analyse customer behaviour and improve site experience and operations
Lawful basis: Legitimate interests
Personal data category: Feedback and survey data
Purpose of processing: Collect customer feedback, measure satisfaction (e.g. NPS), and improve services
Lawful basis: Legitimate interests
Personal data category: Service-related and contextual data; Feedback and survey data
Purpose of processing: Understand usage of specific services and improve offerings (e.g. EV infrastructure)
Lawful basis: Legitimate interests
Personal data category: Marketing and advertising data
Purpose of processing: Record and manage consent for communications and marketing
Lawful basis: Legal obligation; consent
Personal data category: Marketing and advertising data
Purpose of processing: Send marketing communications where you have opted in or where permitted by law
Lawful basis: Consent; legitimate interests (soft opt-in, where applicable)
Personal data category: Aggregated or de-identified insights
Purpose of processing: Perform analytics and improve customer experience and service delivery
Lawful basis: Legitimate interests
3.4 Fuel card services
When you apply for, use or manage a fuel card with us, we process personal data to provide fuel card services, manage accounts, process transactions and ensure secure and compliant operation of the service.
Personal data category: Identity information; Contact details
Purpose of processing: Onboard customers and create fuel card accounts
Lawful basis: Performance of a contract
Personal data category: Business information
Purpose of processing: Verify eligibility and manage business accounts
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Account and membership data
Purpose of processing: Issue and manage fuel cards and associated accounts
Lawful basis: Performance of a contract
Personal data category: Transaction and usage data
Purpose of processing: Record fuel purchases and monitor usage
Lawful basis: Performance of a contract
Personal data category: Billing and payment information
Purpose of processing: Process payments and manage invoicing and financial records
Lawful basis: Performance of a contract
Personal data category: Transaction and usage data
Purpose of processing: Associate transactions with vehicles and monitor usage
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Incident and security data
Purpose of processing: Detect and prevent fraud, misuse and unauthorised transactions
Lawful basis: Legitimate interests; legal obligation
Personal data category: Communication and correspondence data
Purpose of processing: Provide customer support and resolve issues
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Marketing and advertising data
Purpose of processing: Manage communication preferences and send marketing communications
Lawful basis: Consent; legitimate interests (where permitted)
Personal data category: Transaction and usage data; Aggregated or de-identified insights
Purpose of processing: Analyse usage, improve services and support business operations
Lawful basis: Legitimate interests
3.5 Marketing communications
We use your personal data to send marketing communications about our products, services, offers and updates, where you have chosen to receive them or where permitted by law.
Personal data category: Contact details
Purpose of processing: Send marketing communications and updates
Lawful basis: Consent; legitimate interests (soft opt-in where applicable)
Personal data category: Marketing and advertising data
Purpose of processing: Record and manage consent and communication choices
Lawful basis: Legal obligation; consent
Personal data category: Identity information
Purpose of processing: Personalise communications (e.g. addressing you by name)
Lawful basis: Legitimate interests
Personal data category: Marketing and advertising data
Purpose of processing: Measure campaign effectiveness and improve communications
Lawful basis: Legitimate interests
3.6 Personalized offers and promotions
We use personal data to provide tailored offers, promotions and vouchers, and to manage their issuance and redemption.
Personal data category: Identity information; Account and membership data
Purpose of processing: Identify you and link offers to your account
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Determine eligibility for offers and personalise promotions
Lawful basis: Legitimate interests
Personal data category: Promotion, voucher and redemption data
Purpose of processing: Issue, manage and track promotions and vouchers
Lawful basis: Performance of a contract
Personal data category: Location and movement data
Purpose of processing: Validate and process voucher redemption
Lawful basis: Performance of a contract
Personal data category: Marketing and advertising data; Promotion, voucher and redemption data
Purpose of processing: Analyse engagement with offers and improve campaigns
Lawful basis: Legitimate interests
Personal data category: Marketing and advertising data
Purpose of processing: Ensure offers are sent in line with your choices
Lawful basis: Consent; legitimate interests (where permitted)
3.7 Customer surveys and feedback
We use personal data to collect feedback and understand customer experience, including through surveys, reviews and satisfaction metrics.
4. Customer support, inquiries and complaints
Quick guide
Explains how we handle support contacts, general enquiries, complaints and privacy rights requests.
This section explains how we process personal data when you contact us, request support, submit a complaint or exercise your privacy rights.
4.1 Customer support and general inquiries
When you contact us for support or with general inquiries, for example by email, phone, social media or online forms, we process personal data to respond to your request and provide assistance.
Personal data category: Identity information; Contact details
Purpose of processing: Identify you and respond to your enquiry
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Communication and correspondence data
Purpose of processing: Manage and respond to support requests
Lawful basis: Legitimate interests
Personal data category: Service-related and contextual data
Purpose of processing: Investigate and resolve issues relating to our services
Lawful basis: Performance of a contract; legitimate interests
Personal data category: Account and membership data
Purpose of processing: Provide accurate and tailored support
Lawful basis: Legitimate interests
4.2 Complaints handling
When you submit a complaint, we process personal data to investigate the matter, respond appropriately and maintain records for compliance and quality assurance purposes.
Personal data category: Identity information; Contact details
Purpose of processing: Identify you and manage the complaint
Lawful basis: Legitimate interests
Personal data category: Communication and correspondence data
Purpose of processing: Investigate and respond to complaints
Lawful basis: Legitimate interests
Personal data category: Service-related and contextual data; Transaction and usage data
Purpose of processing: Understand the circumstances of the complaint
Lawful basis: Legitimate interests
Personal data category: Complaint, investigation and outcome data
Purpose of processing: Maintain records and improve services
Lawful basis: Legitimate interests
4.3 Privacy requests
When you exercise your rights under data protection law, such as requesting access to your personal data or asking for it to be corrected or deleted, we process personal data to handle and respond to your request.
Personal data category: Identity information; Contact details
Purpose of processing: Identify you and communicate regarding your request
Lawful basis: Legal obligation
Personal data category: Request and verification data
Purpose of processing: Process and fulfil your data subject rights request
Lawful basis: Legal obligation
Personal data category: Request and verification data
Purpose of processing: Confirm your identity before processing the request
Lawful basis: Legal obligation
Personal data category: Communication and correspondence data
Purpose of processing: Maintain records of requests and responses for compliance
Lawful basis: Legal obligation
5. Physical environment and security
Quick guide
Describes how we keep our locations secure through CCTV, vehicle monitoring and certain analytics tools used to improve safety and operations.
This section explains how we process personal data to ensure the safety and security of customers, employees, sites and services, including through CCTV, vehicle monitoring and advanced monitoring technologies at certain locations.
5.1 CCTV and security monitoring
When you visit our sites, we may use CCTV systems to monitor and record activity for safety, security and operational purposes.
Personal data category: CCTV and video footage
Purpose of processing: Ensure safety and security of customers, staff and property
Lawful basis: Legitimate interests
Personal data category: CCTV and video footage
Purpose of processing: Prevent and detect crime and anti-social behaviour
Lawful basis: Legitimate interests
Personal data category: CCTV and video footage; Incident and security data
Purpose of processing: Investigate incidents and support law enforcement
Lawful basis: Legal obligation; legitimate interests
Personal data category: Vehicle information
Purpose of processing: Monitor site usage and investigate incidents
Lawful basis: Legitimate interests
5.2 Vehicle monitoring
At certain locations, we may monitor vehicle movements, including ANPR where applicable, to manage site access, prevent misuse such as unauthorized parking, and support security.
Personal data category: Vehicle information
Purpose of processing: Manage site access and prevent misuse
Lawful basis: Legitimate interests
Personal data category: Vehicle information
Purpose of processing: Monitor site usage and operational efficiency
Lawful basis: Legitimate interests
Personal data category: Vehicle information; Incident and security data
Purpose of processing: Investigate incidents and support enforcement actions
Lawful basis: Legitimate interests; legal obligation
5.3 Advanced analytics technologies
At selected sites, we may use advanced technologies, including facial recognition, demographic estimation and heat mapping, to analyze visitor patterns and improve site operations and customer experience. These technologies are primarily used to generate aggregated statistical insights. Where possible, processing is carried out using anonymized or pseudonymized data, and data is often processed locally to minimize retention of personal data.
Personal data category: CCTV and video footage
Purpose of processing: Count visitors and distinguish between new and returning visits
Lawful basis: Legitimate interests
Personal data category: Biometric and facial pattern data; Aggregated or de-identified insights
Purpose of processing: Generate visitor statistics and insights
Lawful basis: Legitimate interests
Personal data category: Demographic and profile data
Purpose of processing: Understand customer trends and improve site layout and services
Lawful basis: Legitimate interests
Personal data category: Location and movement data
Purpose of processing: Analyse how visitors move around sites to improve layout and operations
Lawful basis: Legitimate interests
Additional safeguards: Facial data is transformed where appropriate, such as being blurred, masked or converted into templates, to reduce identifiability. Data is not used to identify individuals for marketing purposes. Outputs are typically aggregated and not linked to identifiable individuals. You may object to this type of processing at any time by contacting us.
6. Adult gaming areas and responsible gaming controls
Quick guide
Explains age checks, self-excursion controls, and responsible gambling interventions used in the adult gaming areas at relevant locations.
At certain Welcome Break locations, we operate adult gaming areas. We process personal data in these environments to ensure compliance with legal obligations, protect customers and promote responsible gambling.
6.1 Age verification and access control
We use facial recognition technology in adult gaming areas to help ensure that only individuals aged 18 or over access these areas.
Personal data category: Biometric and facial pattern data
Purpose of processing: Estimate age to prevent access by individuals under 18
Lawful basis: Legal obligation; legitimate interests
Personal data category: Biometric and facial pattern data
Purpose of processing: Identify individuals who may require intervention (e.g. self-excluded individuals or known risks)
Lawful basis: Legal obligation; substantial public interest (where applicable)
Personal data category: Adult gaming access and alert data
Purpose of processing: Notify staff to take appropriate action (e.g. deny entry)
Lawful basis: Legal obligation; legitimate interests
Important information: facial images are analyzed in real time and are not retained for general age estimation purposes. Processing is limited to short-term analysis to determine access eligibility. Data is not used for marketing or unrelated purposes.
6.2 Self-exclusion and intervention measures
To comply with our obligations under the Gambling Commission Licence Conditions and Codes of Practice (LCCP), we implement controls to support individuals who have self-excluded or may require intervention.
Personal data category: Adult gaming access and alert data
Purpose of processing: Enforce self-exclusion requests and prevent access
Lawful basis: Legal obligation
Personal data category: Vehicle information
Purpose of processing: Identify when self-excluded individuals may be on site
Lawful basis: Legal obligation; legitimate interests
Personal data category: Vehicle information
Purpose of processing: Support enforcement of self-exclusion measures
Lawful basis: Legal obligation
Personal data category: Adult gaming access and alert data
Purpose of processing: Enable staff to intervene where required
Lawful basis: Legal obligation; legitimate interests
6.3 Responsible gambling monitoring and interventions
We may use limited data from gaming machines to support responsible gambling practices and identify when an intervention may be appropriate.
Personal data category: Gaming session and intervention data
Purpose of processing: Identify patterns indicating a need for intervention
Lawful basis: Legal obligation; legitimate interests
Personal data category: Gaming session and intervention data
Purpose of processing: Support real-time staff intervention
Lawful basis: Legal obligation
Personal data category: Gaming session and intervention data
Purpose of processing: Record that an intervention occurred (without linking to identifiable individuals where possible)
Lawful basis: Legal obligation; legitimate interests
Important safeguards: gaming machine session data is not linked to identifiable individuals on a continuous basis. Identification may only occur at the point of staff interaction, where necessary. We do not maintain records linking individuals to specific gaming sessions beyond what is required for compliance. Records focus on interventions rather than tracking individual behavior over time.
7. Operations, fraud prevention and compliance
Quick guide
Covers fraud prevention, legal compliance, internal controls, analytics and the administration needed to run the business responsibly.
This section explains how we process personal data to protect our business, customers and services, meet legal and regulatory obligations, and improve how we operate.
7.1 Fraud prevention and security
We may process personal data to help prevent, detect and investigate fraud, misuse, unauthorized activity or other behavior that could harm our customers, employees, services or business.
Personal data category: Identity information; Account and membership data
Purpose of processing: Verify customers and detect suspicious activity
Lawful basis: Legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Prevent, detect and investigate fraud, misuse or unauthorised activity
Lawful basis: Legitimate interests
Personal data category: Billing and payment information
Purpose of processing: Identify irregular or fraudulent transactions
Lawful basis: Legitimate interests; legal obligation
Personal data category: Device and technical information; Incident and security data
Purpose of processing: Protect our systems, websites, apps and customer accounts
Lawful basis: Legitimate interests
Personal data category: Vehicle information; Incident and security data
Purpose of processing: Investigate misuse of services or site-related incidents
Lawful basis: Legitimate interests
Personal data category: Complaint, investigation and outcome data
Purpose of processing: Support internal investigations and evidence gathering
Lawful basis: Legitimate interests; legal obligation
7.2 Legal and regulatory compliance
We may process personal data where necessary to comply with applicable laws, regulations, legal processes, industry requirements or requests from public authorities.
Personal data category: Identity information; Contact details
Purpose of processing: Respond to legal, regulatory or official requests
Lawful basis: Legal obligation
Personal data category: Transaction and usage data
Purpose of processing: Meet record-keeping, compliance and statutory obligations
Lawful basis: Legal obligation
Personal data category: Billing and payment information
Purpose of processing: Comply with financial, tax and audit requirements
Lawful basis: Legal obligation
Personal data category: Communication and correspondence data
Purpose of processing: Demonstrate compliance and handle regulatory enquiries
Lawful basis: Legal obligation
Personal data category: CCTV and video footage; Vehicle information; Incident and security data
Purpose of processing: Support investigations and legal or law enforcement requests
Lawful basis: Legal obligation; legitimate interests
Personal data category: Request and verification data
Purpose of processing: Meet identity verification and compliance requirements
Lawful basis: Legal obligation
7.3 Auditing, reporting and internal controls
We may use personal data for internal governance purposes, including auditing, quality assurance, financial control, risk management and business reporting.
Personal data category: Transaction and usage data
Purpose of processing: Maintain internal records and support audits
Lawful basis: Legitimate interests; legal obligation
Personal data category: Billing and payment information
Purpose of processing: Conduct internal financial reporting and controls
Lawful basis: Legal obligation; legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Monitor service delivery and business performance
Lawful basis: Legitimate interests
Personal data category: Complaint, investigation and outcome data
Purpose of processing: Review quality, controls and risk management processes
Lawful basis: Legitimate interests
Personal data category: Complaint, investigation and outcome data; Request and verification data
Purpose of processing: Evidence governance and accountability measures
Lawful basis: Legitimate interests; legal obligation
7.4 Analytics and service improvement
We may use personal data to understand how our customers use our services, identify trends, improve customer experience and develop or enhance our products, services and operations.
Personal data category: Transaction and usage data
Purpose of processing: Understand how customers use our services
Lawful basis: Legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Improve service delivery, performance and business processes
Lawful basis: Legitimate interests
Personal data category: Feedback and survey data
Purpose of processing: Improve customer experience and service quality
Lawful basis: Legitimate interests
Personal data category: Preferences and consent data; Marketing and advertising data
Purpose of processing: Tailor and refine services and customer journeys
Lawful basis: Legitimate interests
Personal data category: Aggregated or de-identified insights
Purpose of processing: Produce reports, identify trends and support business planning
Lawful basis: Legitimate interests
7.5 Business administration and corporate operations
We may process personal data as part of the day-to-day administration of our business, including record management, corporate governance, insurance, dispute handling and business continuity.
Personal data category: Identity information; Account and membership data
Purpose of processing: Maintain business records and administer customer relationships
Lawful basis: Legitimate interests
Personal data category: Transaction and usage data
Purpose of processing: Support governance, insurance and dispute resolution
Lawful basis: Legitimate interests
Personal data category: Communication and correspondence data
Purpose of processing: Manage claims, disputes and business continuity issues
Lawful basis: Legitimate interests; legal obligation
Personal data category: Service-related and contextual data
Purpose of processing: Support internal administration and corporate governance
Lawful basis: Legitimate interests
V. Who we share your data with
Quick guide
This section lists the types of recipients who may receive personal data, such as group companies, suppliers, partners, advisers, authorities and fraud prevention organisations.
We may share your personal data with third parties where necessary for the purposes described in this Privacy Notice. We only share personal data where there is a lawful basis to do so and appropriate safeguards are in place.
We may share your personal data with the following categories of recipients:
- Group companies: We may share your personal data within the Applegreen Group, including Welcome Break and other affiliated entities, where necessary for group operations, service delivery and internal administration.
- Service providers and data processors: We engage third-party service providers to support our business operations. These may include providers of IT systems and hosting, cloud services, customer relationship management (CRM) systems, payment processing, booking systems, loyalty program platforms, EV charging infrastructure, fuel card services, marketing and communications platforms, data analytics and survey tools. These providers process personal data on our behalf and are subject to contractual obligations to protect it.
- Payment and financial service providers: We may share personal data with banks, payment processors and other financial institutions to process transactions, manage payments and prevent fraud.
- Business partners: We may share personal data with partners involved in delivering services such as hotel bookings, loyalty and rewards programs, including partner programs such as Wyndham Rewards, EV charging services and promotions or campaigns.
- Marketing and advertising partners: Where permitted by law, we may share data with marketing agencies, advertising platforms and analytics providers to deliver and measure marketing campaigns and promotions, in accordance with your preferences.
- Professional advisers: We may share personal data with professional advisers such as lawyers, auditors, insurers and consultants where necessary for legal, compliance or business purposes.
- Regulators, authorities and law enforcement: We may share personal data with regulators, supervisory authorities, police, courts and law enforcement agencies where required to comply with legal obligations or respond to lawful requests.
- Fraud prevention and security organizations: We may share personal data with organizations that assist with fraud prevention, risk management and security monitoring.
- Third parties in connection with business transactions: If we are involved in a merger, acquisition, restructuring or sale of assets, personal data may be shared with relevant third parties, subject to appropriate safeguards.
We require all third parties to respect the security of your personal data and to process it in accordance with applicable data protection laws. Where third parties act as our processors, they are only permitted to process your personal data in accordance with our instructions.
VI. International transfers of personal data
Quick guide
Explains when personal data may be transferred internationally and the safeguards used to protect those transfers.
We are an international organization and may transfer, store or access your personal data outside the European Economic Area (EEA) and the United Kingdom. This includes transfers within the Applegreen Group, as well as to service providers and partners located in other countries, where necessary to support our services and global operations.
Where such transfers take place, they are carried out in accordance with applicable data protection laws, including where the destination country benefits from an adequacy decision or where appropriate safeguards and recognized transfer mechanisms are in place.
VII. How long we keep your personal data
Quick guide
This section explains our retention approach - we keep data only as long as needed for the purpose, legal requirements or legitimate business needs.
We will only keep your personal data for as long as it is necessary for the purposes for which it was collected, or to meet legal, regulatory or business requirements.
The length of time we retain personal data depends on the type of data and how it is used. In some cases, we may need to retain it for longer to comply with legal obligations, resolve disputes or protect our business.
Once personal data is no longer required, we will securely delete it or anonymize it so that it can no longer be used to identify you.
VIII. Your privacy rights
Quick guide
Here you can find the privacy rights available to individual and how those rights can be exercised in different jurisdictions
USA
Quick guide
Meet the organisations behind this notice.
This section explains which Applegreen Group company may act as controller and how to contact the relevant privacy team.
We operate in a number of U.S. states that have their own privacy laws, including Connecticut, Delaware, New Hampshire, New Jersey and Indiana.
This section applies to residents of those states. Your privacy rights may vary depending on the state in which you reside, and we will update this Privacy Notice as additional state privacy laws become applicable to our business.
Residents of the states listed above may have some or all of the following rights under applicable state privacy laws:
- the right to confirm whether we are processing your personally identifiable information (PII);
- the right to access your PII;
- the right to correct inaccuracies in your PII;
- the right to delete your PII, subject to certain exceptions;
- the right to obtain a copy of your PII in a portable format; and
- the right to opt out of the processing of your PII for targeted advertising or the sale of personal data.
We do not sell personally identifiable information.
You can exercise your rights by completing our privacy request web form here or by contacting us at dpo@applegreen.com. We may need to verify your identity before processing your request.
IX. Data security
Quick guide
Meet the organisations behind this notice.
This section explains which Applegreen Group company may act as controller and how to contact the relevant privacy team.
We take appropriate technical and organizational measures to protect your personal data.
These measures are designed to safeguard your personal data against accidental loss, unauthorized access, use, disclosure or alteration.
While we take security seriously, please note that no method of transmitting data over the internet or storing information electronically is completely secure. As a result, we cannot guarantee absolute security.
X. Changes to this privacy notice
Quick Guide
Meet the organisations behind this notice.
This section explains which Applegreen Group company may act as controller and how to contact the relevant privacy team.
We may update this Privacy Notice from time to time to reflect changes in our practices, services or legal requirements.
Any changes will be published on this page and, where appropriate, we will notify you. We encourage you to review this Privacy Notice periodically so that you remain informed about how we use your personal data.
XI. Contact us
If you have any questions, comments or concerns about this Privacy Notice or our data protection practices, you can contact us at: dpo@applegreen.com
UK and Northern Ireland
Quick guide
Explains the rights available under UK data protection law, including complaint handling, timelines and the right to contact the ICO.
Data protection law grants you a number of specific rights in respect of your personal data, in addition to the broad and general right to have your personal data protected.
·
Right to be informed about how your personal data will be processed. This enables you toreceive information about how we use your personal data. We have set thisinformation out in this Notice.
Request access to a copy of your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, usually free of charge, unless your request is clearly unfounded, repetitive or excessive. We may also refuse to comply with your request in these circumstances.
Under the Data Use and Access Act (DUAA), we can “stop the clock” on our response time if we need more information from you to handle your request. The deadline restarts once we have that information. We are required to make searches that are reasonable and proportionate when responding to UK subject access requests.
·
Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal data (commonly known as the “right to be forgotten”). This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.
Object to processing of your personal data where we are relying on the lawful basis of our legitimate interests, or those of a third party, to process your personal data. You also have the right to object where we are processing your personal data for direct marketing purposes on the basis of our legitimate interests.
Right to withdraw your consent. Where we rely on your consent to process your personal data, you have the right to withdraw your consent to such processing. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it, or while we are considering an objection you have made.
Request your personal information in a format that makes it easier to reuse your information in another context, and request the transfer of your personal data to another party, if technically feasible.
Not to be subject to a decision solely based on automated processing. We do not anticipate making decisions about you based solely on automated decision-making where that decision would have a significant impact on you. If we ever make a decision about you automatically by a computer or an algorithm without human intervention, you can ask us to have that decision reviewed by a human.
Where UK law applies, the DUAA allows organizations to make decisions based solely on automated processing in a wider range of circumstances. If we ever make a decision about you using automated processing that has a legal or similarly significant effect, we will provide information about that decision, give you the opportunity to make representations or challenge it, and allow you to request human review.
If you want to exercise any of the rights set out above, please contact us using the form :here
We try to respond to all legitimate requests within one month. Occasionally it could take longer than a month if your request is particularly complex or youhave made a number of requests. In this case, we will notify you and keep you updated.
·
Right to complain: we encourage you to contact us first if you have any complaintsabout the way we handle your personal data via our complaint form: (here).
In accordance with applicable data protection requirements of DUAA, you should raise your complaint with us in the first instance. We will investigate your complaint and make every reasonable effort to resolve it promptly and put things right.
Complaints: If, after receiving our final response, you remain dissatisfied with how we have handled your complaint or your personal data, you have the right to lodge a complaint with the supervisory authority for your country.
United Kingdom ICO: icocasework@ico.org.uk; 0303 123 1113; Customer Contact, Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom; www.ico.org.uk.
If you are based outside the UK, you have the right to lodge your complaint with the relevant data protection regulator in your country of residence.
Ireland
Quick guide
Lists the rights available under Irish and EU data protection law, including access, correction, erasure, objection and complaint options.
Data protection law grants you a number of specific rights in respect of your personal data, in addition to the broad and general right to have your personal data protected.
Right to be informed about how your personal data will be processed: This enables you to receive information about how we use your personal data. We have set this information out in this Notice Request access to a copy of your personal data (commonly known as a “data subject access request”): This enables you to receive a copy of the personal data we hold about you, usually free of charge, unless your request is clearly unfounded, repetitive or excessive. We may also refuse to comply with your request in these circumstances.
Request correction of the personal data that we hold about you: This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal data (commonly known as the “right to be forgotten”): This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing.
Object to processing of your personal data where we are relying on the lawful basis of our legitimate interests, or those of a third party, to process your personal data. You also have the right to object where we are processing your personal data for direct marketing purposes on the basis of our legitimate interests.
Right to withdraw your consent: Where we rely on your consent to process your personal data, you have the right to withdraw your consent to such processing. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Request the restriction of processing of your personal data: This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it, or while we are considering an objection you have made.
Request your personal information in a format that makes it easier to reuse your information in another context, and request the transfer of your personal data to another party, if technically feasible.
Not to be subject to a decision solely based on automated processing. We do not anticipate making decisions about you based solely on automated decision-making where that decision would have a significant impact on you. If we ever make a decision about you automatically by a computer or an algorithm without human intervention, you can ask us to have that decision reviewed by a human.
We encourage you to contact us at dpo@applegreen.com first if you have any concerns about how we use your personal data, and we will do our best to resolve the issue. If you want to exercise your privacy rights, please fill in the form here: (here).
You also have the right to lodge a complaint with the Irish Data Protection Commission (DPC).
Office: Dublin Office
Address: Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland
Office: Portarlington Office
Address: Canal House, Station Road, Portarlington, R32 AP23, Co. Laois, Ireland
Email address: Data Protection Commission
Website: https://www.dataprotection.ie/
If you are not resident in the Republic of Ireland, you can submit a complaint before your local data protection supervisory authority.
You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is manifestly unfounded or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
The statutory period under the EU General Data Protection Regulationfor us to reply to a legitimate request is one month. That period may beextended by two further months where necessary, taking into account thecomplexity and number of the requests.
Please note that we may request that you provide some details necessary to verify your identity when you request to exercise a legal right regarding your personal data.
App
Quick guide
We provide functionality within our App to allow you to delete your account, which you can do by following these instructions:
- Step 1 & 2: From the App home page, go to the menu and tap My Account > Profile.
- Step 3: Scroll down to the bottom of the Profile page and tap Delete My Account.
- Step 4: In the popup that appears, tap Delete my account.
- Step 5: A representative will receive the request and delete your account, including references to all historical activities after which, all historical transactions will be anonymised. You will receive an email confirming the deletion of your account.
9
%201.svg)
Copyright © 2026 Applegreen Fast Charge. All rights reserved.