1. Purpose

Traffic Logix is committed to protecting the privacy, security, and integrity of Automated License Plate Recognition (ALPR) information collected, stored, processed, maintained, or accessed through Logix on Cloud and related Traffic Logix systems.

This policy governs the collection, use, access, maintenance, sharing, transfer, retention, and destruction of ALPR information by Traffic Logix, LLC, a subsidiary of Traffic and Parking Control Co., LLC (“Traffic Logix”) in its capacity as the operator of Logix on Cloud. It is intended to ensure that ALPR information is handled consistently with applicable privacy and civil-liberties protections and is publicly available as the operator’s ALPR usage and privacy policy.

2. Scope

This policy applies to Traffic Logix employees, independent contractors, service providers, customer administrators, customer users, support personnel, and any other person authorized to access the ALPR system or ALPR information.

This policy applies to ALPR information maintained in or processed through Traffic Logix systems, including:

• license plate images and characters
• vehicle and contextual images
• date and time information
• location information
• search criteria and search results
• system and activity logs
• exports, reports, and related metadata

 

This policy applies only to ALPR information maintained in or processed through Logix on Cloud. It does not apply to SmartHub, ATS ParkingCloud, ATS TraffiCloud, or another platform unless that platform is expressly added to this policy following legal, privacy, security, and technical review

3. Definitions

ALPR Information: Information or data collected through the use of an ALPR system.

ALPR Operator: A person that operates an ALPR system, as defined by applicable law.

ALPR System: A searchable computerized database resulting from one or more mobile or fixed cameras combined with algorithms that read and convert registration plate images and characters into computer-readable data.

Authorized User: A person granted access to the ALPR system or ALPR information for an approved purpose and within assigned permissions.

Customer: The organization that contracts for or administers use of Logix on Cloud and associated ALPR capabilities.

Access : refers to viewing, searching, querying, retrieving, generating a report from, exporting, downloading, modifying, disclosing, or otherwise interacting with ALPR information.

Authorized Purpose: refers to a purpose expressly identified in Section 4 and permitted by applicable law, the applicable customer agreement, and the user’s assigned role.

ALPR End-User: refers to a person or entity that accesses or uses an ALPR system or ALPR information and is subject to the requirements applicable to an ALPR end-user.

Service Provider: refers to a person or entity authorized to process or store ALPR information solely on behalf of the Operator under a written agreement imposing applicable use, confidentiality, security, retention, deletion, incident-notification, and audit obligations.

4. Authorized Purposes

ALPR information may be collected, accessed, maintained, or used only for an Authorized Purpose and only to the extent reasonably necessary and proportionate to that purpose. Authorized Purposes are limited to:

1. providing customer-requested operation, configuration, diagnostics, troubleshooting, maintenance, and technical support;
2. maintaining the availability, integrity, security, and proper functioning of Logix on Cloud;
3. detecting, investigating, documenting, and responding to suspected unauthorized access, misuse, security incidents, or policy violations;
4. conducting authorized audits, compliance reviews, retention activities, and access reviews;
5. responding to valid legal process or satisfying another applicable legal obligation after review by authorized Legal personnel; and
6. performing another customer-directed activity only if Legal or Compliance has documented that the activity is permitted by applicable law, within the applicable agreement, disclosed by this policy where required, and consistent with the user’s assigned permissions.

ALPR information shall not be accessed or used for personal purposes, curiosity, harassment, discrimination, immigration enforcement except where expressly required or permitted by applicable law, surveillance unrelated to an Authorized Purpose, or any purpose outside the applicable customer environment and assigned role.

Production ALPR information shall not be used to train or improve an OCR or other machine-learning model unless, before that use begins, Legal and Privacy have approved the legal and contractual authority, required notice, purpose limitation, data minimization, de-identification or aggregation where appropriate, access restrictions, training-data retention, deletion procedures, model-governance controls, and any necessary amendment to this policy.

5. Authorized Users, Roles, and Account Management

Access to ALPR information shall be granted only to an individually identified Authorized User who has a documented business need, has completed required training, has received appropriate approval, and has been assigned least-privilege permissions. Shared user credentials are prohibited. Access shall be reviewed periodically and modified or revoked promptly when no longer required, including following a change in role, termination of employment or engagement, expiration of contractual need, or identification of misuse.

Role	Intended Access	Status
Administrator	Full platform administration, including user administration and configuration.	Validate precise privileges
User	Operational functions within the customer environment, excluding designated administrative functions.	Validate precise privileges
Reporter	Read-only access to authorized information and reports.	Validate precise privileges

Authorized personnel of Traffic Logix, and personnel of an approved affiliate only where the affiliate’s access has been documented and subjected to the same authorization, training, confidentiality, logging, security, and oversight requirements.

Engineering personnel shall not have routine access to production ALPR information. Any exceptional Engineering access must be time-limited, specifically approved, associated with a documented support, security, or incident record, and recorded as required by Section 8.

Logix on Cloud accounts are protected by strong password controls.

• Corporate multi-factor authentication protects Traffic Logix personnel access to the internal corporate environment.
• For Logix on Cloud accounts, two-factor authentication is available but is not enabled automatically; each customer determines whether to enable it for its users.

6. Training and Acceptable Use

Before receiving access to production ALPR information, each employee and independent contractor must complete documented, role-appropriate training addressing authorized and prohibited uses, privacy and civil liberties, confidentiality, data minimization, credential security, event-level access-record requirements, information sharing, legal process, data accuracy, correction, retention, destruction, and incident reporting. Training shall address:

• authorized and prohibited uses of ALPR information
• privacy, civil liberties, confidentiality, and data minimization
• account security, role-based access, and credential protection
• audit logging and documentation of the purpose of access
• information sharing and legal process
• incident recognition, reporting, escalation, and response
• data accuracy, human verification, error correction, retention, and destruction

ALPR-specific refresher training shall be completed at least annually and after a material change in law, policy, product functionality, authorized use, or security practice. Training completion shall be documented and retained. A person who does not complete required training shall not receive or retain production access.

Customers are responsible for training and supervising their users. Before enabling customer access, Traffic Logix shall provide or make available the portions of this policy and product documentation necessary for the customer to understand authorized-use, access-record, security, accuracy, sharing, retention, and incident-reporting requirements.

7. Security Safeguards

Traffic Logix shall maintain reasonable administrative, operational, technical, and physical safeguards designed to protect ALPR information from unauthorized access, destruction, use, modification, or disclosure.

Safeguards shall be appropriate to the nature and sensitivity of ALPR information and shall be periodically assessed and updated in light of material changes in threats, technology, processing, and applicable requirements.

Traffic Logix uses approved cloud service providers to support Logix on Cloud. Each provider that stores or processes ALPR information must be identified in the internal subprocessor registry and must be subject to documented contractual, confidentiality, security, retention, deletion, and incident-notification requirements. Public descriptions of hosting locations, encryption, backup, resilience, certifications, or testing shall be made only to the extent verified by current evidence.

8. Monitoring, Audit Logging, and Compliance Review

Traffic Logix shall maintain a record of each access to ALPR information. Each access record shall include:

1. The date and time of access;

2.The license plate number or other data elements used to query or retrieve the information;

3.The username or other unique identifier of the person accessing the information and, where applicable, the person’s affiliated organization or entity; and

4. The purpose for accessing the information.

Access records shall associate the required fields with the specific access or query event. A general terms-of-use acceptance, account-level statement, login record, date-range report, or aggregate page-visit count does not substitute for an event-level purpose-of-access record.

Traffic Logix shall require each person who accesses ALPR information to use it only for an Authorized Purpose. The same access-record requirements apply to customer users and internal personnel accessing customer ALPR information.

Access records shall be protected against unauthorized access, alteration, and deletion; restricted to authorized personnel; and retained under the approved retention schedule and any applicable legal hold.

Compliance or Security shall conduct an ALPR compliance review at least annually and event-driven reviews following suspected misuse, a security incident, a substantiated complaint, or a material change in law, policy, or product functionality. Reviews shall assess required-field completeness, inappropriate or unusual access, privileged access, retention, sharing, exceptions, and remediation. Findings and corrective actions shall be documented.

9. Sale, Sharing, Transfer, and Law-Enforcement Access

Traffic Logix shall not sell ALPR information.

Traffic Logix shall not share, disclose, or transfer ALPR information except to a recipient and for a purpose permitted by applicable law. Before a disclosure or transfer, authorized personnel shall verify and document the recipient’s identity, authority, permitted purpose, requested scope, applicable legal basis, and any required recipient compliance obligations.

Subject to that review, a disclosure or transfer may be made only:

1. To the customer that controls the applicable customer environment or at that customer’s authenticated direction, if the recipient is legally eligible to receive the information and the disclosure is otherwise permitted by law;
2. To an eligible public agency or ALPR end-user that satisfies the requirements applicable to the recipient;
3. To an approved Service Provider solely as necessary to provide contracted services and subject to written restrictions on use, access, disclosure, security, retention, deletion, and incident notification; or
4. In response to valid and binding legal process, after review and approval by authorized Legal personnel.

at the documented direction of the customer

 

Disclosures undertaken to investigate or remediate a security incident must be limited to recipients and information permitted by law and reasonably necessary for the approved response.

Traffic Logix does not provide direct agency-to-agency sharing, cross-customer sharing, pooled-data access, hot-list functionality, or a law-enforcement portal. Law-enforcement status alone does not authorize access. Emergency or informal requests shall be referred to Legal for determination of whether disclosure is permitted and what documentation is required.

10. Data Accuracy and Error Correction

Logix on Cloud presents the license plate value generated by Traffic Logix optical character recognition technology together with available supporting image information. Because optical character recognition may produce incomplete or inaccurate results, the OCR-generated plate value is provided as an initial system result for customer review and is not a final determination by Traffic Logix.

The customer is responsible for the final evaluation of the OCR-generated plate value. The customer determines whether the value should be accepted, corrected, or disregarded and whether any suspected violation should be reviewed or processed. Traffic Logix does not make violation determinations and does not decide whether enforcement or other action should occur. These customer evaluation, correction, and violation-processing decisions are outside the scope of Traffic Logix. Traffic Logix evaluates OCR performance through documented testing using representative image samples and comparison of OCR-generated plate values against reference values. Test results may be maintained by software version, jurisdiction, plate type, or other relevant test conditions. Because OCR performance can vary based on plate design, image quality, camera placement and configuration, lighting, weather, motion, obstruction, and other operating conditions, Traffic Logix does not represent a single universal accuracy rate. Traffic Logix accuracy measures are limited to the operation and support of the OCR technology and presentation of available source information, including, as supported by the product:

• Camera installation, configuration, and image-quality controls
• Presentation of source images with recognized plate data for human review
• Confidence or quality indicators where available
• Customer ability to evaluate the OCR-generated value and determine whether correction or other action is appropriate
• Traffic Logix support investigation of reported recurring OCR or system-performance concerns

Authorized Users shall be instructed that OCR-generated values may be incomplete or inaccurate and must be compared with available source images before being used for an enforcement, legal, safety-critical, or similarly consequential decision. Traffic Logix shall maintain a documented method for receiving, investigating, and, where technically appropriate, correcting reported system errors without altering preserved source material or required audit evidence.

11. Retention and Destruction

Unless a shorter customer-specific period or an approved exception applies, Logix on Cloud ALPR information is subject to a 2-year retention threshold. Engineering shall remove information older than two years during the next scheduled annual purge. Because the purge occurs annually, information may remain after the two-year threshold until that purge but shall not be retained longer than 3 years.

 A customer may request a shorter retention period through an authenticated written request. Support shall document the customer, authority, requested period, affected account and data scope, and requested effective date; route the request for implementation; and record completion and customer confirmation.

Before deletion, the team responsible shall check for an applicable legal hold, preservation notice, investigation, regulatory requirement, contractual restriction, or other approved exception. An exception must identify the affected information, reason, approving authority, duration, owner, safeguards, and release or review date.

Destruction shall address active databases, object or file storage, images, ticket packets, exports, related metadata, and temporary or derived copies where technically supported and required. Deleted information remaining in backups shall be isolated from ordinary use and shall expire under the approved backup lifecycle unless subject to an applicable hold.

Traffic Logix shall maintain evidence of each scheduled purge and material deletion, including the authority, customer and data scope, systems involved, execution date, actor or service, result, exception status, and available verification evidence.

The retention model, purge execution, customer-specific periods, aged information, holds, deletion failures, backup expiration, and destruction evidence shall be reviewed at least annually.

12. Incident Response and Notification

Suspected unauthorized access, acquisition, disclosure, alteration, destruction, or misuse of ALPR information shall be reported and handled under Traffic Logix incident management and escalation procedures. Traffic Logix shall investigate confirmed incidents, preserve appropriate evidence, coordinate internal response, and provide notices required by law and applicable customer commitments.

13. Official Custodian and Responsibilities

The Vice President of Software Product Management serves as the Official Custodian of the ALPR system. The Official Custodian is responsible for implementation and annual review of this policy; coordination with Legal, Privacy, Security, Product, Engineering, Support, and Compliance; oversight of authorized access, training, monitoring, retention, destruction, and public availability; approval and tracking of exceptions; and maintenance of compliance evidence.

14. Violations and Enforcement

Suspected violations shall be reported through approved security, compliance, legal, management, or incident-reporting channels. Violations may result in access suspension or removal, corrective action, disciplinary action, contractual remedies, and legal action, as applicable.

15. Policy Governance and Public Availability

This policy shall be reviewed at least annually and upon material changes to law, product functionality, data practices, security controls, or authorized uses. Approved revisions shall be documented and retained.

The current approved version of this policy shall be publicly available in writing and conspicuously posted through the website of Traffic Logix. A written copy shall also be available upon request by contacting the Traffic Logix support (support@trafficlogix.com). The posted policy shall identify its effective date and version. Superseded versions and approval records shall be retained under the applicable records-retention schedule.