A road toll system comprises a vehicle-mounted unit having a satellite navigation receiver. A first data processing means determines a route taken based on satellite navigation data provided from the receiver, and the satellite navigation data is associated with a variable identity. A road toll level is derived. A second data processing means receives the road toll level provided by the first data processing means, and the satellite navigation obtains the determined road toll level from the second data processing means using the variable identity. This provides a thin client scenario (the receiver does not implement the map calculations), but with data security corresponding to a thick client solution. Thus, the map matching and trip cost computation steps are delegated by the on-board unit to an external unit, but this delegation is performed anonymously, so that no data sent for external processing compromises the privacy of the data.