Through this personal data processing document, the processing is regulated of personal data provided by users (the "User" or the "Users") of the website:
All these web pages form the "Website".
The purpose of this personal data protection policy ("Personal Data Protection") is to announce how we obtain, process and protect the personal data you provide, or which we obtain through forms on our Website, so you can freely and voluntarily decide if you wish us to process them.
The Website is the property of TMB. We would also like to remind you that through this document, we inform you on the processing of personal data, which TMB does through the Website. However this does not apply to third parties, which obtain them from other web pages, even those that are linked to this Website.
It is important to read this Personal Data Protection Policy, whenever you use the Website, as there may be modifications.
The data controllers of User data are Transports de Barcelona, SA holding CIF number A-08016081, Ferrocarril Metropolità de Barcelona, SA holding CIF number A-08005795, Projectes i Serveis de Mobilitat, SA holding CIF number A-63645220 and Transports Metropolitans de Barcelona, SL holding CIF number B-63645253 (jointly “co-data processing controllers” or “TMB”):
Contact details for the Data Controllers are as follows:
You can request information regarding the responsibility of each entity by using the following email address: firstname.lastname@example.org
The User is hereby informed that TMB has appointed a Data Protection Officer ("DPO"), whom you can address for any question regarding processing of your personal details. The User can contact the Data Protection Officer by using the following email address: email@example.com
TMB will process your personal data for the purposes and with the legitimacy indicated in each personal data collection form of the Website.
As a general rule, the purposes and legitimacy for processing, as set out in the forms, are:
Uses based on your consent:
We can collect and process your personal data when you have specifically given your consent. For example, when you give your consent to receive the TMB newsletter.
Uses of a contractual purpose
TMB will have to use your personal data to complete any purchase made through the Website. For example, we need to use data such as your contact data and information on payment, in order to provide the transport tickets or services contracted.
Uses with a legal or regulatory purpose
There are situations in which TMB is subject to certain legal obligations and needs to use your personal data, in order meet these obligations. For example: processing your data in order to arrange information access requests by citizens, under Law 19/2013 of 9 December, on transparency, information access and good governance.
Uses based on public interest
On other occasions, we may process your data on the legitimate basis of public interest, such as processing administrative records and the presentation of the corresponding allegations by the User.
Uses of a commercial purpose, based on legitimate interest.
As a transport service company, TMB has a legitimate business interest in processing personal data collected, in order to offer an efficient service and to develop our business. For example, the Company has a legitimate interest in carrying out satisfaction surveys to Users of its services.
TMB processes your personal data in strict confidentiality. We undertake to keep them secret and guarantee to adopt all measures required, to avoid their alteration, loss, non-authorized processing or access, following legal obligations applied as the party responsible for your personal data.
TMB undertakes to maintain and implement the required levels of security, bearing in mind the status of technology, the nature of stored data and risks, in order to protect your personal data against incidental losses and accesses, non-authorized processing or disclosure, all in accordance with current law regarding data protection.
TMB guarantees that your information is only used in an appropriate manner. Hence, we basically process information indicated below:
We process your data while the consents you have given us remain in force, or unless you cancel the contractual or business relation with us.
Notwithstanding the above, we will no longer process your data once your consent has been withdrawn or once your contractual or business relation with TMB is over, as long as your data are not required for purposes for which they were collected or processed.
Without prejudice to regulations and certain legal requirements, your personal data will be preserved in order to meet archive and documentation regulations, and also: to make and pursue claims, during the limitation term of actions arising from signed contractual or business relations, etc.
Apart from the exchange of personal data between companies which are Co-responsible for Processing, on some occasions we need to share certain information with third parties, including personal data, in order to offer our services.
The type of services with which we may share your data are given below:
The User is hereby informed that in general your persona data are processed by service providers located within the European Economic Area ("EEA") or in countries that have been declared with a suitable level of protection.
Nevertheless, in other cases they may be transferred to third party entities located outside the EEA, including countries that cannot offer the same level of protection of personal data as Spain or the EEA. In this case, TMB will ensure that these third countries offer the following guarantees:
Lastly, in view of the lack of an adequacy decision and suitable guarantees, TMB will only make international transfers, if any of the following conditions are met:
In accordance with European data protection regulation, you have the following rights:
Right of access
You have the right to know which of your data we are processing, and the right to access these data and obtain the following information:
Right to withdraw consent
Right to withdraw consent at any time, when you have given us authorization to process your data.
Right of rectification
Right to rectify your data if they are inaccurate and to complete them if they are incomplete.
Right to object
Right to object to processing of your personal data, based on a mission performed in public interest or the exercise of public powers conferred to the party responsible, or in legitimate interest pursued by the party responsible for processing or by a third party.
Right of elimination
Right to eliminate your data, when:
Right of limitation
Right to limit processing of your data (in certain cases, explicitly indicated in regulations).
Right of portability
Right to release your data (data processed to implement products and services, and data we process with your consent), so you can transfer them to another party responsible for processing.
Right to not be subject to automated individual decisions.
Right to not be subject to a decision based only on automated processing of your data, including the drawing-up of profiles, which lead to legal implications or which have a negative effect, unless the decision:
The aforementioned rights can be exercised by sending an email to the following address: firstname.lastname@example.org indicating in the subject: "Exercising GPDR rights".
If it is not possible to exercise your rights through the previous option, send a written and signed request to a "TMB data": carrer 60. núm. 21-23. sector A, Zona Franca, 08040 Barcelona, indicating in the subject: "Exercising GPDR rights".
Finally, the User is informed that he/she has the right to present a claim to the Catalan Data Protection Agency (https://apdcat.gencat.cat) and to the Spanish Data Protection Agency (https://www.aepd.es/) regarding the processing of your personal data at all times.