Privacy policy
Purpose
The purpose of this personal data policy is to inform how TMB obtains, processes and protects personal data, provided to us or collected by us, in accordance with the European Data Protection Regulation (EU) 2016/679 of the European Parliament and Council of of 27 April 2016 (regarding the protection of individual people, with regard to processing personal data and the free circulation of these data), the Organic Law 3/2018 of 5 December on the Protection of personal data and guarantees of digital rights, and other regulations in force regarding the protection of personal data.
Data controllers
The data controllers of your personal data are:
- Transports de Barcelona, SA, with Tax ID number A08016081
- Ferrocarril Metropolità de Barcelona, SA, with Tax ID number A08005795
- Projectes i Serveis de Mobilitat, SA, with Tax ID number A63645220
- Transports Metropolitans de Barcelona, SL, with Tax ID number B63645253
- Fundació TMB, with Tax number G59053538
They jointly form the "Data Processing Controllers" or "TMB" of:
- Postal address: Carrer 60, number 21-23, Sector A, Polígon Industrial de la Zona Franca, 08040 Barcelona
- Email address: dpd@tmb.cat
- Tel: 900 70 11 49
Processing of video surveillance and voice recordings
Check out the information about the proccessing of video surveillance and voice recordings.
TMB websites
TMB "Websites" are formed by the following websites and their applications:
- TMB
- Telefèric de Montjuïc
- Barcelona Bus Turístic
- Hola Barcelona
- its subdomains, among others, Fundació TMB, TMB Tickets, Bitllet Bus, Transparency Portal, Access to public information request, Developer Portal, Contractor Profile, TMB Notícies, Ethics Channel and
- TMB Aapp, GenTMBapp and other TMB apps.
The Websites are the property of TMB and contain links and other third-party websites, with data protection policies unrelated to TMB. On accessing these third-party websites, you can decide whether or not to accept their data protection and cookie policies, in accordance with current regulations.
Public transport users, customers and potential customers
Public transport users, customers and potential customers are informed of the personal data that may be collected, the purpose and the legitimacy of the data processing.
Data |
|
Purposes of the personal data processing |
|
Legitimacy for processing personal data |
For all purposes, the legal bases that legitimise the processing of personal data by TMB are:
|
TMB App
Apart from the processing of personal data that is generally detailed by the TMB "Websites", related to digital services (user area, online sales and other services related to the JoTMBé account), some TMB App functionalities require using the user location. In no case is this information stored or transmitted to third parties; the user location is only used locally (in TMB App) and momentarily to offer the functionalities detailed below:
Data | GPS or Bluetooth location |
Purposes of personal data processing |
|
Legitimacy for processing personal data | The consent of the interested parties, which can be withdrawn at any time. |
Bidders, subcontractors and suppliers, business partners, collaborators and Administrations
Bidders, subcontractors and suppliers, business partners, collaborators and Administrations are informed of the personal data that may be collected, the purpose and the legitimacy of the data processing.
Data |
|
Purpose of personal data processing |
We will process contact data collected from contact channels, emails and forms on our websites for the following purposes:
|
Legitimacy for processing personal data |
|
Candidates, employees and trainee students
Candidates, employees and trainee students are informed of the personal data that may be collected, the purpose and the legitimacy of the data processing.
Data | Data required to enter into the relation (pre-employment, contractual, collaboration): name and surnames, Tax number, address, social security number, family, health and bank details, image, voice recordings, geolocation data, union affiliation and academic data. |
Purpose of personal data processing |
In the case of candidates, the purpose of data collection and processing is to accept and manage candidacies and selection processes and, if necessary, contracts and partnerships. In the case of employees, data collection and processing is carried out to fulfil and manage labour relations, including access to TMB systems, personnel administration, occupational health and safety, general communication, payroll and pension plans, if applicable, accessing facilities, managing the working day and leave, processing insurance claims for possible accidents or incidents, investigating incidents, and ensuring the safety of people, property and facilities. Data collection and processing is also carried out for any other purpose arising from labour relations with the employee.
|
Legitimacy for processing personal data |
|
Collection of personal data and Registration of Processing
TMB processes your personal data in a legal, fair and transparent manner, limiting objectives to those for which they were collected.
You may consult the information on the processing carried out by TMB, the purpose of and legal basis for the processing, the recipients of the data and the security measures, and any additional information on the protection of your personal data, in our Register of Processing Activities.
Communication of personal data
TMB will not communicate personal data without the consent of parties concerned, except in circumstances indicated in current legislation, along with Law Enforcement Authorities of the State, Courts, Public Administrations with jurisdiction in the field.
Preservation of data
As a general rule, personal data processed by TMB, will be preserved for the time needed to fulfil de purpose for which they were collected, bearing in mind the terms set generally in rule i and specifically in Law 10/2001 of 13 July and Decree 13/2008 of 22 January, notwithstanding where appropriate, the provision of competent authorities or to attend to complaints. In this case, the data are blocked and preserved until the end of the term of limitation, when they will be eliminated.
Confidentiality
TMB processes your personal data with confidentiality. It undertakes to keep them secret and adopt all measures required to avoid alterations, loss, non-authorized processing or access, pursuant to the legal obligations applicable to us as controllers of processing your personal data.
We therefore undertake to maintain and implement the required safety levels, bearing in mind the state of technology, the category of stored data and risks, in order to protect your personal data from accidental loss and non-authorized access, processing or dissemination, and not to disseminate information, as long as it does not follow the strict fulfilment of an assignment or a legal obligation. In short, to process your data following current legislation in data protection.
Transfer of personal data outside the European Economic Area (EEA)
As a general rule, international data transfers are not anticipated. However if transfers are required, the party concerned will be informed, and all necessary measures will be taken to ensure full, legally contemplated, guarantees.
Notwithstanding the foregoing, if data has to be transferred to entities outside the EEA, TMB will check that these third parties have sufficient guarantees, as established in current data protection regulations.
Rights in data protection
The parties concerned may at any time, exercise their rights indicated in the Data Protection Regulations:
Rights | Scope of the right |
---|---|
Right of access | This right enables you to request and obtain information on your personal data, held by TMB, along with how they are processed, for what purpose and for which specific uses. |
Right of rectification | This right enables you to rectify your personal data if they are incorrect or incomplete. |
Right of deletion (right to be forgotten) | This right enables you to ask for deletion of access to your personal data, when they are inappropriate, excessive or unnecessary, when they are preserved for longer than required of if they are contrary to Regulations. |
Right of opposition | This right enables you to request that no processing is done of your personal data. |
Right of limitation to processing | This right consists of marking your personal data preserved by TMB, for the purpose of limiting their processing in the future. |
Right of portability of data | This gives you the right to receive personal data provided to TMB, in a structural format, of common use and machine readable, and to transfer them to another controller, if processing is based on consent of in a contract and if done through authorized means. |
Right not to be subject to individual, automated decisions. | This right is not to be subject to a decision based solely on automated processing of data, including drawing up profiles, which have legal implications on you or which affect you significantly. |
You will find full information to exercise these rights in Exercise of rights (GDPR).
You also have the right to present, at any time, a claim to the Catalan Data Protection Authority, regarding the processing of your personal data.
Data protection Officer
TMB has a Data Protection Officer (DPO), to whom you can present any matter concerning the processing of your personal data. The Data Protection Officer will have a reasonable time of two months to reply to your enquiries.
If you need to make an enquiry, request or complaint regarding the processing of your personal data, you can contact the Data Protection Officer through the following email address: dpd@tmb.cat.