Protection of customer service personal data

I. Data controller

The data controllers of the personal details of the data subject are Transports de Barcelona, SA holding CIF number A-08016081, Ferrocarril Metropolità de Barcelona, SA holding CIF number A-08005795, Projectes i Serveis de Mobilitat, SA holding CIF number A-63645220 and Transports Metropolitans de Barcelona, SL holding CIF number B-63645253 (jointly “Co-Data Processing Controllers” o “TMB”):

Contact details for the Data Controller are as follows:

• Postal address: Carrer 60, No. 21-23, Sector A, Polígon Industrial de la Zona Franca, 08040, Barcelona.
• Email address: tmb@tmb.cat

You can request information regarding the responsibility of each entity by using the following email address: tmb@tmb.cat.

Data subjects are hereby informed that TMB has appointed a Data Protection Officer (DPO), who you can contact for any query relating to the processing of your personal details. The data subject can contact the Data Protection Officer by using the following email address: dpd@tmb.cat.

 

II. For what purpose are your personal data processed?

The data subject is hereby advised that the main use of the personal details provided are to manage any enquiries and claims that may arise. The following will be specifically included for this purpose: 

a) Including your personal data in a TMB database. 

b) Answering enquiries, requests, applications, claims or suggestions regarding the following questions: timetables and validity of routes, itinerary of routes, services offered on board the bus, prices, etc.

c) Sending communications to establish how data subjects assess the service received and their levels of satisfaction.

d) Carrying out aggregated statistics studies related to enquiries, requests, applications, claims or suggestions made by users.

 

III. What is our legal basis for processing your personal data?

The legal basis for processing users' personal data for the purposes detailed in points a) and b) is the prior and unequivocal consent of the data subject. 
In this respect, data subjects are obliged to provide the information necessary to deal with and respond to their enquiry. If this information is not provided it will not be possible to process their enquiries and claims. 

The legal basis for processing users' personal data for the purposes detailed in point c) and d) is the legitimate interest of TMB. 

 

IV. How long is your data kept?

Personal details provided by the data subject in order to manage enquiries or claims will be kept for the time necessary to deal with the enquiry and, subsequently, the personal data will be blocked until the applicable statute of limitations expires.

 

V. To which recipients may we communicate your personal data?

In order to achieve the aforementioned objective, personal details about data subjects may be assigned to: 

Public Administrations in circumstances where this is required to comply with the legal and regulatory provisions applicable in each case and, where applicable, to other official bodies such as State Security Forces and Agencies and judicial entities.

In addition, TMB advises that it does not envisage making any international data transfers.

 

VI. What are your rights regarding the data you provide?

Anybody has the right to obtain confirmation about whether we are processing personal data that concerns you, or not. Data subjects have the right to access their personal data, and also to request the rectification of inaccurate data, or if applicable, their erasure if they are no longer necessary for the purposes for which they were collected.

In certain cases, data subjects will have the right to ask for the limitation of processing their personal data, in which case we only preserve them in order to make or defend claims.

In certain circumstances and for reasons regarding their own particular situation, data subjects may object to the processing their data. In this case, TMB will stop processing the data in response to legitimate, compelling reasons or else to make or defend against possible claims.

In either of the above cases, TMB will notify any rectification,  erasure or limiting of the use of the processing of data processing to each of the possible recipients of such data, unless it represents or requires disproportionate effort. If a data subject requests this, said recipients will be informed.

Likewise, data subjects will have the right to receive information about the personal data concerning them provided to TMB in a structured format in common use and machine readable, and assign them to another controller when the processing is based on consent or contract, and executed by automatic means.

Data subjects have the right to object, at any time and for reasons related to their personal situation, to personal data concerning them being subject to processing based on public or legitimate interests pursued by TMB or a third party, including profiling, so that TMB stops processing personal data, unless TMB can justify the processing for legitimate, compelling reasons, in such a way that the processing prevails over the interests, rights and liberties of the data subject, or else so that TMB can prepare, exercise or defend claims.

Likewise, data subjects have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal consequences for them or which significantly affects them, unless this decision is necessary to enter into a contract between TMB and the data subject authorised by current European or state law, or that is based on the explicit consent of the data subject.

In addition to the aforementioned rights, data subjects will have the right to withdraw the consent granted at any time, without this action affecting the legitimacy of previous processing.

The above-mentioned rights can be exercised by a written and signed request sent to the following address: Carrer 60, no. 21-23, Sector A, Zona Franca, 08040 Barcelona, or by an email addressed to dades@tmb.cat tot putting n the subject line: “Exercise of GDPR rights” and including the following information: name and surname(s) of the user, address for correspondence, photocopy of the National Identity Document or Passport, and details of the request being submitted. 

Lastly, data subjects are hereby advised that they have the right to submit a claim to the Catalan Data Protection Agency.

 

VII. How do we obtain your data? 

The personal details processed by TMB come from data subjects themselves and from their activity.