Privacy and personal data protection policy for the T-mobilitat website and app
Autoritat del Transport Metropolità (hereinafter also ATM, for its initials in Catalan), as the data processor, guarantees an adequate and consistent level of protection for individuals with regard to the processing of their personal data, the object of processing, in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the Protection of Individuals with regard to the Processing of Personal Data and on the free movement of such data and (RGPD) and Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDiGDD).
ATM only processes personal data with full responsibility and in good faith, and in accordance with the legal bases that allow the lawfulness of the processing, in accordance with the General Data Protection Regulation and Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights.
In order to comply with the RGPD and the LOPDGDD, ATM has prepared a Register of Processing Activities and has adopted appropriate and suitable security measures for the risks associated with the processings.
ATM applies the principle of transparency in the processing of personal data, providing interested parties with concise, easily accessible, complete information with easy-to-understand language and, at the same time, facilitating the exercise of rights through the following forms:
EXERCISE OF THE RIGHT OF ACCESS FORM
Article 15 of the General Data Protection Regulation (EU) 2016/679.
EXERCISE OF THE RIGHT OF RECTIFICATION FORM
Articles 16 and 19 of the General Data Protection Regulation (EU) 2016/679.
EXERCISE OF THE RIGHT OF DELETION FORM
Articles 17 and 19 of the General Data Protection Regulation (EU) 2016/679.
EXERCISE OF THE RIGHT OF OPPOSITION FORM
Article 21 of the General Data Protection Regulation (EU) 2016/679.
PROCESSING LIMITATION EXERCISE FORM
Articles 18 and 19 of the General Data Protection Regulation (EU) 2016/679.
EXERCISE OF THE RIGHT TO PORTABILITY FORM
Article 20 of the General Data Protection Regulation (EU) 2016/679.
ATM has also appointed a data protection delegate, in accordance with the provisions of article 37.1.a. of the General Data Protection Regulation (2016/679). The contact address of the data protection delegate is [email protected].
Below, you are provided with additional and extended information on data protection:
Responsible for the processing
Identity: Autoritat del Transport metropolità
NIF: P-5890049-I
Postal address: Balmes street, 49, 6th floor, 08007, Barcelona
Phone: +34 93 362 00 20
E-mail: [email protected]
Data protection delegate
Data protection delegate: [email protected]
Purposes of the processing
The data of the interested parties will be processed for the following purposes:
- For the registration, attention, processing and response to the communication of the interested person.
- For the registration, care and management of applications for data protection rights, recognized to the persons concerned.
- To manage the registration and acquisition of the T-mobilitat.
- Management of the use of the T-mobilitat app.
- For statistical and scientific purposes.
Legal basis of the processing
The legal bases that legitimize the processing of the personal data of the people interested by ATM are the following:
- Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016 ,on the Protection of Individuals with regard to the Processing of Personal Data and on the free movement of such data Article 6.1. b. The processing is necessary for the execution of a contract in which the interested party is a party or for the application at its request of pre-contractual measures.
- Article 6.1.c. The processing is necessary for the fulfillment of a legal obligation applicable to the person in charge of the treatment.
- Article 6.1.e. The processing is necessary for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the responsible for the processing.
Provenance of personal data
The personal data processed by ATM in fulfillment of a mission carried out in the public interest and in the exercise of public powers come directly from the persons concerned or their representatives.
Categories of data subject to processing
Identifying data, personal data, economic data, employment data and sensory needs/assistance data.
Preservation period
The personal data of the persons concerned will be kept for the time necessary for the fulfillment of the purposes for which they were obtained, in the exercise of the powers and functions of ATM, and to determine the possible responsibilities arising from them. Preservation periods can be consulted in detail in the Register of Processing Activities (hereinafter also RAT, for its initials in Catalan). Once they are no longer needed, ATM will keep your personal data locked during the statute of limitations.
The mandatory RAT, relating to the processing of personal data carried out by this organization, can be consulted via the following link.
Recipients of the data
The data will not be transferred to public or private third parties except in the case of a legal obligation.
International data transfers
No international data transfers are foreseen, except in the following cases, where they will be made to third countries with an adequate level of protection, declared by the European Commission and with the provision of adequate guarantees such as Model Contract Clauses:
- When you send the data you have provided to us to subscribe to our newsletter, through the company Mailchimp/Campaign Monitor/Active Campaign, which carries out its activity of processing your personal data in third countries outside the European union. The full version of its Privacy Policy can be found in its corresponding policies on the processing of the data collected:
- Mailchimp: https://mailchimp.com/gdpr/
- Campaign Monitor: https://www.campaignmonitor.com/policies/#privacy-policy
- Active Campaign: https://www.activecampaign.com/legal/privacy-policy
- ATM, the data processor, contracts its virtual infrastructure according to a cloud computing model, through Google/Microsoft, under Model Contract Clauses. The information is available at:
- In cases where there may be international data transfers, it will be through cookies from third parties (Liferay). You may be informed of data transfers to third countries which, where applicable, are made by the third parties identified in this cookies policy, in their corresponding policies on the processing of the data collected.
In charge of data processing
Ferrocarrils de la Generalitat de Catalunya dels Vergós St., 44 08017 Barcelona, CIF Q0801576J.
Rights of interested parties
The holders of the data processed by ATM are entitled to the right, at all times, to exercise the right of access to their data, rectification of erroneous or inaccurate data, deletion when, among other reasons, the data are no longer necessary for the purposes for which they were collected, and to the portability of the data. In certain circumstances, the interested parties may request the limitation of the processing of their data, in which case they will only be kept for the exercise or defense of claims. Interested parties may also withdraw their consent at any time.
Also for reasons related to their particular situation, interested parties may object to the processing of their data. ATM will stop processing the data, except for legitimate reasons or for the exercise or defense of possible claims.
To exercise these rights, you can contact ATM by sending the corresponding form by ordinary mail to AUTORITAT DEL TRANSPORT METROPOLITÀ, Balmes Street, 49, 6th floor, 08007, Barcelona, or to the email address [email protected].
Likewise, if you are not satisfied with the response to the exercise of your rights and, in any case, whenever you deem it appropriate, you may file a complaint with the Autoritat Catalana de Protecció de Dades through its headquarters. electronics at apdcat.gencat.cat.
Registration of processing activities
ATM treats your personal data in a lawful, fair and transparent manner and by limiting the purposes for which they were collected.
In compliance with article 30 of the RGPD and article 31 of the LOPDGDD, ATM has drawn up the Register of Mandatory Processing Activities, relating to the processing of personal data carried out by this organization, which can be consulted through the next link.
For any queries, requests or complaints regarding the processing of personal data, users may contact the data protection delegate via the following e-mail address: [email protected].
Users also have the right to submit, at any time, a complaint to the Autoritat Catalana de Protecció de Dades regarding the processing of their personal data.
