You are in:
Privacy policy
Privacy Policy
This privacy policy aims to explain how, at TMB, we obtain, process, and protect the personal data that you provide or that we collect, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD), and other regulations in force regarding the protection of personal data.
Data Controllers
The joint controllers of your personal data are:
- Transports de Barcelona, S.A., with CIF number A08016081.
- Ferrocarril Metropolità de Barcelona, S.A., with CIF number A08005795.
- Projectes i Serveis de Mobilitat, S.A., with CIF number A63645220.
- Transports Metropolitans de Barcelona, S.L., with CIF number B63645253.
- Fundació TMB, with CIF number G59053538.
All of them referred to jointly as “TMB,” with address at:
- Carrer 60, número 21-23, sector A, polígon industrial de la Zona Franca, 08040 Barcelona.
- Email address: dpd@tmb.cat.
In accordance with the provisions of Article 26.2 of the GDPR, you can consult the joint responsibility agreement of the entities that make up the TMB group at Joint Controllers Agreement.
TMB Websites
The websites are owned by TMB and contain links to other third-party websites with data protection policies separate from those of TMB. By accessing these third-party websites, you can decide whether to accept their data protection and cookie policies, in accordance with current regulations.
TMB’s websites consist of all these websites:
Together with its subdomains and other portals, among which are the following:
- TMB Foundation
- TMB Tickets
- Single ticket – bank card
- Transparency Portal
- Access to public information request
- Developer Portal
- TMB Notícies
- Ethics Channel
And their applications: TMB App, GenTMBapp, App Hola Barcelona and other TMB apps.
Purposes of Processing and Legal Basis
TMB processes your personal data lawfully, fairly, and transparently, limiting the purposes for which it was collected.
Information regarding the processing carried out by TMB, its purpose, legal basis, recipients, and security measures, as well as any additional information, can be found in our Record of Processing Activities:
Communication of Personal Data
TMB will not share personal data without the consent of the data subjects, except in cases provided for by current legislation, and to the competent State Security Forces, Courts and Tribunals, and Public Administrations.
Data Retention
Generally speaking, personal data processed by TMB will be retained for the time necessary to fulfil the purpose for which it was collected, considering the time periods established by general regulations and, specifically, by Law 10/2001, of July 13, and Decree 13/2008, of January 22. If necessary, it will be kept blocked until the expiration of the statute of limitations, at which point it will be deleted.
Confidentiality
At TMB, we process your personal data confidentially, committing to maintaining its secrecy and adopting all necessary measures to prevent its alteration, loss, unauthorized processing, or access, in accordance with our legal obligations as data controllers.
We are committed to maintaining and applying the necessary security levels, considering the state of the art, the type of data stored, and the risks, to protect your personal data from accidental loss and unauthorized access, processing, or disclosure.
Transfers of Personal Data Outside the European Economic Area (EEA)
Generally, international data transfers are not planned. If such transfers are necessary, the data subject will be informed, and the necessary measures will be taken to ensure their legality.
If data must be transferred to entities outside the EEA, TMB will verify that these third parties have sufficient guarantees in accordance with current regulations.
Data Protection Rights
Data subjects may exercise the rights recognized in the GDPR at any time:
| Rights | Scope of the right |
|---|---|
| Right of access | This is your right to request and obtain information about your personal data held by TMB, as well as how it is processed, for what purpose, and for what specific uses. |
| Right of rectification | This is your right to rectify your personal data when it is incorrect or incomplete. |
| Right of deletion (right to be forgotten) | This is your right to request the deletion of access to your personal data when it is inappropriate, excessive, or unnecessary, when it is retained for longer than required, or when it is contrary to applicable regulations. |
| Right of opposition | This is your right to request that no processing of your personal data be carried out. |
| Right of limitation to processing | This is a right that consists of marking your personal data held by TMB to limit its processing in the future. |
| Right of portability of data | This is the right to receive the personal data you have provided to TMB in a structured, commonly used, and machine-readable format, and to transmit it to another controller, if the processing is based on consent or a contract, or if it is carried out by authorized means. |
| Right not to be subject to individual, automated decisions. | This is the right not to be subject to a decision based solely on automated data processing, including profiling, which produces legal effects on you or significantly affects you. |
You will find full information to exercise these rights in Exercise of rights (GDPR).
You also have the right to file a complaint with the Catalan Data Protection Authority at any time if you believe that TMB has not processed your personal data in accordance with applicable regulations.
Data Protection Officer
TMB has appointed a Data Protection Officer (DPO), to whom you can present any matter concerning the processing of your personal data. The DPO has a reasonable period of two months to respond, although they will acknowledge receipt of any requests received.
If you need to make a query, request, or file a complaint related to the processing of your personal data, you can contact the Data Protection Officer at the following email address: dpd@tmb.cat.
