You are in:
I. Which entities are responsible for controlling the processing of users’ data obtained through the website?
The three entities act as co-controllers of the data processed in that they decide jointly on the methods used and purposes for which the processing of data is carried out through the website.
The TMB Personal Data Protection and Confidentiality Policy refers to the compiling and use of information provided through the website.
TMB has introduced policies and procedures into its systems and premises to guarantee and protect the privacy of its users’ personal data. It has adopted the necessary levels of protection as well as technical and organisational measures to avoid, as far as possible, unauthorised access, illicit modifications, removal or loss of data.
II. For what purpose do we process your personal data?
Here users are advised that TMB will process personal data provided through the online forms, or that have been collected while browsing the website for the purposes detailed hereinafter, to the extent that there is a legal basis for each process as explained later on:
a) To respond to queries, requests, applications, claims, declarations or suggestions relating to, among others, the following issues: the transport service of TMB itself, lost property, incidents arising from TMB’s transport service, new business or international business, the use of TMB spaces (for example, using spaces belonging to the Metro and Bus for filming purposes), carrying out educational activities in TMB spaces or transparency or obtaining licences for the reuse of (non-personal) data generated by the service.
b) To acknowledge and manage feedback on issues that include, among others, the following: damage to premises, vehicles, malfunction of digital tools, etc.
c) To provides personalised access to the website (language, browser type, etc.), conduct analysis of user browsing habits on the website in order to optimise it, make improvements and compile statistics about its use; all of this achieved by installing cookies.
d) To undertake aggregated statistical studies related to the queries, requests, applications, claims or suggestions raised by users
III. What is the legal basis for processing users’ personal data?
- The legal basis for processing users’ personal data for the purposes described under points a), b) and d) is the legitimate interest of TMB to reply to, manage or provide a solution to user’s queries, requests, applications, claims, suggestions and notifications; as well as to understand the type and volume of the queries raised by users. TMB also considers that the purpose described under point d) is compatible with the purposes indicated in points a) and b).
- The legal basis for the processing of users’ personal data for the purposes described in point c) is the consent of the user. Consult our Cookies policy.
- Users understand and accept that failure to fill in the personal data marked with an asterisk on the request form will prevent TMB from responding to or managing the request made. Under no circumstances will TMB pass on and exploit these data or make different use of them other than that which is expressly stated herein. During the registration process, users will be advised about any data that are not compulsory for TMB to collect in order to provide their services.
IV. For how long are users’ personal data kept?
TMB will keep data on its users for as long as is necessary to be able to offer service and manage the queries, requests, notifications, suggestions, declarations or claims submitted by users. As a general rule, data are not kept for more than thirty (30) days from TMB submitting its response. Specifically, in the case of carrying out film shoots in TMB locations, data are kept until filming has been completed.
All of the foregoing is without prejudice to data maintained in order to comply with legal obligations, the formulation, exercise or defence of potential claims or the length of time permitted under current legislation.
V. Who has access to users’ personal data?
Offering the best possible service through its website may require TMB to provide access to user data to other third party TMB suppliers in the capacity of data processors.
When users request permission to film on Line 9 of the Metro, TMB needs to share the data of the applicant users with Infraestructures Ferroviàries de Catalunya (Ifercat), in order for them to be able to manage access to the premises and the authorisation to film.
When users request permission to use TMB spaces for educational activities, TMB is able to share data with the relevant education centre in order to manage the request.
In addition to the foregoing, TMB may transfer or communicate personal data and any other information held in its files to fulfil its obligations to Public Administrations
when requested to do so in accordance with the legal and regulatory requirements applicable in each case and, where appropriate, also to other bodies such as the State Security Forces and the judiciary.
VI. What rights do users have?
TMB advises users of the possibility of exercising their right to access, rectification, objection, erasure and restriction of the processing of personal data collected by TMB.
These rights may be exercised freely by users and, where appropriate, by their representatives by sending a written and signed request to the following address: Carrer 60, No. 21-23. Sector A, Zona Franca, 08040 Barcelona, indicating in the subject line: “Exercise of GDPR rights” and including the following information: name and surname(s) of the user, address for correspondence, photocopy of the National Identity Document or Passport, and details of the request being submitted. The right of rectification can also be exercised through the website itself. The exercise of the right to erasure, out of necessity, implies that TMB will not be able to respond to or manage any request or notification from the user. In the case of representation, the representative will be required to produce a reliable document of proof to confirm their status. Similarly, users can exercise the aforementioned rights using the email address: email@example.com.
In addition to the aforementioned rights, users have the right to withdraw the consent they have granted at any time for purpose c) as indicated in section II above. To do this, they can reject or configure the installation of cookies. For more information consult our Cookies policy, without this withdrawal of consent affecting the legality of the processing carried out before the consent was withdrawn. TMB may continue to process user data to the extent permitted under current legislation.
In the same way, users can contact the TMB Data Protection Officer via the email address firstname.lastname@example.org to raise any queries they might have, including those relating to the co-responsibility agreement made between the Data Controllers of their data.
TMB reminds users that they can submit a claim to the Catalan Data Protection Agency at any time with regard to the processing of their personal data. Contact can be made through http://apdcat.gencat.cat.