TMB Processing Activities Register as Data Controller

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

Type of personal data:

• Identification and contact details: Name and First Surname, ID number, telephone number, address
• Health details
• Image

Purpose: management and processing of the files with the insurance entities covering accidents, incidents between people or with the property and claims for damages received by TMB.

Legitimacy:

• 6.1.b) Contract execution
• 6.1.c) Legal obligation

Data communication: may be shared with insurance companies and public entities that are competent in the matter.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

Type of personal data:

• Contact details: Name and First Surname, ID number and email address

Purpose: to manage the requests to exercise rights regarding personal data protection.

Legitimacy: 6.1.c) Legal obligation

Data communication: shall not be communicated to third parties except for legal obligations.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, suppliers and citizens.

Type of personal data: The contents of the complaint received and, if the complainant voluntarily registers, their contact details (email).

Purpose: process and manage complaints through TMB's Ethics Channel regarding alleged violations.

Legitimacy: 6.1.e) An initiative undertaken in the public interest.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: three months (Article 24 of Law 3/2018 on Data Protection and Guarantee of Digital Rights).

International transfers: not foreseen.

Safety measurest: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: subcontractors, customers and citizens.

Type of personal data:

• Identification data: Name and Surnames, ID/NIF/Identification document, address and telephone number.
• Economic, financial and insurance details: Bank details.
• Occupation data: employment position, category

Purpose:

• Management of initiatives and commercial and promotional services
• Facility hire and services
• Income from advertising

Legitimacy: 6.1.b) Contract execution

Communication of the data: it will not be shared with third parties except for legal obligations.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: users of public transport, customers, citizens and business people/professionals.

Type of personal data:

• Contact details: Name and First Surname, ID number and email address.

Purpose: management of suggestions, damage reports, justifications and processing of requests.

Legitimacy: 6.1.a) Consent of the interested party

Communication of the data: it will not be shared with third parties except for legal obligations.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures:TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: bidders and contractors.

Type of personal data:

• Identification data: Name and Surnames, ID/NIF/Identification document, address, electronic signature and telephone.
• Details of the employment position
• Economic, financial and insurance details: Bank details.

Purpose: processing of public procurement files.

Legitimacy:

• 6.1.b) Contract execution
• 6.1.c) Legal obligation

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers:: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: public transport users, customers, citizens, employees, bidders, subcontractors and suppliers, business partners, collaborators and public administrations.

Type of personal data:

• Identification and contact data : Name and First Name, ID, telephone, address

Purpose: management and control of incoming and outgoing correspondence.

Legitimacy: 6.1.f) Legitimate interest

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

Type of personal data:

• Identification data: Name, ID, telephone, address, signature
• Health Details
• Employment details
• Academic and professional details
• Image and voice
• Economic data

Purpose:

• Management and processing of legal files
• Legal counsel

Legitimacy: 6.1.c) Legal obligation

Data communication: it may be shared with suppliers and public entities.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: suppliers and collaborators.

Type of personal data:

• Identification data: Name and Surnames, ID/NIF/Identification document, address, Social Security Number and telephone
• Economic, financial and insurance details: Bank details
• Health details
• Occupation data: employment position, category
• Professional Identification Cards (TIP)

Purpose:

• Formalisation of the contractual relationship
• Contractual or collaborative relationship with third parties
• Coordination of business activities
• Management of the prevention of occupational risks
• Management of payments and reimbursements
• Carrying out surveys

Legitimacy:

• 6.1.b) Contract execution
• 6.1.c) Contract execution

Data communication: it will not be shared with third parties except in the event of a legal obligation or contractually required.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

Type of personal data:

• Identification data and contact details: Name and First Surname, ID, email adress, telephone and adress
• Image and voice

Purpose:manage event organization and participation, as visits to schools or entities, filming at TMB's facilities, on-line activities or other events promoted by TMB.

Legitimacy: 6.1.a) Consent of the interested party

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees and subcontractors.

Type of personal data:

• Identification data: Name, ID, user, employee number, email, occupation data
• Occupation data

Purpose:

• Registration, management and monitoring of reported incidents and online requests
• Management of user registrations and de-registrations on applications or software (Active Directory))
• Management of VPN permissions for suppliers

Legitimacy: 6.1.f) Legitimate interest

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: subcontractors and suppliers, partners, Sales staff, collaborators and public administrations.

Identification data:

• Identification data: Name and Surnames, ID/NIF/Identification Document, address, electronic signature and telephone number
• Details of the employment position
• Economic, financial and insurance details: bank details.

Purpose: processing of the income and expense files arising from the execution of the budget and the responsible entity's activities.

Legitimacy: 6.1.c) Legal obligation

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: 

1. Employees

Purposes:

• Preserve the safety of people, goods and facilities
• Incident/accident investigation (service quality)
• Supervision and management of circulation activities

Legitimate basis: 6.1.e) Mission carried out in the public interest

• Investigation of incidents/accidents (Prevention of Occupational Risks)

Legitimate basis: 6.1.c) Compliance with a legal obligation

• Management of employee incidents

Legitimate basis: 6.1.b) Execution of the contract

2. Public transport users

Purposes:

• Contracting services by telephone
• Assistance to transport users

Legitimate basis: 6.1.b) Execution of the contract

• Maintaining the safety of people and property

Legitimate basis: 6.1.e) Mission carried out in the public interest

Type of personal data: voice

Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.

Data storage: The data shall be kept for a maximum period of one month from their collection, except when they must be kept to prove the commission of acts against the integrity of persons, goods or facilities. In such cases, the images will be made available to the competent authority no later than seventy-two hours after the existence of the recording became known. Once this maximum period of one month has elapsed since the data was collected without such an event occurring, the data will be deleted from our systems.

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: users of public transport and citizens

Type of personal data:

• Identification and contact details: name and First Surname, ID, date of birth, email address, telephone number and address.

Purpose:

• Intervention of the transport ticket
• Management of public transport offence files
• Payment of offences

Legitimacy: 6.1.c) Legal obligation

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: : TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: users of public transport, customers and citizens.

Type of personal data:

• Contact details: name and First Surname and email address

Purpose: Register

Legitimacy: 6.1.a) Consent of the interested party: register at JoTMBé, Hola Barcelona or TMB webs.

Data communication: It will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, public transport users, customers and citizens.

Type of personal data:

• Identification data: Name, ID, telephone number, ID, signature
• Health Details
• Image
• Bank details: credit cards

Purpose: custody and management of the objects found in the TMB facilities.

Legitimacy: 6.1.c) Legal obligation

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

Type of personal data:

• Identification and contact data: Name and First Surname and email address.

Purpose: newsletter user management with information on the latest news, services and offers.

Legitimacy: 6.1.a) Consent of the interested party

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, candidates and trainee students.

Type of personal data:

• Contact details: name and First Surname, ID number and email address
• Education and training data
• Health details

Purpose: personnel recruitment for new job vacancies or traineeships.

egitimacy:

• 6.1.b) Contract execution
• 6.1.c) Legal obligation

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: users of public transport, customers and citizens.

Type of personal data:

• Identification and contact details: name and First Surname, ID, date of birth, email address and telephone number.

Purpose: management of complaints, allegations and claims received by the entity.

Legitimacy: 6.1.c) Legal obligation

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees and trainee students.

Type of personal data:

• Identification data: ID, Social Security number, image, signature / electronic signature, if necessary.
• Family data
• Health data
• Economic and bank details
• Data on union membership (for payroll deduction) and union representation (for time management and regulation compliance)
• Digital fingerprint pattern for CAP Training courses
• Data on CV, training and professional experience
• Data on psycho-professional and competence profile

Purpose:

• Employment management: contracts and social security registration (registration and de-registrations and modifications).
• Payroll: time management, leaves, holidays, absences from work, seniority, advances, legal retentions and social benefits.
• Occupational risks prevention
• Management and control of training programmes
• Job development
• Assessment and guidance for the professional career, talent and development programs
• Pension plan management for affiliated employees
• Union membership data, in order to deduct the union fee from the employee's payroll.
• Data on union representation to manage syndicate relays, information to union representatives.
• Management of disciplinary files
• Sending communications and contact with the employee and any other purpose relating to the employment relationship with the employee.
• We will also manage your data to respond to your requests or complaints, if necessary.

Legitimacy:

• 6.1.a) Consent of the interested party
• 6.1.b) Contract execution
• 6.1.c) Legal obligation

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

Type of personal data:

• Identification and contact details: Name and First Surname, ID, telephone number.
• Image

Purpose:

• Preserving the safety of people, property and facilities
• Access and registration control

Legitimacy: 6.1.e) An initiative undertaken in the public interest

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: candidates, employees and ex-employees

Type of personal data:

• Contact details: name and First Surname, ID, Social Security number and email address
• Employment data
• Health data

Purpose:

• Medical aptitude tests for candidates
• Control and monitoring of workers' health health surveillance, diagnostic tests, aptitude assessments and worksite adjustments.
• Management and custody of clinical records
• Social assistance

Legitimacy:

• 6.1.b) Contract execution
• 6.1.c) Legal obligation

Data communication: data may be shared with health care suppliers and public entities.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

Type of personal data:

• Identification data: name and Surnames, ID/NIF/Identification document, address, Social Security number and telephone.
• Details of the employment position
• Economic, financial and insurance details: bank details
• Health details
• Occupation data: employment position, category

Purpose:

• Document management
• Management of internal tools and systems

Legitimacy:

• 6.1.b) Contract execution
• 6.1.f) Legitimate interest

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: citizens

Type of personal data:

• Contact details: Name and First Surname, ID number and email address.

Purpose: register and process requests for access to public information and complaints made in compliance with current regulations on transparency.

Legitimacy: 6.1.c) Legal obligation

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: users of public transport, customers and citizens.

Type of personal data:

• Contact details: name and first surname and email address
• Ticket sales: invoice details: ID, address, Tax ID
• Sale of transport tickets and contractual communications to notify the user of actions taken on purchased tickets

Purpose: sale of transport tickets and contractual communications to notify the user of actions taken on purchased tickets.

Legitimacy: 6.1.b) Contract execution

Data communications: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties:

1. Employees

Purposes:

• Supervision and management of circulation activities
• Incident/accident investigation (service quality)
• Maintaining the safety of people and property

Legitimate basis: 6.1.e) Mission carried out in the public interest

• Investigation of incidents/accidents (Prevention of Occupational Risks)

Legitimate basis: 6.1.c) Compliance with a legal obligation

2. Public transport users

Purposes:

• Maintaining the safety of people and property

Legitimate basis: 6.1.e) Mission carried out in the public interest

Type of personal data: images

Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.

Data storage: the data shall be kept for a maximum period of one month from their collection, except when they must be kept to prove the commission of acts against the integrity of persons, goods or facilities. In such cases, the images will be made available to the competent authority no later than seventy-two hours after the existence of the recording became known. Once this maximum period of one month has elapsed since the data was collected without such an event occurring, the data will be deleted from our systems.

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: public transport users, customers and citizens.

Type of personal data:

• Contact details: Name and First Surname and email address

Purpose:

• Inform and send alerts on incidents that have an impact on TMB public transport.
• Alerts, communications or surveys on products or services offered.

Legitimacy: 6.1.f) Legitimate interest

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not forseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: public transport users, customers and citizens.

Type of personal data:

• Contact details: Name and First Surname, DNI, postal code, town, cell phone number and email address

Purpose:

• Undertake business prospecting
• News and newsletters
• Attend contests and rewards
• Conducting surveys

Legitimacy: 6.1.a) Consent of the interested party

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not forseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: public transport users, customers and citizens.

Type of personal data:

• Contact details: Name and First Surname, phone number and email address

Purpose: offer TMB products or provide TMB services.

Legitimacy:

• 6.1.a) Consent of the interested party
• 6.1.b) Contract execution

Data communication: when contracting services or products, data may be communicated to companies providing these services or to assessment and review companies in order to know our customers' opinion about these services.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers:

• Generally speaking, no international transfers are foreseen.
• In the service provided through elMeuBus, international transfers to the USA are foreseen, with appropriate guarantees.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: employees

Purposes:

• Supervision and management of circulation activities
• Incident/accident investigation (service quality)
• Maintaining the safety of people and property

Legitimate: 6.1.e) Mission carried out in the public interest

• Investigation of incidents/accidents (Occupational Risk Prevention)

Legitimate: 6.1.c) Compliance with a legal obligation

• Control of contractual obligations

Legitimate basis: 6.1.b) Execution of the contract

Type of personal data: location data

Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.

Data storage: the location data will be duly blocked, in accordance with article 32 LOPDGDD, for a period of three (3) years from the moment the purposes for which they were collected have been fulfilled.

International transfers: not forseen.

Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Type of interested parties: TMB App users

Purposes:

• Location of nearby transport.
• User location on maps.
• Calculation of transport routes.
• Alerts of bus arrivals at bus stops and warning the driver of a blind person at a stop.

Legitimacy: 6.1.a) Consent of the interested party.

Type of personal data: localition data

Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.

Data storage: TMB App users location data is not stored.

International transfers: TMB App users location data is not stored, so international transfers are not forseen.

Safety measures: TMB App users location data is not stored, so there is no need for storage safety mesures.

Exercise of rights: TMB App users location data is not stored, so there is no need for the exertion of data protection rights.