Last update: 03/03/2023
TMB Processing Activities Register as Data Controller
The entities responsible for processing the personal data are Ferrocarril Metropolità de Barcelona SA, Transports de Barcelona SA, Projectes i Serveis de Mobilitat SA and TMB SL.
Data Protection Officer contact details
TMB has a Data Protection Officer (DPO), to whom you can present any matter concerning the processing of your personal data. The Data Protection Officer will have a reasonable time of two months to reply to your enquiries.
If you need to make an enquiry, request or complaint regarding the processing of your personal data, you can contact the Data Protection Officer through the following email address: dpd@tmb.cat.
Accidents, incidents and assaults
Type of interested parties: employees, subcontractors, public transport users, customers and citizens.
Type of personal data:
- Identification and contact details: Name and First Surname, ID number, telephone number, address
- Health details
- Image
Purpose: management and processing of the files with the insurance entities covering accidents, incidents between people or with the property and claims for damages received by TMB.
Legitimacy:
- 6.1.b) Contract execution
- 6.1.c) Legal obligation
Data communication: may be shared with insurance companies and public entities that are competent in the matter.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Attention to the exercise of DP rights (RGPD)
Type of interested parties: employees, subcontractors, public transport users, customers and citizens.
Type of personal data:
- Contact details: Name and First Surname, ID number and email address
Purpose: to manage the requests to exercise rights regarding personal data protection.
Legitimacy: 6.1.c) Legal obligation
Data communication: shall not be communicated to third parties except for legal obligations.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Management of Code of Ethics complaints
Type of interested parties: employees, suppliers and citizens.
Type of personal data: The contents of the complaint received and, if the complainant voluntarily registers, their contact details (email).
Purpose: process and manage complaints through TMB's Ethics Channel regarding alleged violations.
Legitimacy: 6.1.e) An initiative undertaken in the public interest.
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: three months (Article 24 of Law 3/2018 on Data Protection and Guarantee of Digital Rights).
International transfers: not foreseen.
Safety measurest: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Commercialisation of non-fare business
Type of interested parties: subcontractors, customers and citizens.
Type of personal data:
- Identification data: Name and Surnames, ID/NIF/Identification document, address and telephone number.
- Economic, financial and insurance details: Bank details.
- Occupation data: employment position, category
Purpose:
- Management of initiatives and commercial and promotional services
- Facility hire and services
- Income from advertising
Legitimacy: 6.1.b) Contract execution
Communication of the data: it will not be shared with third parties except for legal obligations.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Consultations, requests and suggestions
Type of interested parties: users of public transport, customers, citizens and business people/professionals.
Type of personal data:
- Contact details: Name and First Surname, ID number and email address.
Purpose: management of suggestions, damage reports, justifications and processing of requests.
Legitimacy: 6.1.a) Consent of the interested party
Communication of the data: it will not be shared with third parties except for legal obligations.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures:TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Public procurement
Type of interested parties: bidders and contractors.
Type of personal data:
- Identification data: Name and Surnames, ID/NIF/Identification document, address, electronic signature and telephone.
- Details of the employment position
- Economic, financial and insurance details: Bank details.
Purpose: processing of public procurement files.
Legitimacy:
- 6.1.b) Contract execution
- 6.1.c) Legal obligation
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers:: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Correspondence and registration
Type of interested parties: public transport users, customers, citizens, employees, bidders, subcontractors and suppliers, business partners, collaborators and public administrations.
Type of personal data:
- Identification and contact data : Name and First Name, ID, telephone, address
Purpose: management and control of incoming and outgoing correspondence.
Legitimacy: 6.1.f) Legitimate interest
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Legal defence
Type of interested parties: employees, subcontractors, public transport users, customers and citizens.
Type of personal data:
- Identification data: Name, ID, telephone, address, signature
- Health Details
- Employment details
- Academic and professional details
- Image and voice
- Economic data
Purpose:
- Management and processing of legal files
- Legal counsel
Legitimacy: 6.1.c) Legal obligation
Data communication: it may be shared with suppliers and public entities.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Management of suppliers and collaboration agreements
Type of interested parties: suppliers and collaborators.
Type of personal data:
- Identification data: Name and Surnames, ID/NIF/Identification document, address, Social Security Number and telephone
- Economic, financial and insurance details: Bank details
- Health details
- Occupation data: employment position, category
- Professional Identification Cards (TIP)
Purpose:
- Formalisation of the contractual relationship
- Contractual or collaborative relationship with third parties
- Coordination of business activities
- Management of the prevention of occupational risks
- Management of payments and reimbursements
- Carrying out surveys
Legitimacy:
- 6.1.b) Contract execution
- 6.1.c) Contract execution
Data communication: it will not be shared with third parties except in the event of a legal obligation or contractually required.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Management of activities and events
Type of interested parties: employees, subcontractors, public transport users, customers and citizens.
Type of personal data:
- Identification data and contact details: Name and First Surname, ID, email adress, telephone and adress
- Image and voice
Purpose:manage event organization and participation, as visits to schools or entities, filming at TMB's facilities, on-line activities or other events promoted by TMB.
Legitimacy: 6.1.a) Consent of the interested party
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Management of incidents and requests at the Technology Support Centre (TSC)
Type of interested parties: employees and subcontractors.
Type of personal data:
- Identification data: Name, ID, user, employee number, email, occupation data
- Occupation data
Purpose:
- Registration, management and monitoring of reported incidents and online requests
- Management of user registrations and de-registrations on applications or software (Active Directory))
- Management of VPN permissions for suppliers
Legitimacy: 6.1.f) Legitimate interest
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Economic and budget management
Type of interested parties: subcontractors and suppliers, partners, Sales staff, collaborators and public administrations.
Identification data:
- Identification data: Name and Surnames, ID/NIF/Identification Document, address, electronic signature and telephone number
- Details of the employment position
- Economic, financial and insurance details: bank details.
Purpose: processing of the income and expense files arising from the execution of the budget and the responsible entity's activities.
Legitimacy: 6.1.c) Legal obligation
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Voice recordings
Type of interested parties:
1. Employees
Purposes:
- Preserve the safety of people, goods and facilities
- Incident/accident investigation (service quality)
- Supervision and management of circulation activities
Legitimate basis: 6.1.e) Mission carried out in the public interest
- Investigation of incidents/accidents (Prevention of Occupational Risks)
Legitimate basis: 6.1.c) Compliance with a legal obligation
- Management of employee incidents
Legitimate basis: 6.1.b) Execution of the contract
2. Public transport users
Purposes:
- Contracting services by telephone
- Assistance to transport users
Legitimate basis: 6.1.b) Execution of the contract
- Maintaining the safety of people and property
Legitimate basis: 6.1.e) Mission carried out in the public interest
Type of personal data: voice
Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.
Data storage: The data shall be kept for a maximum period of one month from their collection, except when they must be kept to prove the commission of acts against the integrity of persons, goods or facilities. In such cases, the images will be made available to the competent authority no later than seventy-two hours after the existence of the recording became known. Once this maximum period of one month has elapsed since the data was collected without such an event occurring, the data will be deleted from our systems.
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Offences
Type of interested parties: users of public transport and citizens
Type of personal data:
- Identification and contact details: name and First Surname, ID, date of birth, email address, telephone number and address.
Purpose:
- Intervention of the transport ticket
- Management of public transport offence files
- Payment of offences
Legitimacy: 6.1.c) Legal obligation
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: : TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Register at TMB web site: JoTMBé, Hola Barcelona and TMB
Type of interested parties: users of public transport, customers and citizens.
Type of personal data:
- Contact details: name and First Surname and email address
Purpose: Register
Legitimacy: 6.1.a) Consent of the interested party: register at JoTMBé, Hola Barcelona or TMB webs.
Data communication: It will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Lost property
Type of interested parties: employees, public transport users, customers and citizens.
Type of personal data:
- Identification data: Name, ID, telephone number, ID, signature
- Health Details
- Image
- Bank details: credit cards
Purpose: custody and management of the objects found in the TMB facilities.
Legitimacy: 6.1.c) Legal obligation
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Press and News
Type of interested parties: employees, subcontractors, public transport users, customers and citizens.
Type of personal data:
- Identification and contact data: Name and First Surname and email address.
Purpose: newsletter user management with information on the latest news, services and offers.
Legitimacy: 6.1.a) Consent of the interested party
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Recruitment procedures
Type of interested parties: employees, candidates and trainee students.
Type of personal data:
- Contact details: name and First Surname, ID number and email address
- Education and training data
- Health details
Purpose: personnel recruitment for new job vacancies or traineeships.
egitimacy:
- 6.1.b) Contract execution
- 6.1.c) Legal obligation
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Customer complaints, allegations and claims
Type of interested parties: users of public transport, customers and citizens.
Type of personal data:
- Identification and contact details: name and First Surname, ID, date of birth, email address and telephone number.
Purpose: management of complaints, allegations and claims received by the entity.
Legitimacy: 6.1.c) Legal obligation
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Human Resources
Type of interested parties: employees and trainee students.
Type of personal data:
- Identification data: ID, Social Security number, image, signature / electronic signature, if necessary.
- Family data
- Health data
- Economic and bank details
- Data on union membership (for payroll deduction) and union representation (for time management and regulation compliance)
- Digital fingerprint pattern for CAP Training courses
- Data on CV, training and professional experience
- Data on psycho-professional and competence profile
Purpose:
- Employment management: contracts and social security registration (registration and de-registrations and modifications).
- Payroll: time management, leaves, holidays, absences from work, seniority, advances, legal retentions and social benefits.
- Occupational risks prevention
- Management and control of training programmes
- Job development
- Assessment and guidance for the professional career, talent and development programs
- Pension plan management for affiliated employees
- Union membership data, in order to deduct the union fee from the employee's payroll.
- Data on union representation to manage syndicate relays, information to union representatives.
- Management of disciplinary files
- Sending communications and contact with the employee and any other purpose relating to the employment relationship with the employee.
- We will also manage your data to respond to your requests or complaints, if necessary.
Legitimacy:
- 6.1.a) Consent of the interested party
- 6.1.b) Contract execution
- 6.1.c) Legal obligation
Data communication: it will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Safety
Type of interested parties: employees, subcontractors, public transport users, customers and citizens.
Type of personal data:
- Identification and contact details: Name and First Surname, ID, telephone number.
- Image
Purpose:
- Preserving the safety of people, property and facilities
- Access and registration control
Legitimacy: 6.1.e) An initiative undertaken in the public interest
Data communication: data will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Employment safety and health
Type of interested parties: candidates, employees and ex-employees
Type of personal data:
- Contact details: name and First Surname, ID, Social Security number and email address
- Employment data
- Health data
Purpose:
- Medical aptitude tests for candidates
- Control and monitoring of workers' health health surveillance, diagnostic tests, aptitude assessments and worksite adjustments.
- Management and custody of clinical records
- Social assistance
Legitimacy:
- 6.1.b) Contract execution
- 6.1.c) Legal obligation
Data communication: data may be shared with health care suppliers and public entities.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Treatment of information stored in TMB's systems and software
Type of interested parties: employees, subcontractors, public transport users, customers and citizens.
Type of personal data:
- Identification data: name and Surnames, ID/NIF/Identification document, address, Social Security number and telephone.
- Details of the employment position
- Economic, financial and insurance details: bank details
- Health details
- Occupation data: employment position, category
Purpose:
- Document management
- Management of internal tools and systems
Legitimacy:
- 6.1.b) Contract execution
- 6.1.f) Legitimate interest
Data communication: data will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Transparency and access to public information
Type of interested parties: citizens
Type of personal data:
- Contact details: Name and First Surname, ID number and email address.
Purpose: register and process requests for access to public information and complaints made in compliance with current regulations on transparency.
Legitimacy: 6.1.c) Legal obligation
Data communication: data will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Sales of transport tickets
Type of interested parties: users of public transport, customers and citizens.
Type of personal data:
- Contact details: name and first surname and email address
- Ticket sales: invoice details: ID, address, Tax ID
- Sale of transport tickets and contractual communications to notify the user of actions taken on purchased tickets
Purpose: sale of transport tickets and contractual communications to notify the user of actions taken on purchased tickets.
Legitimacy: 6.1.b) Contract execution
Data communications: data will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Video surveillance
Type of interested parties:
1. Employees
Purposes:
- Supervision and management of circulation activities
- Incident/accident investigation (service quality)
- Maintaining the safety of people and property
Legitimate basis: 6.1.e) Mission carried out in the public interest
- Investigation of incidents/accidents (Prevention of Occupational Risks)
Legitimate basis: 6.1.c) Compliance with a legal obligation
2. Public transport users
Purposes:
- Maintaining the safety of people and property
Legitimate basis: 6.1.e) Mission carried out in the public interest
Type of personal data: images
Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.
Data storage: the data shall be kept for a maximum period of one month from their collection, except when they must be kept to prove the commission of acts against the integrity of persons, goods or facilities. In such cases, the images will be made available to the competent authority no later than seventy-two hours after the existence of the recording became known. Once this maximum period of one month has elapsed since the data was collected without such an event occurring, the data will be deleted from our systems.
International transfers: not foreseen.
Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Alerts and surveys on contracted services
Type of interested parties: public transport users, customers and citizens.
Type of personal data:
- Contact details: Name and First Surname and email address
Purpose:
- Inform and send alerts on incidents that have an impact on TMB public transport.
- Alerts, communications or surveys on products or services offered.
Legitimacy: 6.1.f) Legitimate interest
Data communication: data will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not forseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Commercial campaigns, contests, surveys and communications (newsletters)
Type of interested parties: public transport users, customers and citizens.
Type of personal data:
- Contact details: Name and First Surname, DNI, postal code, town, cell phone number and email address
Purpose:
- Undertake business prospecting
- News and newsletters
- Attend contests and rewards
- Conducting surveys
Legitimacy: 6.1.a) Consent of the interested party
Data communication: data will not be shared with third parties except in the event of a legal obligation.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers: not forseen.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Contracting of products or services offered by TMB
Type of interested parties: public transport users, customers and citizens.
Type of personal data:
- Contact details: Name and First Surname, phone number and email address
Purpose: offer TMB products or provide TMB services.
Legitimacy:
- 6.1.a) Consent of the interested party
- 6.1.b) Contract execution
Data communication: when contracting services or products, data may be communicated to companies providing these services or to assessment and review companies in order to know our customers' opinion about these services.
Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).
International transfers:
- Generally speaking, no international transfers are foreseen.
- In the service provided through elMeuBus, international transfers to the USA are foreseen, with appropriate guarantees.
Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Geolocation
Type of interested parties: employees
Purposes:
- Supervision and management of circulation activities
- Incident/accident investigation (service quality)
- Maintaining the safety of people and property
Legitimate: 6.1.e) Mission carried out in the public interest
- Investigation of incidents/accidents (Occupational Risk Prevention)
Legitimate: 6.1.c) Compliance with a legal obligation
- Control of contractual obligations
Legitimate basis: 6.1.b) Execution of the contract
Type of personal data: location data
Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.
Data storage: the location data will be duly blocked, in accordance with article 32 LOPDGDD, for a period of three (3) years from the moment the purposes for which they were collected have been fulfilled.
International transfers: not forseen.
Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.
Exercise of rights:
- Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).
Type of interested parties: TMB App users
Purposes:
- Location of nearby transport.
- User location on maps.
- Calculation of transport routes.
- Alerts of bus arrivals at bus stops and warning the driver of a blind person at a stop.
Legitimacy: 6.1.a) Consent of the interested party.
Type of personal data: localition data
Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.
Data storage: TMB App users location data is not stored.
International transfers: TMB App users location data is not stored, so international transfers are not forseen.
Safety measures: TMB App users location data is not stored, so there is no need for storage safety mesures.
Exercise of rights: TMB App users location data is not stored, so there is no need for the exertion of data protection rights.