Privacy and personal data protection policy

Website privacy policy
The Barcelona Metropolitan Transport Authority (hereafter ATM), as data controller, guarantees a proper, coherent level of protection for individuals concerning the processing of their personal data which is subject to treatment in accordance with Regulation (EU) 2016/679 of the European Parliament and the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) and the Spanish Personal Data Protection and Guaranteed Rights Act 3/2018 (LOPDiGDD).

The ATM only processes personal data with full responsibility and fidelity and following the principles concerning processing included in Article 5 of GDPR.
 
In order to comply with GDPR and the LOPDGDD, the ATM has drawn up a Log of Processing Activities and has adopted security measures appropriate for the risks to the rights and freedoms of the data subjects objectively assessed and identified that could result from the processing carried out by the ATM.

The ATM applies the principle of transparency in personal data processing, providing data subjects with concise, easily accessible, full information in language easy to understand and, at the same time, making it easy for them to exercise their rights using the following forms:

•    FORM FOR EXERCISING THE RIGHT TO ACCESS
Article 15 of the General Data Protection Regulation (EU) 2016/679.

•    FORM FOR EXERCISING THE RIGHT TO RECTIFICATION
Articles 16 and 19 of the General Data Protection Regulation (EU) 2016/679.

•    FORM FOR EXERCISING THE RIGHT TO ERASURE
Articles 17 and 19 of the General Data Protection Regulation (EU) 2016/679.

•    FORM FOR EXERCISING THE RIGHT TO OBJECTION
Article 21 of the General Data Protection Regulation (EU) 2016/679.

•    FORM FOR EXERCISING THE RIGHT TO RESTRICT PROCESSING
Articles 18 and 19 of the General Data Protection Regulation (EU) 2016/679.

•    FORM FOR EXERCISING THE RIGHT TO PORTABILITY
Article 20 of the General Data Protection Regulation (EU) 2016/679.

To exercise these rights, they can contact the ATM by filling in the corresponding Generic Request form, through this link, or by postal mail, to AUTORITAT DEL TRANSPORT METROPOLITÀ, Carrer Balmes, 49, 6a planta, 08007, Barcelona.

Further information concerning data protection is given here:
 
Data controller

Identity: Autoritat del Transport Metropolità 
Tax ID no.: P-5890049-I
Postal address: Carrer Balmes, 49, 6a planta, 08007 Barcelona
Telephone: +34 93 362 00 20
E-mail: atm@atm.cat
 
 

Data protection officer
Data protection officer: dpd@atm.cat
 
 

Purpose of processing 

The purposes for which the data are processed are records, service, paperwork, administration and responding to enquiries and/or communications from the data subject and passes and tickets requested by the data subject, on their own behalf or in representation of a third party. More specifically:

1.    Storing, dealing with, processing and replying to the data subject’s communications.

2.    Storing, dealing with and managing requests concerning data subjects’ acknowledged data protection rights.

3.    Managing user registration and the purchase of T-mobilitat tickets, and T-mobilitat informative and operative communications.

4.    Managing the use of the T-mobilitat app and website, and the service improvement.

5.    Statistical and scientific purposes.

 
Legal basis for the processing
The legal basis making the ATM’s processing of the data subjects’ personal data is as follows:

Regulation (EU) 2016/679 of the European Parliament and the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

• Article 6.1.b. The treatment is necessary for implementing a contract to which the data subject is party or for the application of precontractual measures at the data subject’s request.

  • Article 6.1.a. The data subject has given consent for the processing of their personal data.

  • Article 6.1.c. The processing is necessary for compliance with a legal obligation applicable to the controller.

  • Article 6.1.e. The processing is necessary for compliance with a duty being carried out in the public interest or in exercise of public powers conferred on the data controller.

 
Period held
The personal data of data subjects will be kept for the time necessary to comply with the purposes for which it was obtained in exercise of the ATM’s competences and functions, and to determine possible liabilities deriving from these purposes. The periods for which the data will be kept can be consulted in detail in the Log of Processing Activities (hereafter LPA). Once it ceases to be necessary, the ATM will keep personal data blocked until the possibility of any possible legal action expires.

The regulatory LPD relating to the processing of personal data carried out by this organisation can be consulted via this link.

 
Data subjects’ rights
The owners of data processed by the ATM have the acknowledged right to exercise the right of access to their data; rectification of erroneous or inaccurate data; erasure when, among other reasons, the data is no long necessary for the purposes for which it was collected; and portability of their data at any time. In certain circumstances, data subjects may request restriction of the processing of their data. In such cases, it will be kept only for making or defending against possible claims. Data subjects may also withdraw their consent at any time.

Data subjects may also oppose the processing of their data for reasons related to their particular situation. In such circumstances, the ATM will cease to process the data except for legitimate reasons or for making or defending against possible claims.

To exercise these rights, they can contact the ATM by filling in the corresponding Generic Request form, through this link, or by postal mail, to AUTORITAT DEL TRANSPORT METROPOLITÀ, Carrer Balmes, 49, 6a planta, 08007, Barcelona.

In addition, if they are not satisfied with the response to the exercise of their rights, or whenever they see fit, they may present a complaint to the Catalan Data Protection Authority via its online office at www.apdcat.gencat.cat.

Recipient of the data
The data will not be transferred to public or private third parties except in the case of legal obligation.

In the cases of passes and tickets associated with minors, their personal data will form part of the adult representative's account until they are of legal age, and the data subject takes the relevant steps to disassociate themselves.

Origin of the personal data
The personal data subject to treatment by the ATM if it is carrying out a duty in the public interest or in the exercise of public powers comes directly from the data subjects or their representatives.

International data transfers

No international data transfers are planned except in the following cases, when they will be made to third countries with an adequate level of protection, as declared by the European Commission, and with the provision of adequate guarantees, such as standard contractual clauses:

• When data provided in order to subscribe to our newsletter is sent by means of Mailchimp/Campaign Monitor/Active Campaign, which carries out its personal data processing in countries outside the European Union. The full version of their Privacy Policy can be consulted in their corresponding policies concerning the processing of data collected:

  • Mailchimp: https://mailchimp.com/gdpr/

  • Campaign Monitor: https://www.campaignmonitor.com/policies/#privacy-policy

  • Active Campaign: https://www.activecampaign.com/legal/privacy-policy

• ATM, which is the data controller, hires the company’s virtual infrastructure via Google/Microsoft following a cloud computing model, under standard contractual clauses. The information is available at:

  • GOOGLE: https://business.safety.google/compliance/?hl=en/ 

  • MICROSOFT: https://privacy.microsoft.com/en-us/privacystatement

• International data transfer is possible via third-party cookies (Liferay). You can find out about data transfers to third countries made by the third parties identified in this cookies policy in their corresponding policies concerning the processing of data collected. 

Categories of data subject to processing

Identifying data, data on personal characteristics, financial data, employment data.

Log of processing activities

The ATM processes your personal data legally, faithfully and transparently, restricting the purposes for which it can be collected.

In accordance with Article 30 of GDPR and Article 31 of the LOPDGDD, the ATM has drawn up a Log of Processing Activities relating to the processing of personal data made by this organisation. It can be consulted via this link.

In compliance with Article 30.2 of the GDPR and Article 31 of the LOPDGDD, the ATM, as the data processor, has prepared the mandatory Record of Processing Activities, related to the processing of personal data carried out on behalf of a data controller, which can be consulted through the following link.

For any questions, requests or complaints about personal data processing, users can contact the data protection officer by a Generic Request, through this link.

Users also have the right to present a complaint about the processing of their personal data to the Catalan Data Protection Authority at any time.

Communication through the social media

One possible channel of communication for addressing matters related to T-mobilitat is social media. It is important to consider that users who contact T-mobilitat's customer service through these channels are responsible for providing their personal information through these channels and are aware of the privacy policies of each one. It is recommended not to disclose sensitive personal data through these channels and to use them only for basic procedures or inquiries.