PRIVACY POLICY

 

This data privacy policy governs the use of data by TRAM (TRAMVIA METROPOLITÀ, S.A., TRAMVIA METROPOLITÀ DEL BESÒS, S.A., TRAMBAIX UTE and TRAMBESÒS UTE)

 

1. Data controller

The following will act as Data Controllers, in accordance with the corresponding processing:

  • TRAMVIA METROPOLITÀ, S.A. with Tax ID (NIF) No. A62415641, postal address at Calle Córcega, 270, planta 4ª puerta 6ª 08008 Barcelona, and email address dpo@tram.cat
  • TRAMVIA METROPOLITÀ DEL BESÒS, S.A. with Tax ID (NIF) No. A63061626, postal address at Calle Córcega, 270, planta 4ª puerta 6ª 08008 Barcelona, and email addressdpo@tram.cat
  • TRAMBAIX UTE (comprising the companies TRANSDEV DIVISIÓN ESPAÑA, S.L. and MARFINA, S.L.) with Tax ID (CIF) No. U-62868906, postal address at Avenida Barcelona, s/n, 08970 Sant Joan Despí (Barcelona), email address dpd@trambcn.com and telephone number 900 701 181
  • TRAMBESÒS UTE (comprising the companies TRANSDEV DIVISIÓN ESPAÑA, S.L. and MARFINA, S.L.) with Tax ID (CIF) No. U-63304935, postal address at Avenida Barcelona, s/n, 08970 Sant Joan Despí (Barcelona), email address dpd@trambcn.com and telephone number 900 701 181

 

2. The purpose for which your data are used and parties having access to them

 

2.1. Accidents and incidents causing damage

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: The information provided will be used to investigate and record the accident or incident and to deal with any claims or compensation.

Data storage: Data will be stored for as long as necessary to deal with the accident or incident.

Parties using your data: Your data will be used by the operating company TRAMBAIX UTE if the case involves the TRAMBAIX tram system, or by the operating company TRAMBESÒS UTE if the case involves the TRAMBESÒS tram system, as Data Processors. Data may be disclosed to the relevant authorities in order to comply with the obligations related to the operation of the tram transport service and to facilitate the management and monitoring of said service by these bodies. Data may also be disclosed to insurance brokers and insurance companies in the event of an incident causing damage, and to national law enforcement forces, courts and tribunals.

Legal basis: TRAM will process the data on the grounds of its legitimate interest in complying with the contractual obligations arising from the transport service (Article 6(1)(f) GDPR). It will also process data in order to comply with the legal obligations established in Law 4/2006, of 31 March, on tramways, the Law on insurance and the Law governing public sector contracts (Article 6(1)(c) GDPR). Special categories of data may be processed, such as information regarding health, if this proves necessary for the formulation, presentation or rebuttal of complaints or claims arising from accidents or incidents leading to damage (Article 9(2)(f) GDPR).

 

2.2. Complaints Channel

Data controller: Tramvia Metropolità, S.A., Tramvia Metropolità del Besòs, S.A., Trambaix UTE and Trambesòs UTE.

Purpose: The personal details provided will be used exclusively in order to evaluate, analyse and respond to the complaint submitted and, if necessary, for TRAM to take appropriate action.

Data storage: Data compiled via the Complaints Channel will be deleted in a period not exceeding three months from receipt of the complaint, unless their conservation is intended to provide proof of the correct functioning of the crime prevention and detection model. Nevertheless, when this three-month period has expired, data may continue to be used to carry out any necessary internal investigation procedures and, at most, to undertake any legal proceedings arising from the events reported.

Parties using your data: Complaints submitted will be processed by Molins Advocats Defensa Penal, S.L.P, with Tax ID (CIF) No. B62565734 and postal address at Calle Aribau, 198 5º, 08036 Barcelona (BARCELONA). However, the Compliance Body of TRAM (TRAMVÍA METROPOLITÀ, SA., TRAMVIA METROPOLITÀ DEL BESÒS, SA., TRAMBAIX UTE and TRAMBESÒS UTE, as the company regarding which the complaint is submitted) will be responsible for any internal investigation that may be necessary. This information may also be disclosed to organisations and public administrations with authority in the matter and Courts and Tribunals, if required.

Legal basis: The legal basis for using the data is as follows: (i) the user’s consent given when completing the registration process and submitting the complaint, (ii) our legitimate interest in maintaining a complaints system that allows us to comply with our Code of Ethics and take action in the event of any illegal or inappropriate conduct, and (iii) compliance with a legal obligation.

 

2.3. Minimum payments (MP) and administrative complaints (AC)

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: Use of data for the proposal, formulation and notification of MP and AC.

Data storage: The time specified in current legislation for the presentation and rebuttal of complaints.

Parties using your data: Your data will be used by the operating company TRAMBAIX UTE if the case involves the TRAMBAIX tram system, or by the operating company TRAMBESÒS UTE if the case involves the TRAMBESÒS tram system, as Data Processors. Data may be disclosed to the relevant authorities in order to comply with the obligations related to the operation of the tram transport service and to facilitate the management and monitoring of said service by these bodies.

Legal basis: Compliance with a legal obligation.

 

2.4. Ticketing

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: Issue and control of tickets for use the tram services.

Data storage: Data will be kept for four years from the date on which they are received.

Parties using your data: Financial entities.

Legal basis: Execution of a contract to which the data subject is party.

 

2.5. Board of Directors

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: Management of procedures carried out by the Board of Directors.

Data storage: Until the organisation is dissolved.

Parties using your data: Tax authorities, National Securities Market Commission, Notaries and Court officers.

Legal basis: Legitimate interest of the data controller or a third party.

 

2.6. Professional contacts

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: Diary and accounting records of professional contacts managed by staff.

Data storage: Data will be kept for four years from the date on which they are received.

Parties using your data:

Legal basis: Legitimate interest of the data controller or a third party.

 

2.7. Accounting and tax management

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: To manage administrative tasks with customer companies, suppliers and employees, and accounts and tax obligations.

Data storage: Data will be kept for five years.

Parties using your data: Other public administration bodies, Social Security administration, Tax authority, notaries, court officers and financial entities.

Legal basis: Consent of the data subject and execution of a contract to which they are party.

 

2.8. Personnel management

Data controller: Tramvia Metropolità, S.A.

Purpose: Administrative and personnel management of employees.

Data storage: Data will be kept for four years.

Parties using your data: Social Security, tax authorities, financial entities and insurers.

Legal basis: Consent of the data subject and execution of a contract to which they are party.

 

2.9. Supplier management

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: To manage accounting and tax matters with the organisation’s suppliers.

Data storage: Five years for compliance with tax legislation and/or until the service is discontinued.

Parties using your data: Financial entities.

Legal basis: Execution of a contract to which the data subject is party.

 

2.10. Selection/recruitment of new employees

Data controller: Tramvia Metropolità, S.A.

Purpose: To manage data regarding those interested in joining the organisation’s staff, management of CVs and candidate selection processes.

Data storage: Data will be kept for one year from the date on which it is entered.

Parties using your data:

Legal basis: The execution of pre-contractual procedures.

 

2.11. Marketing

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: Management of marketing and corporate publicity campaigns.

Data storage: Until consent for the sending of publicity is revoked.

Parties using your data:

Legal basis: Consent of the data subject.

 

2.12. Press releases

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: Management of the information that TRAM wishes to issue to the media.

Data storage: Data will be kept for one year from the date of publication.

Parties using your data:

Legal basis: Legitimate interest of the data controller or a third party.

 

2.13. Requests from passengers

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: Management of queries, complaints and suggestions from users, lost property and assistance.

Data storage: Data will be kept for the time necessary to process and respond to the request and determine possible responsibility arising from this purpose and the use of data. The regulations governing archives and documentation may also be applicable.

Parties using your data: Data will be used by the operating company TRAMBAIX UTE if the case involves the TRAMBAIX tram system, or by the operating company TRAMBESÒS UTE if the case involves the TRAMBESÒS tram system, as Data Processors, and may be disclosed to the relevant authorities in order to comply with the obligations related to the operation of the tram transport service and to facilitate the supervision of said service by these bodies.

Legal basis: Data will be used in order to comply with the legal obligations (Article 6(1)(c) GDPR) that TRAM must respect, especially concerning the rights of users of the tram transport service, as established in Law 4/2006, of 31 March, on tramways, and in Law 22/2010, of 20 July, on the Catalan Consumers Code. In the case of requests concerning lost property, personal data will be used in the legitimate interest of the person who has lost the item (Article 6(1)(f) GDPR). Data obtained from recordings of calls to the customer service help line will be used according to TRAM’s legitimate interest, with a view to improving the quality of service, accrediting compliance with its legal obligations and dealing with possible liabilities (Article 6(1)(f) GDPR). When the request is made using one of the forms provided for this purpose, it will indicate the details that are compulsory for appropriate action to be taken. If these details are not provided, it may not be possible to act on the request.

 

2.14. Social Networks

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: To analyse the customer service provided and the presence of TRAM in these networks.

Data storage   

Parties using your data: Your data will be used by the operating company TRAMBAIX UTE if the case involves the TRAMBAIX tram system, or by the operating company TRAMBESÒS UTE if the case involves the TRAMBESÒS tram system, as Data Processors. IT services may be used to facilitate the analysis of information from social networks.

Legal basis: Data will be used according to TRAM’s legitimate interest in carrying out quality and efficiency analysis of its customer service and studying the significance of its profiles (Article 6(1)(f) GDPR).

 

2.15. TRAM Barcelona APP

Data controller: Tramvia Metropolità, S.A. and Tramvia Metropolità del Besòs, S.A.

Purpose: To provide information about the stops nearest the user’s location and audio information on the routes each vehicle follows, and to notify users of any issues and analyse the use of the app by users.

Data storage: -

Parties using your data: Your data will be used by the operating company TRAMBAIX UTE if the case involves the TRAMBAIX tram system, or by the operating company TRAMBESÒS UTE if the case involves the TRAMBESÒS tram system, as Data Processors. TRAM may use IT services to provide the services available via the app. Statistical analysis will be conducted via Google Inc., a US company which adheres to the Privacy Shield framework (Article 45 GDPR).

Legal basis: Data will be used on the basis of the consent given by the user when granting access to the data on the latter’s device, so that information can be provided on the nearest stop and on routes of interest, or when the user selects the option to be notified of any incidents (Article 6(1)(a) GDPR). The user’s data will also be used in accordance with TRAM’s legitimate interest in analysing the use of the app for statistical purposes (Article 6(1)(f) GDPR).

 

2.16. T-Empleat for concessionaire and operating staff

Data controller: Tramvia Metropolità, S.A.

Purpose: To issue a travel pass for each employee of Tramvia Metropolità, S.A., Trambaix UTE and Trambesòs UTE.

Data storage: Data will be deleted when employee status terminates.

Parties using your data: Public and private organisations and government bodies with authority in this area.

Legal basis: Execution of a contract to which the data subject is party.

 

2.17. Operational Safety

Data controller: Trambaix UTE and Trambesòs UTE.

Purpose: To ensure the proper functioning and safety of tramway operations and the facilities of TRAMBAIX UTE and TRAMBESÒS UTE. In order to do this, images are recorded of users or visitors during the operation of the tram services at tram stops, inside trams and at operational sites (depots, customer services offices); all calls made via the communication system at tram stop totems, located on automatic ticket machines, will be recorded, and visits to company facilities will be logged.

Data storage: The data will be kept for a maximum period of one month, unless it is necessary to keep the data beyond this period due to an accident or incident for which any of the following parties could be held responsible: TRAMBAIX UTE or TRAMBESÒS UTE, the franchise holders or government bodies and/or organisations with authority in this area and, in particular, the transport service.

Parties using your data: Data may be shared with franchise companies (TRAMVÍA METROPOLITÀ, SA or TRAMVIA METROPOLITÀ DEL BESÒS, SA, depending on whether the data relates to the TRAMBAIX tram system or the TRAMBESÒS tram system) and the relevant authorities, with the aim of fulfilling the obligations of the contract that governs the operation of tram services and facilitating the management and monitoring of these entities. Data may be shared with State security and police forces, lawyers, courts and tribunals, in the event of any incident that necessitates such sharing of information. TRAMBAIX UTE and TRAMBESÒS UTE manage the tram lines jointly, and each may therefore access the personal data for which the other is responsible. In the event of an incident, this data may also be shared with insurance companies and brokers, and they may also be accessed by companies contracted to carry out systems maintenance, and by security companies and auxiliary support services that manage access to the facilities.

Legal basis: Data processing on the grounds that they have a legitimate interest to comply with their contractual obligations and to ensure the security of their facilities and the transport service (Articles 22 and 8.1 LOPDGDD [Spanish Data Protection and Digital Rights Law]). This data processing must also be performed in order to comply with the legal obligations established in the Spanish Law on Public Sector Contracts and in Catalan Law 4/2006, of 31 March, relating to tramways (Article 8.1 LOPDGDD).

 

2.18. Financial Management

Data controller: Trambaix UTE and Trambesòs UTE.

Purpose: To provide the service, procurement, sales, payment management, sales management, compliance with accounting and tax obligations.

Data storage: Data will be kept for five years or the time necessary to deal with any possible liability arising from the provision of a public transport service by the company.

Parties using your data: Government and other bodies with powers related to the transport service.

Legal basis: Data for offering sales and, if such offers are accepted, for formalising the contract, tracking and executing the service or purchase, billing, payment and receipt of payment are used for the purpose of providing our services to the customer, making purchases and managing the service contracted (fulfilment of contract, Article 6(1)(b) GDPR). The data necessary for us to fulfil our accounting and tax obligations (billing, accounts, taxes) are used in accordance with fiscal legislation (Law on Value Added Tax, General Tax Law) (Article 6(1)(c) GDPR). The data requested are indispensable for the purposes described, it being impossible to proceed with the sale or to provide the service if they are not provided.

 

2.19. Human Resources1

Data controller: Trambaix UTE and Trambesòs UTE.

Purpose: To use information provided by candidates to carry out selection processes.

Data storage: If candidates are not selected, their identification details will be stored for a period of two years, during which they may not reapply for the same position. After this period, if candidates wish to continue to participate in selection processes, they must provide their details again.

Parties using your data: TRAMBAIX UTE and TRAMBESÒS UTE manage the tram lines jointly, and each may therefore access the personal data for which the other is responsible. Data will be disclosed to public and private organisations and government bodies with authority in this area and persons contracted for personnel and human resources selection.

Legal basis: Data will be used on the basis of the individual’s consent and, if the person should be selected, for the implementation of the contract and any pre-contractual measures necessary, in accordance with the express request of the data subject (Articles 6(1)(a) and 6(1)(b) GDPR). During the selection process, psychophysical and psychotechnical tests may be conducted if considered necessary for the post applied for. These special category data will be used in accordance with the individual’s express consent (Article 9(1)(a) GDPR). When information is provided using one of the forms created for this purpose, it will indicate the details that are compulsory for the application to proceed. If these details are not provided, it may not be possible to include the candidate in the selection process. The details of candidates who are not selected will be retained by TRAMBAIX UTE and TRAMBESÒS UTE for two years on the basis of their legitimate interest in not repeating the selection process for a candidate who has been rejected.

1 Information related to employees can be found on the company’s corporate intranet.

 

2.20. Occupational Safety

Data controller: Trambaix UTE and Trambesòs UTE.

Purpose: To use the data provided to comply with our legal obligations regarding employment.

Data storage    Data will be stored as long as the employee provides a service to the employer and as long as there may be any legal liability related to compliance with said obligations.

Parties using your data: TRAMBAIX UTE and TRAMBESÒS UTE manage the tram lines jointly, and each may therefore access the personal data for which the other is responsible. Data may also be processed by companies providing IT services who have been contracted to expedite the transfer of documentation regarding the coordination of risk prevention.

Legal basis: Data are used so that we can comply with our legal obligations (Article 6(1)(c) GDPR) regarding employment and the prevention of occupational hazards (Workers’ Statute, Social Security Law, Law on the Prevention of Occupational Hazards, Law on Subcontracting in the Construction Sector) and legislation on rail transport (Railway Law). Special category data related to accident investigations will be used as established in labour law (Article 9(1)(b) GDPR). The details requested will be indispensable for the purposes specified and failure to supply them may make it impossible for the employer to implement the contract.

 

2.21. Internal Communication2

Data controller: Trambaix UTE and Trambesòs UTE.

Purpose: To establish a channel for personnel involved in managing the tram service to communicate and interact.

Data storage: In all cases, data will be kept as long as the employee is working for the employer and after this period if necessary to resolve any possible liabilities.

Parties using your data: TRAMBAIX UTE and TRAMBESÒS UTE manage the tram lines jointly, and each may therefore access the personal data for which the other is responsible. They will also be used by third parties who provide IT maintenance services.

Legal basis: Data will be used by the different internal communication channels in order to fulfil employment contracts (Article 6(1)(b) GDPR), in accordance with the user’s consent (Article 6(1)(a) GDPR) and in accordance with the legitimate interest of the data controller in ensuring the safety of the tram service and encouraging communication between the employees of the companies involved in providing the service (Article 6(1)(f) GDPR).

2 More extensive information regarding this use of data can be found on the company’s corporate intranet.

 

3. Rights

Anyone has the right to obtain confirmation as to whether or not their data are being processed.

You can exercise your rights of access, rectification, erasure, data portability, restriction and right to object to their use, as well as the right not to be subject to a decision based solely on the automated processing of your data.

If necessary, these rights can be exercised by writing to the parties responsible for data at the postal and/or email addresses given in point 1 of this document.

Complaints may be submitted to the relevant authority, and if you wish to obtain further information regarding your data protection rights, you can contact the Catalan Data Protection Agency (http://apdcat.gencat.cat).