Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as Spanish Law 3 of 5 December 2018 on the protection of personal data and guarantee of digital rights, and in compliance with Law 34 of 11 July 2002 on information society services and electronic commerce (LSSICE), SOCIETAT CATALANA PER A LA MOBILITAT, SA hereby declares that it is the owner of the Website and, taking into account Article 10 of the said law, provides the following information:
Company name: SOCIETAT CATALANA PER A LA MOBILITAT, SA
Trade name: SocMobilitat
Company tax (CIF) no.: A66383761
Registered office: Gran Via de les Corts Catalanes, 16-20, P 1, 08902 L’Hospitalet de Llobregat
Email for exercising rights: firstname.lastname@example.org
Data Protection Officer (DPO): email@example.com
Activity: Implementation of the T-mobilitat project, which involves a new technological, fare and management system in conjunction with the Metropolitan Transport Authority (ATM), and others.
It is registered in the Barcelona Companies Register: T 44514, F 59, S 8, H B 458.377
Website: www.socmobilitat.cat (hereinafter, the Website)
OBTAINING YOUR DATA
SocMobilitat may have obtained your personal data through one of the following sources:
- Through your registration as a client: data provided directly by the client.
- Through public sources: data obtained through different public sources such as public authorities, magazines, business cards, professional associations, online publications, websites, social media and telephone directories.
- Through your request for information on the Website and/or emails.
- When you register to use our websites, applications or services (including free trials); this information may include your name (and trade name), address, email address and telephone number. We may also ask you for additional information about your professional activity and preferences.
- When you submit a request through our websites, applications or services: this may include your name (and trade name), address, means of contact (such as telephone number and email address) and payment details.
- When you interact with us on our social networks.
- When you provide your contact details when registering to use or access any websites, applications or services we make available, or when you update the said data; and when you contact us through offline channels such as by telephone, text message, WhatsApp, email or ordinary mail.
We also collect your data when you fill out forms on our Website and/or other online forms, even when you do so partially and/or when you stop entering information; we may therefore use the said data to contact you and remind you to provide the missing details and/or for marketing purposes.
In addition to your personal data that we collect, we can gather information on you from other sources such as third parties authorized to share such information, credit agencies, search information providers and public sources, pursuant to applicable legislation in each case.
TRANSFERRING THIRD-PARTY DATA
If you provide us with another person’s personal data, you will be responsible for ensuring all obligations are complied with in terms of consent and information on applicable data protection legislation and on the said disclosure. To the extent required by applicable legislation on data protection, you must ensure that you have duly informed the other person and that you have his or her explicit consent to transfer his or her data, and of the purposes for which the data will be processed.
The legal basis for processing your data is the formalization of the service agreement and any transfer strictly necessary to fulfil this purpose, as well as our legitimate interest in you as a client and for having previously requested information on our products or services.
Sending commercial communications, data transfers to third parties and capture/use of images shall be legitimized at all times due to the express consent granted by you.
When processing your personal data, we shall apply the following principles, which meet the requirements of the new European data protection regulation:
- The principles of lawfulness, fairness and transparency: We shall always ask you for your consent to process your personal data for one or several specific purposes, of which we shall inform you in advance with absolute transparency.
- The principle of data minimization: We shall request data only when strictly necessary for the purposes for which we require them.
- The principle of storage limitation: Data shall be stored no longer than necessary for processing purpose; based on the purpose, we shall inform of the relevant storage period.
- The principle of integrity and confidentiality: Your data shall be processed to ensure appropriate security levels and guarantee their confidentiality. You should know that we take all the necessary precautions to prevent unauthorized public access or misuse of our Users’ data by third parties.
PURPOSES OF COLLECTING AND PROCESSING PERSONAL DATA
Below is a list of SocMobilitat’s different purposes for processing personal data.
1. To render services in the transport industry (T-mobilitat card).
This purpose includes different activities that are necessary and inherent to rendering the services or products.
- Maintenance and IT support.
- Cloud services.
- Intervention management.
- To contact you to see if you would like to participate in our client surveys (for example, by providing your opinion about using our applications, products and services).
- To assess, perform statistical analysis and benchmarking, provided this is done in these cases using aggregated data that cannot be linked to you or any other specific individual.
2. To send information and/or advertising on our products or services.
This purpose includes the use of your personal data to send you messages related to rendering, improving and updating our services, as well as advertising information on our special offers applicable to the product/service, or to send you information on industry regulations and innovations, based on your use of our applications and services.
SocMobilitat may use your contact details to carry out commercial actions and use communication channels (including, but not limited to, WhatsApp messages, emails and telephone calls) to send you information about products and services that may of interest to you.
You will be able to object to being sent further commercial communications at any time, and may make use of this right by sending an email to the address indicated for this purpose.
3. To transfer your data to companies to render the service.
SocMobilitat may transfer your data to companies linked to rendering services that are strictly necessary to implement the products or services commissioned by you, such as companies working in transport, IT and hosting services, and T-mobilitat project partners (FUJITSU, CAIXABANC, INDRA, MOVENTIA).
4. To communicate information on payment default.
In the event that you do not meet your financial obligations and generate a certain amount of debt, you shall be informed that we will communicate your identifying details and information on the debt to all bodies commissioned for advice, management and processing of payment defaults, in accordance with current legislation.
5. To manage forms for sending CVs.
The purpose of this processing is to enable you to participate in SocMobilitat recruitment procedures operating at present or in the future. We shall store your data for no more than two years unless you indicate the contrary and, in all cases, your data shall be stored for the compulsory period to comply with legal obligations.
DATA STORAGE PERIOD
Personal data provided shall be stored as long as necessary to render the commissioned services and respond to requests made, and in all cases, as long as the contractual relationship between the parties lasts, or for the number of years necessary to comply with the obligations imposed by other reference regulations. Therefore, in accordance with tax regulations, your data shall be stored for five years.
SocMobilitat shall apply the data erasure protocol in accordance with the provisions of current data protection regulations. In all cases, if lawsuits are pending when the contractual relationship ends, data may be stored until a definitive ruling is issued.
SocMobilitat may transfer your data to companies for administrative purposes or legal compliance (e.g. auditors, insurance companies, banking institutions and public authorities).
SocMobilitat may transfer your data to any and all companies required to perform the commissioned service or to claim late payments, including our service providers and agents (and their subcontractors) or third parties that process data on our behalf (service providers and Internet platforms, payment processing providers and organizations commissioned to send communications, among others), so they can help us offer you the applications, products, services and information you have requested or that we understand would be of interest to you.
In all cases when you have granted your express consent, SocMobilitat may transfer your data to outsourced companies to perform commercial actions on products and services that may be of interest to you.
Pursuant to the provisions of Article 22 of the EU General Data Protection Regulation (GDPR) 2016/679, you may exercise any of the following rights:
- Right to access: The right to know the kind of data we are processing and the characteristics of the processing we carry out.
- Right of rectification: The right to request the rectification of your data because they are inaccurate or untrue.
- Right to data portability: The right to obtain a copy of your information in an automated, easy-to-export format that is commonly used and electronically readable, or, when technically possible, the right to have your information sent directly to a different company.
- Right to restrict processing: To restrict processing of your data based on the specific purpose.
- Right of erasure: To request erasure of your data when processing is no longer necessary.
- Right to oppose processing: The right to request the termination of processing of your data for a specific purpose, such as for direct marketing.
- The right to oppose decisions based on automated processing of your personal data, such as profiling.
Likewise, you may withdraw the consent granted whenever processing your data hinges on your consent, subject to existing legal or contractual restrictions at all times, and you may file a complaint with the Supervisory Authority (AEPD) (https://www.aepd.es)
You may exercise any of the aforementioned rights by sending an email to the address firstname.lastname@example.org, and indicating in the subject line the right you wish to exercise and attaching a document that provides proof of your identity. However, you may also submit any queries you consider necessary to the email address of the Data Protection Officer: email@example.com
DATA ACCURACY AND VERACITY
As a User, you are the only party responsible for the veracity and accuracy of the data you send and attach to us, and you hereby exempt SocMobilitat from any liability in this regard.
In all cases, Users guarantee and are accountable for the accuracy, validity and authenticity of the personal data provided, and undertake to keep them duly updated. The User agrees to provide complete, correct information on the contact or subscription form. Users providing third-party data shall have the third party’s prior consent.
DATA CONFIDENTIALITY AND SECURITY
In its use and processing of data, including the personal data of Users, SocMobilitat undertakes to respect the confidentiality of these data and use them in accordance with their purpose, and to comply with its obligation to store them and adopt all measures to prevent their unauthorized alteration, loss, processing or access pursuant to the provisions of current data protection regulations.
This website has an SSL certificate. This security protocol ensures that your data are transported securely as a whole, i.e. all data transfers between the server and the Website User, as well as feedback, are fully encrypted.
SocMobilitat cannot guarantee the absolute invulnerability of the Internet and therefore cannot guarantee absolute protection from data breaches by means of fraudulent third-party access to data; nor can it assume liability for such attacks.
With regard to the confidentiality of processing, SocMobilitat shall ensure that any person authorized by SocMobilitat to process the data of client Users shall be under the obligation of confidentiality.
In the event of a security incident, SocMobilitat shall notify the client and User without undue delay and shall provide them with suitable information on the security incident as soon as and how it becomes available, or shall notify the Client when the Client makes a reasonable request for such information.
TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA
Within the European Union, personal data are protected by data protection legislation, but other countries do not necessarily protect their personal data in the same way.
Our Website and some of our applications, services or parts thereof may be hosted in the United States or other locations outside the European Economic Area (which includes all EU countries plus Norway, Iceland and Liechtenstein) (hereinafter, the “EEA”). This means that we may transfer data sent through the Website, application or service to a location outside the EEA in the United States or other territories outside the EEA. Emails we are sent shall also be stored on our email servers, which are hosted in the United States.
We may use service providers located outside the EEA to help us make our Website, applications and services available to you (e.g. platform providers and payment service providers that help us offer our applications and services, or advertising, or for payment processing).
This implies that we may transfer your data to service providers outside the EEA for the purposes of providing you with our applications, advertising and services.
We adopt several actions to guarantee that the relevant protection measures and controls are implemented in accordance with applicable legislation and regulations on data protection when our service and hosting providers transfer your data to a location outside the EEA. In each case, the said transfers are made pursuant to the requirements of Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and may be based on the use of standard contractual clauses from the European Commission for transfers of personal data outside the EEA.
Our Website, applications or services may enable you to share data with social media websites or to use the said social media websites to create your account or connect to your social media account. These social media websites may provide us with automatic access to certain personal data they may hold on you (e.g. content you have viewed). You should be able to manage the privacy parameters in your account on the third-party social media website in order to decide on the personal data we can access from this account.
ACCEPTANCE AND CONSENT
Pursuant to the LSSICE, SocMobilitat does not engage in spamming, which means it does not send commercial emails that are not solicited or authorized by the User. Therefore, in each form on the Website, Users have the chance to give their express consent to receive commercial communications on the services and products offered by SocMobilitat, newsletters, etc., regardless of the commercial information they request on specific occasions.
In accordance with the provisions of Law 34 of 11 July 2002 on information society services and electronic commerce, SocMobilitat undertakes not to send commercial communications without duly identifying them.