TMB Processing Activities Register as Data Controller

Purpose: management and processing of the files with the insurance entities covering accidents, incidents between people or with the property and claims for damages received by TMB.

Legitimacy:

• 6.1.b) Contract execution
• 6.1.c) Legal obligation (RD 1575/1989, 22 December, approving the Regulation of Compulsory Travelers Insurance).

Type of interested parties:

• Employees, suppliers individuals and personnel of the suppliers (6.1.b) execution of the contract) and legal obligation in certain cases (in those cases where, for example, the accident or assault is typified in the CP).
• Public transport users, customers and citizens (6.1.c) legal obligation).

Type of personal data:

• Identification details: name and first surname, ID number./li>
• Contact details: telephone number and address.
• Health details.
• Image.

Data communication: may be shared with insurance companies and public entities that are competent in the matter.

International transfers: not foreseen.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion, based on their specific purpose, within a maximum period of 5 years (art. 23 Law 50/1980, of the Insurance Contract and 131 of the Criminal Code).

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: to manage the requests to exercise rights regarding personal data protection.

Legitimacy: 6.1.c) Legal obligation (LO 3/2018, December 5, Protection of Personal Data and Guarantee of Digital Rights).

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

• Employees, suppliers, natural person and personnel of the suppliers.
• Public transport users, customers and citizens in general.

Type of personal data:

• Identification details: name and surnames, ID number.
• Contact details: email address.
• Image (recent photograph) and ID photocopy (access to video surveillance images).
• The interested party's data affected by the exercise.

Data communication: shall not be communicated to third parties except for legal obligations.

International transfers: not foreseen.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, Tfrom which point they will be subject to blocking and subsequent deletion within a period of 3 years (art. 72.1 LOPDGDD).

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: process and manage TMB's Ethical Channel communications of possible violations.

Legitimacy: 6.1.c) Legal obligation (Law 2/2023, of February 23, on the protection of persons who report on regulatory violations and the fight against corruption).

Type of interested parties:

• Employees.
• Suppliers, natural person and personnel of the suppliers.
• Citizens in general.

Type of personal data:

• Contact details (if the communicator registers): email address.
• Data collected in communication.

Data communication: it will not be shared with third parties except in the event of a legal obligation (Courts of Justice, Public Prosecutor's Office, Anti-Fraud Office of Catalonia).

Data storage: the data will be kept for the period strictly necessary to comply with the purpose for which they were collected, unless the purpose of the conservation is to leave evidence of the operation of the crime prevention model by the legal person. Complaints that have not been acted upon may only be recorded anonymously, without the blocking obligation provided for in article 32 LOPDGDD being applicable.

In any case, the data collected will be subject to deletion within a maximum period of 10 years (arts. 26 and 32 and Law 2/2023).

International transfers: not foreseen.

Safety measurest: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Management of initiatives and commercial and promotional services
• Facility hire and services
• Income from advertising

Legitimacy: 6.1.b) Contract execution

Type of interested parties: subcontractors, customers and citizens.

• Suppliers, natural person and personnel of the suppliers.
• Public transport users, customers and citizens in general.

Type of personal data:

• Identification data: Name and Surnames, ID/NIF/Identification document, address and telephone number.
• Economic, financial and insurance details: Bank details.
• Occupation data: employment position, category

Communication of the data: it will not be shared with third parties except for legal obligations.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion, within a period of 10 years (art. 121-20 Civil Code of Catalonia).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: management of suggestions, damage reports, justifications and processing of requests.

Legitimacy: 6.1.a) Consent of the interested party

Type of interested parties:

• Users of public transport, customers.
• Suppliers, natural person and personnel of suppliers.

Type of personal data:

• Identification details: name and surname, ID.
• Contact details: email address.

Communication of the data: it will not be shared with third parties except for legal obligations.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion within a period of 3 years (art. 72.1 LOPDGDD).

International transfers: not foreseen.

Safety measures:TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Processing of public procurement files.
• Management of contracts with awardees.

Legitimacy:

• 6.1.b) Contract execution
• 6.1.c) Legal obligation (Law 9/2017, November 8, on Public Sector Contracts).

Type of interested parties:

• Natural person bidders, and bidders' staff (6.1.b) legal obligation).
• Natural person contractors, and contractors' personnel (6.1.b) legal obligation and 6.1.c) execution of the contract).

Type of personal data:

• Identification data: name and surnames, ID document, address, electronic signature.
• Contact details: adress and telephone.
• Details of the employment position.
• Economic, financial and insurance details: bank details.

Data communication: it will not be shared with third parties except in the event of a legal obligation (Administrative procurement courts and courts of justice).

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time they will be subject to blocking and subsequent deletion, within a period of 3 years from that moment (art. 72.1 LOPDGDD), except for that information that is affected by the Transparency regulations, and that will be public for a period of 5 years (art. 13 Law 19/2014, on transparency, access to public information and good governance).

International transfers:: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: management and control of incoming and outgoing correspondence.

Legitimacy: 6.1.e) Public interest (registration of entry and exit of the documentation of Public Sector companies).

Type of interested parties:

• Public transport users, customers and citizens in general./li>
• Employees and staff of bidding companies and suppliers, commercial partners, collaborators and administrations./li>

Type of personal data:

• Identification and contact details: first and last name, ID.
• Contact details: telephone, address.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion within a period of 6 years (art. 30 Commercial Code).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Management and processing of legal files
• Legal counsel

Legitimacy: 6.1.f) Legitimate interest (effective judicial protection of TMB's interests).

Type of interested parties:

• Public transport users, customers and citizens in general.
• Employees and personnel of the suppliers.

Type of personal data:

• Identification data: Name, ID, telephone, address, signature
• Health Details
• Employment details
• Academic and professional details
• Image and voice
• Economic data

Data communication: it may be shared with suppliers and public entities.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion within a period of 3 years (art. 72.1 LOPDGDD).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Formalisation of the contractual relationship.
• Contractual or collaborative relationship with third parties.
• Coordination of business activities.
• Management of the prevention of occupational risks.
• Management of payments and reimbursements.
• Carrying out surveys.

Legitimacy:

• 6.1.b) Contract execution.
• 6.1.c) Legal obligation: Law 9/2017, November 8, on Public Sector Contracts; Law 31/1995 on Prevention of occupational risks; RD 171/2004 which develops Law 31/1995 on the Coordination of Business Activities.

Type of interested parties: suppliers and natural person collaborators, and their staff.

Type of personal data:

• Identification data: name and surnames, ID/NIF/Identification document, address, Social Security Number and telephone.
• Economic, financial and insurance details: bank details.
• Health details.
• Occupation data: employment position, category.
• Professional Identification Cards (TIP).

Data communication: it will not be shared with third parties except in the event of a legal obligation or contractually required.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time it will be subject to blocking and subsequent deletion, based on its specific purpose, within a maximum period of 10 years (art. 25 Law 10/2010, April 28, on the prevention of money laundering and financing of terrorism).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: manage event organization and participation, as visits to schools or entities, filming at TMB's facilities, on-line activities or other events promoted by TMB.

Legitimacy: 6.1.a) Consent of the interested party.

Type of interested parties:

• Employees.
• Suppliers, natural person and personnel of the suppliers.
• Public transport users, customers and citizens in general.

Type of personal data:

• Identification data: name and first Surname, ID.
• Contact details: email address, telephone and postal address.
• Image and voice.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time they will be subject to blocking and subsequent deletion within a period of 3 years from that moment (art. 72.1 LOPDGDD).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Registration, management and monitoring of reported incidents and online requests.
• Management of user registrations and de-registrations on applications or software (Active Directory).
• Management of VPN permissions for suppliers.

Legitimacy: 6.1.b) Execution of the contract and legal obligation in certain cases (for example, in the event that the incident may affect personal data and the need to notify a security breach must be assessed).

Type of interested parties:

• Employees.
• Suppliers, natural person and personnel of the suppliers.

Type of personal data:

• Identification data: name, ID, employee number.
• Contact details: email address.
• Workplace details (timetable, equipment affected).

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. from which time they will be subject to blocking and subsequent deletion within a period of 3 years from that moment (art. 72.1 LOPDGDD; art. 4.1 LISOS).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: processing of the income and expense files arising from the execution of the budget and the responsible entity's activities.

Legitimacy: 6.1.c) Legal obligation (Law 58/2003, December 17, General Tax; Law 38/2003, November 17, General Subsidies).

Type of interested parties:

• Suppliers, business partners and natural person collaborators, as well as their staff.
• Administration staff.

Identification data:

• Identification data: Name and Surnames, ID/NIF/Identification Document, address, electronic signature and telephone number.
• Details of the employment position.
• Economic, financial and insurance details: bank details.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time it will be subject to blocking and subsequent deletion, based on its specific purpose, and will be subject to deletion in a maximum term of 10 years (art. 25 Law 10/2010, of April 28, on the prevention of money laundering and financing of terrorism).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purposes:

• Preserve the safety of people, goods and facilities.
• Incident/accident investigation (including quality of service).
• Supervision and management of circulation activities.
• Management of employee incidents.
• ontracting services by telephone.
• Assistance to transport users

Legitimate basis:

• 6.1.b) Execution of the contract.
• 6.1.c) Compliance with a legal obligation.
• 6.1.e) Mission carried out in the public interest.

Type of interested parties:

• Public transport users (6.1.b; 6.1.e)
• Employees, natural person suppliers and suppliers' staff (6.1.b; 6.1.c; 6.1.e).

Type of personal data: voice.

Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.

Data storage: the data shall be kept for a maximum period of one month from their collection, except when they must be kept to prove the commission of acts against the integrity of persons, goods or facilities. In such cases, the images will be made available to the competent authority no later than seventy-two hours after the existence of the recording became known. Once this maximum period of one month has elapsed since the data was collected without such an event occurring, the data will be deleted from our systems.

In the event that the data has as its object the contracting of services, they will be kept for the period necessary to comply with the purpose for which they were collected, from which point they will be subject to blocking and subsequent deletion within a period of 10 years from that moment (art. 121-20 Civil Code of Catalonia).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Intervention of the transport ticket.
• Management of public transport offence files.
• Payment of offences.

Legitimacy: 6.1.e) Mission carried out in the public interest.

Type of interested parties: users of public transport.

Type of personal data:

• Identification and contact details: name and first surname, ID, date of birth, email address, telephone number and address.
• Financial details: bank account number.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time they will be subject to blocking and subsequent deletion within a period of 3 years from the commission of the offense ( 58 Law 12/1987, on the regulation of passenger transport by road; 71 Law 4/2006, on railways).

International transfers: not foreseen.

Safety measures: : TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: management of the registration and maintenance of users on the organization's web areas.

Legitimacy: 6.1.a) Consent of the interested party

Type of interested parties: users of public transport, customers and citizens in general.

Type of personal data:

• Identification data: first and last name.
• Contact details: email address.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time they will be subject to blocking and subsequent deletion within a period of 3 years from that moment (art. 45 Law 34/2002, of July 11, on information society services and electronic commerce).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Management of the registration of users in the web space of lost objects.
• Registration, custody and return of lost objects at TMB facilities.

Legitimacy: 6.1.c) Legal obligation (Art. 615 Civil Code).

Type of interested parties:

• Employees, suppliers, natural person and personnel of the suppliers.
• Public transport users.

Type of personal data:

• Identification data: name, ID, telephone number, address, signature.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time they will be subject to blocking and subsequent deletion within a period of 3 years from that moment (art. 72.1 LOPDGDD).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: newsletter user management with information on the latest news, services and offers.

Legitimacy: 6.1.a) Consent of the interested party.

Type of interested parties:

• Employees, natural person suppliers and suppliers' staff.
• Public transport users, customers and citizens in general.

Type of personal data:

• Identification and contact data: name and surnames, email address.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time they will be subject to blocking and subsequent deletion within a period of 3 years from that moment (Art. 72.1 LOPDGDD).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: personnel recruitment for new job vacancies or traineeships.

Legitimacy: 6.1.a) Consent of the interested party.

Type of interested parties:

• Employees and trainee students.
• Citizens in general.

Type of personal data:

• Contact details: name and first surname, ID number and email address.
• Image.
• Education and training details.
• Data contained in the tests carried out.
• Health details.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, and will be subject to deletion within 3 years from that moment (art. 72.1 LOPDGDD).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: management of complaints, allegations and claims received by the entity.

Legitimacy: 6.1.c) Legal obligation (art. 211-14 Law 22/2010, of July 15, of the Consumer Code of Catalonia).

Type of interested parties: users of public transport, customers and citizens in general.

Type of personal data:

• Identification and contact details: name and first surname, ID.
• Contact details: email address and telephone (optional).

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time they will be subject to blocking and subsequent deletion and will be subject to deletion within a period of 4 years (art. 335- 1 Law 22/2010, July 15, the Consumer Code of Catalonia).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Employment management: contracts and social security registration (registration and de-registrations and modifications).
• Time management, permits, telecommuting, holidays, absences from the workplace, seniority.
• Payment of payroll, advances, judicial withholdings and social benefits.
• Occupational risks prevention.
• Management and control of training programmes.
• Job development.
• Assessment and guidance for the professional career, talent and development programs.
• Pension plan management for affiliated employees.
• Union membership data, in order to deduct the union fee from the employee's payroll.
• Data on union representation to manage syndicate relays, information to union representatives.
• Sending communications and contact with the employee and any other purpose relating to the employment relationship with the employee.

Legitimacy:

• 6.1.a) Consent of the interested party.
• 6.1.b) Contract execution.
• 6.1.c) Legal obligation (RDL 2/2015, October 23, Employees' Statute; Law 31/1995, November 8, on the Prevention of Occupational Risks; Organic Law 11/1985, August 2, on Trade Union Freedom; RDL 8/2019, March 8).

Type of interested parties: employees and trainee students, relatives (possible data of children under 14).

Type of personal data:

• Identification data: ID, Social Security number, image, signature / electronic signature, if necessary.
• Family data.
• Health data.
• Economic and bank details.
• Data on union membership (for payroll deduction) and union representation (for time management and regulation compliance).
• Digital fingerprint pattern for CAP Training courses.
• Data on CV, training and professional experience.
• Data on psycho-professional and competence profile.

Data communication: it will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time it will be subject to blocking and subsequent deletion, based on its specific purpose, within a maximum period of 10 years (art. 131 Penal Code).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Preserving the safety of people, property and facilities.
• Access and registration control.

Legitimacy:

• 6.1.b) Contract execution (control of access to the facilities by workers and supplier staff).
• 6.1.c) Compliance with legal obligation (art. 14 Law 8/2011 critical infrastructures: unequivocal identification of workers accessing this type of infrastructure).
• 6.1.e) An initiative undertaken in the public interest.

Type of interested parties:

• Employees, natural person suppliers and employees of the suppliers (6.1.b) contract execution; 6.1.c) Compliance with legal obligation).
• Public transport users, customers and citizens in general (6.1.e) An initiative undertaken in the public interest).

Type of personal data:

• Identification data: name and surnames, ID, vehicle registration.
• Contact details: telephone number.
• Image.

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: the data relating to the access of the interested parties will be kept for a maximum period of one month from when they were collected (Instruction 1/1996, of the AEPD, on automated files established for the purpose of controlling access to buildings).

With regard to the data of the employees to manage their registration in the systems that grant access permits to the different facilities, they will be kept for the period necessary to fulfill their purpose, from which time they will be subject to blocking and subsequent deletion within 3 years from that moment (art. 72.1 LOPDGDD).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Medical aptitude tests for candidates.
• Control and monitoring of workers' health health surveillance, diagnostic tests, aptitude assessments and worksite adjustments.
• Management and custody of clinical records.
• Social assistance.
• Assessment of psychosocial risks.

Legitimacy:

• 6.1.b) Contract execution.
• 6.1.c) Legal obligation (art. 22 Law 31/1995, November 8, on the Prevention of Occupational Risks).

Type of interested parties:

• Employees and ex-employees.
• Candidates.

Type of personal data:

• Identification data: name and surnames, ID, Social Security number.
• Contact details: telephone and email address.
• Employment data.
• Health data.

Data communication: data may be shared with health care suppliers and public entities.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which time it will be subject to blocking and subsequent deletion, based on its specific purpose, within a maximum period of 15 years (Art. 12.4 Law 21/2000, 29 December, on the rights of information concerning the patient's health and autonomy, and clinical documentation).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Document management.
• Management of internal tools and systems.

Legitimacy:

• 6.1.b) Contract execution.
• 6.1.f) Legitimate interest.

Type of interested parties: employees, subcontractors, public transport users, customers and citizens.

Type of personal data:

• Identification data: name and surnames, ID, address, Social Security number and telephone.
• Details of the employment position.
• Economic, financial and insurance details: bank details.
• Health details.
• Occupation data: employment position, category.

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected. The provisions of the archiving and documentation regulations will apply (Law 10/2001, of 13 July, on archives and documents).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: register and process requests for access to public information and complaints made in compliance with current regulations on transparency.

Legitimacy: 6.1.c) Legal obligation (Law 19/2014, December 29, on transparency, access to public information and good governance).

Type of interested parties: citizens in general.

Type of personal data:

• Identification data: name and surnames, ID.
• Contact details: email address.

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion within a period of 3 years (art. 90 Law 19/2014, December 29, on transparency, access to public information and good governance).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: sale of transport tickets and contractual communications to notify the user of actions taken on purchased tickets.

Legitimacy: 6.1.b) Contract execution.

Type of interested parties: users of public transport.

Type of personal data:

• Identification data: name and surnames.
• Contact details: email address.
• Invoice details: Tax ID, bank data.
• Social certificates, family data (sale of subsidized tickets).

Data communications: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion within a period of 10 years (Art. 121-20 Civil Code of Catalonia ).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purposes:

• Preserve the safety of people, property and facilities.
• Supervise and manage circulation activities.
• Investigate incidents/accidents (service quality/occupational risk prevention).

Legitimate basis:

• 6.1.c) Compliance with a legal obligation (art. 16 Law 31/1995, November 8, on the Prevention of Occupational Risks).
• 6.1.e) Mission carried out in the public interest.

Type of interested parties:

• Employees, natural person suppliers and personnel of the suppliers; trainees, candidates.
• Public transport users, customers and citizens in general.

Type of personal data: images.

Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.

Data storage: the data shall be kept for a maximum period of one month from their collection, except when they must be kept to prove the commission of acts against the integrity of persons, goods or facilities. In such cases, the images will be made available to the competent authority no later than seventy-two hours after the existence of the recording became known. Once this maximum period of one month has elapsed since the data was collected without such an event occurring, the data will be deleted from our systems (Art. 22 LOPDGDD).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Inform and send alerts on incidents that have an impact on TMB public transport.
• Alerts, communications or surveys on products or services offered.

Legitimacy: 6.1.f) Legitimate interest.

Type of interested parties: public transport users, customers and citizens in general.

Type of personal data:

• Identification data: name and surnames.
• Contact details: email address.

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion within a period of 3 years (Law 34/2002, 11 July, information society services and electronic commerce).

International transfers: not forseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• Undertake business prospecting.
• News and newsletters.
• Contests and rewards.

Legitimacy: 6.1.a) Consent of the interested party.

Type of interested parties: public transport users, customers and citizens.

Type of personal data:

• Identification data: name and surnames, ID.
• Contact details: postal code, town, cell phone number and email address.

Data communication: data will not be shared with third parties except in the event of a legal obligation.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion within a period of 3 years (Art. 24 of Law 34/2002 , of July 11, of information society services and electronic commerce).

International transfers: not forseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose: offer TMB products or provide TMB services.

Legitimacy: 6.1.b) Contract execution.

Type of interested parties: public transport users, customers and citizens.

Type of personal data:

• Identification data: name and surnames.
• Contact details: phone number and email address.

Data communication: when contracting services or products, data may be communicated to companies providing these services or to assessment and review companies in order to know our customers' opinion about these services.

Data storage: data will be kept for the time necessary to comply with the purpose for which it was collected, from which point they will be subject to blocking and subsequent deletion within a period of 10 years (Art. 121-20 Catalan Civil Code).

International transfers:

• Generally speaking, no international transfers are foreseen.
• In the service provided through elMeuBus, international transfers to the USA are foreseen, with appropriate guarantees.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purposes:

• Supervision and management of circulation activities.
• Incident/accident investigation (occupational risks prevention; service quality).
• Maintaining the safety of people, property and facilities.
• Control of contractual obligations.

Legitimate: 6.1.e) Mission carried out in the public interest.

• 6.1.b) Execution of the contract.
• 6.1.c) Compliance with a legal obligation (art. 16 Law 31/1995, November 8, on the Occupational Risks Prevention).
• 6.1.e) Mission carried out in the public interest.

Type of interested parties: employees.

Type of personal data: location data.

Data communication: the data will not be passed on to any third party unless there is a legal obligation to do so.

Data storage: the location data will be kept for the period necessary to comply with the purpose for which it was collected, from which time it will be subject to blocking and subsequent deletion within 3 years (art. 721 LOPDGDD).

International transfers: not forseen.

Safety measures: TMB maintains the necessary levels of security, according to the state of technology, the category of data stored, the risks and the specific regulations applicable to protect your personal data from accidental loss and unauthorised access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• To process and resolve disciplinary cases involving Transports Metropolitans de Barcelona staff.
• To enforce any reprimands or sanctions imposed.

Legitimacy: 6.1.b) Execution of the contract.

Type of interested parties: employees.

Type of personal data:

• Identification data: name and surnames.
• Contact details: postal address (sending of the notification burofax), telephone number.
• Employment data (duties assigned within the organisation).
• Data collected in the file.
• Trade union affiliation.

Data communication: The data can be communicated to the workers' legal representatives, as well as to the Courts and Tribunals.

Data storage: data relating to disciplinary proceedings will be kept for the period necessary to fulfil their purpose, from which point they will be subject to blocking and subsequent deletion within a period of 3 years from this moment (art. 72.1 LOPDGDD).

International transfers: not foreseen.

Safety measures: TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).

Purpose:

• To obtain aggregate bus occupancy data by identifying the number of users of the service.
• To obtain aggregate data on availability of PRM places.
• To prepare an origin-destination matrix, so that the routes taken by bus users can be identified.

Legitimacy: 6.1.f) Legitimate interest.

Type of interested parties:

• Users of public bus transport.
• Employees (bus drivers).

Type of personal data: image.

Data communication: the data will not be communicated to third parties unless this is required by law.

Data storage:: the data will not be kept except for the purpose of carrying out audits to verify the correct functioning of the system. Once checks have been carried out, the images are deleted.

International transfers: not foreseen.

Safety measures:

• The data processing system assigns an ID to each user who accesses the bus exclusively on the basis of characteristics such as height or colour of clothing, and does not use personal data such as a facial image. This ID is not reversible, so it is not possible to identify which ID corresponds to the image of each individual. The ID is used to produce the aggregate data that enables the purposes of the processing to be met.
• TMB maintains the necessary levels of security, taking into account the level of technology, the category of data stored and the risks, to protect your personal data from accidental loss and unauthorized access, processing or disclosure.

Exercise of rights:

• Rights that assist them: access, rectification, erasure, restriction of processing, opposition to processing, unless subject to automated individual decisions and portability by sending a request to dpd@tmb.cat. More information at Exercise of rights (GDPR).