Privacy Policy

RCTA PRIVACY POLICY

1. Commitment

The Network of Metropolitan Transport Consortiums of Andalusia (RCTA), which includes the Metropolitan Transport Consortiums of the areas of Almería, Bahía de Cádiz, Campo de Gibraltar, Córdoba, Costa de Huelva, Granada, Jaén, Málaga, and Sevilla, affiliated with the Ministry of Development, Infrastructure, and Land Planning, carries out its mission through activities and services aimed at fulfilling the purposes of the development of its competency objectives. For this, on occasion, it must make use of treatments that include personal data.

The consortiums integrated into the Network of Metropolitan Transport Consortiums of Andalusia have maintained a rigorous privacy policy concerning the data of those who have had some relationship with each entity. The information about these people is always used in accordance with current regulations on the matter, Organic Law 3/2018, of December 5, on Personal Data Protection and guarantee of digital rights, whose purpose is to adapt Spanish law to the General Data Protection Regulation, GDPR, (EU) 2016/679.

With this, the aim is always to ensure respect for the principles related to the processing of personal data established in article 5 of the aforementioned General Data Protection Regulation and, in particular, transparency and information to people who use or request services and resources provided by the Transport Consortiums, about the processing of their personal data.

Below we describe our Privacy Policy to help you better understand how we use your personal data. In it, we explain in more detail the types of personal data we collect, how we collect them, for what purposes we can use them, and with whom we can share them.

Notwithstanding the rights granted to you under the applicable laws, the Privacy Policy and the information above are not contractual and do not form part of your contract with us.

If you have contacted our User Support Center through any of the enabled communication channels (Web, email, and phone), as this service is provided by an external company, this company will also independently be responsible for processing your data under the data protection laws of the European Union and Spain. You can access the privacy policies of this provider by contacting them directly.

How can you contact the data processing controller and their Data Protection Officer?

For any issue related to personal data protection, you can contact the Data Protection Officer of the Andalusian Public Transport Consortium Network:

• Name: Manuel Moreno Piquero
• Adress: Calle Pablo Picasso, 6. 41018-Sevilla
• E-mail: dpd@ctan.es

3. Purpose and legal basis for processing your data

Why and for what do we process your personal data?

Although each specific purpose is indicated in the form or medium through which your data has been requested, they are also contemplated in the Register of Processing Activities.

The main purposes for which we process your personal data are as follows:

• To process communications received through our communication channels 
  We need to know your basic personal and contact data to address you in response to your communication.
• To allow you to access the benefits of nominative services 
  Some of our services require the nominative identification of each person to access the benefits they provide, as they are for personal and non-transferable use

In some cases, this requirement is determined by legal regulations, such as access to transport discounts for large families, or by the service's definition itself, such as bike rentals and on-demand transport.

However, the primary purpose of CTAN processing the personal data of the interested party is to execute the functions and obligations of the Entity within its competencies, according to the requirements indicated by the current regulations.

What is the legal basis for processing your personal data

Generally, the legal basis that allows us to perform processing activities is one of the following from Article 6 of the GDPR:

• 6.1 b) Processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract.
• 6.1 c) Processing is necessary for compliance with a legal obligation to which the controller is subject.
• 6.1 e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

To a lesser extent, the legality of some processing will be the consent of the data subject:

• 6.1 a) The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

When is this policy applicable?

EThis Policy applies to the personal data we collect, use, and process in the context of your relationship with us as a regular public transport user, including when you travel with us or use other of our services, when you browse our website, or when you contact our User Service Center.

4. Data

What do we mean by personal data?

Personal data refers to data that identifies you or could be used to address your requests or to provide the regular public transport service for passengers and complementary services.

How can you protect your personal data?

We are stringent in the measures we apply to protect the personal data you provide us. Here are some steps you can take to keep your data safe in relation to our services:

• Don't share your login details for accessing your personal area on the Consortium's website. To ensure secure access to the private area of our website, don't share your access keys with anyone. When finished using the website or mobile app, you should log out if someone might have access to your computer or device. This is especially important if using a public access computer.
• Be cautious and protect yourself from internet fraud and 'Phishing'. There is a fraudulent internet practice called 'Phishing' that involves illegally obtaining personal data by deception. Unsolicited emails are sent to individuals on lists illegally obtained by third parties, asking recipients to enter or confirm bank details or passwords on a cloned or fake website.
  You can call us to verify the authenticity of any communication you receive on our behalf.

When do we collect your personal data?

We collect personal data when you request a service that requires personal identification or when you communicate with us through the Web forms. For more information, see the following section.

What types of personal data do we collect and retain?

When using some of our services, you'll need to provide us with your personal data. We collect the following groups of personal data:

• Data you provide when communicating with us through Web forms: For queries and suggestions, we ask for Name, email, and phone. For complaints or certificate requests, additionally, NIF (Tax Identification Number) and address are required. If the certificate to be issued is for use, you must also inform your transport card number.
• Nominative transport card data: Name, email, phone, NIF, address, photograph, and family title.
• Demand transport data: NIF, email, and optionally the phone.
• Bicycle rental service data: Name, NIF, transport card number, and bank account details.

Do we collect sensitive personal data?

There's no need to collect sensitive data for our regular public transport service for passengers or any of our complementary services.

When will we send you communications?

We will only send you communications in response to your requests or if there's a change in the terms of a service you've subscribed to.

5. Retention Period

How long do we keep personal data?

The personal data provided by the interested parties are kept strictly for the time necessary to fulfill the purpose for which they were collected and to determine the possible liabilities that could arise from the purpose of the processing.

Once the processing activity is completed, they will be retained for the periods provided for in the current provisions on documentary archiving of the Autonomous Community of Andalusia. Once these periods expire, your data will be deleted as long as no type of liability can be claimed derived from a legal relationship or obligation, or from the execution of a contract, or from the application of pre-contractual measures requested by the interested party.

6. Communication and International Transfers

Who do we share your personal data with?

In general, the personal data of the interested party will not be communicated to third parties, except for a legal obligation. Among these obligations might be communications to the Ombudsman and the Ombudsman of Andalusia, judges and courts interested in the procedures related to claims presented, as well as other bodies and administrations or public entities with competence. Any communication of personal data not provided for in the regulations will require the consent of the interested party.

You can consult the recipients for each of the processing activities carried out by the entity by following the link to CTAN's Registry of Activities.

As a general rule, the entity does not transfer Personal Data outside the European Economic Area.

7. Rights of the interested parties

What rights do you have and how can you exercise them?

In accordance with European data protection regulations, and local data protection regulations, you have the following rights.

• Access
  You can request a copy of all your personal data that the entity holds about you. 
  If you are a user of the on-demand transport service, you can access this information through your account on the on-demand transport portal.
• Rectification
  You can modify your personal data when they are inaccurate. 
  If you are a user of the on-demand transport service, you can make this modification directly through your account on the on-demand transport portal.
• Deletion
  You can request the removal of your personal data. 
  If necessary for the provision of an active service, this service will be canceled.
• Opposition
  You can request that your personal data not be processed.

These rights can be exercised through the following Form.