Privacy Policy

1.- Commitment

The Andalusian Metropolitan Transport Consortium Network (RCTA), which integrates the Metropolitan Transport areas of Almería, Bahía de Cádiz, Campo de Gibraltar, Córdoba, Costa de Huelva, Granada, Jaén, Málaga and Seville, attached The Ministry of Development, Infrastructure and Spatial Planning, carries out its purpose through activities and services aimed at fulfilling the purposes of developing its competency objectives, for which, on occasions, it must make use of treatments that include data from personal character.

The consortiums integrated in the Andalusian Metropolitan Transport Consortium Network have been maintaining a rigorous privacy policy with the data of those people who have maintained a relationship with each entity. The information on these people is always used in accordance with current regulations on the matter, Organic Law 3/2018, of December 5, on the Protection of Personal Data and guarantee of digital rights, the purpose of which is to adapt the Spanish legal system to the General Data Protection Regulation, RGPD, (EU) 2016/679.

With this, it is about ensuring at all times the respect for the principles regarding the processing of personal data established in article 5 of the aforementioned General Data Protection Regulation and, especially, for transparency and information to the people who use or request the services and resources made available by the Transport Consortiums, on the treatment of your personal data.

Below we describe our Privacy Policy to help you better understand how we use your personal data. In it we explain in more detail the types of personal data we collect, how we collect it, for what purposes we can use it and with whom we can share it.

Without prejudice to the rights that correspond to it under the applicable laws, the Privacy Policy and the above information are not contractual nor are they part of your contract with us.

2.- Responsible for data processing

Who is responsible for the processing of your data?

All personal data processed by the Andalusian Transport Consortium Network in relation to this Privacy Policy are controlled by these bodies that are attached to the Ministry of Development, Infrastructure and Spatial Planning of the Andalusian Government. These organizations are considered responsible for the treatment of your personal data under the data protection laws of the European Union and Spain. For each metropolitan area, the data of those responsible for the processing of your data are:

If you have contacted our User Service Center, through any of the communication channels enabled (web, mail and telephone), as this is a service provided by an external company, it will also be independently, responsible for the treatment of your data under the data protection laws of the European Union and Spain. You can access the privacy policies of said provider by contacting him directly.

How can you contact the data controller and your Data Protection Officer?

For any question related to the protection of personal data, you can contact the Data Protection delegate of the Andalusian Transport Consortium Network:

• Manuel Moreno Piquero
• Calle Pablo Picasso, 6. 41018-Sevilla
• dpd@ctan.es

3.- Purposes and legal basis of the treatment of your data

Why do we process your personal data and for what purpose?

Although each specific purpose is indicated in the form or means by which your data has been requested, they are also contemplated in the Treatment Activities Register (spanish version).

The main purposes for which we process your personal data are as follows:

To process the communications received through our communication channels

We need to know your basic personal and contact information in order to contact you in response to your communication.

So you can access the benefits of registered services

Some of our services require the nominal identification of each person to access the benefits they provide, since they are for personal and non-transferable use.

In some cases this requirement is determined by legal regulations, this is the case of access to transportation discounts due to large family conditions, or by the definition of the service itself, such as bicycle rental and on-demand transportation.

However, the main purpose of the processing of the personal data of the person interested for CTAN is to be able to execute the Entity’s functions and obligations within the scope of its powers, according to the requirements indicated by current regulations.

What is the legal basis to process your personal data?

In general, the legal basis that allows us to carry out treatment activities is one of the following in Article 6 of the RGPD:

• 6.1 b) The treatment is necessary for the execution of a contract in which the interested party is a party or for the application at its request of pre-contractual measures.
• 6.1 c) The treatment is necessary for the fulfillment of a legal obligation applicable to the controller.
• 6.1 e) Treatment is necessary for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the controller.

To a lesser extent, the lawfulness of some treatments will be the consent of the interested person:

• 6.1 a) The interested party gave their consent for the processing of their personal data for one or more specific purposes.

When is this policy applicable?

This Policy is applicable to the personal data that we collect, use and process in the context of your relationship with us as a user of regular public passenger transport, including when you travel with us or use other of our services, when you browse our website or when contact our User Service Center.

4.- Data

What do we understand by personal data?

Personal data is understood as data that identifies you or could be used to respond to your requests or to the provision of regular public passenger transport services and complementary services.

How can you protect your personal data?

We are rigorous in the measures we apply to protect the personal data you provide us. Here are some steps you can take to keep your data safe when it comes to our services.

Do not share the login data to access your personal area of the Consortium’s Web

To ensure that your access to the private area of our website, do not share your passwords with anyone. When you are finished using the website or mobile app, you should log out if someone can access your computer or device. This is especially important if you are using a publicly accessible computer.

Be cautious and protect yourself against internet fraud and “Phishing”

There is a fraud practice through the Internet known as “Phishing”, which consists of illegally obtaining personal data through deception. Unsolicited emails are sent to people included in lists illegally obtained by third parties, and their recipients are asked to enter or confirm bank details or passwords on a fake or cloned website.

You can contact us by phone to verify the authenticity of any communication you receive on our behalf.

When do we collect your personal data?

We collect personal data when you request a service that requires nominal identification or when you contact us through the forms on the Web. See the next section for more information.

What types of personal data do we collect and keep?

When you use some of our services, you will have to provide us with your personal data. We collect the following groups of personal data:

Data you provide when communicating with us through Web forms

In the case of queries and suggestions, the name, email and telephone are requested.

When a claim or certificate request is made, it is necessary to additionally indicate the NIF and address.

If the certificate to be issued is for use, you must also provide your transport card number.

Nominal transport card data

Name, email, telephone, NIF, address, photograph and title of large family.

Transport data on demand

NIF, mail and optionally the phone.

Bicycle rental service details

Name, NIF, transport card number and bank account data.

Do we collect sensitive personal data?

It is not necessary to collect sensitive data for the provision of our regular public passenger transport service, or for any of our complementary services.

When will we send you communications?

We will only send you communications in response to your requests, or if there is any change in the conditions for the provision of a service that you have subscribed to.

5.- Conservation period

How long do we keep personal data?

The personal data provided by the interested persons is kept for the time strictly necessary to fulfill the purpose for which it was collected and to determine the possible responsibilities that may arise from the purpose of the treatment.

Once the treatment activity is completed, they will be kept for the periods provided for in the current provisions on documentary archives of the Autonomous Community of Andalusia. When these terms expire, your data will be deleted as long as some type of liability arising from a legal relationship or obligation or the execution of a contract, or the application of pre-contractual measures requested by the interested party, cannot be demanded.

6.- International communication and transfers

With whom do we share your personal data?

In general, the personal data of the interested person will not be communicated to third parties, except legal obligation, among which may be communications to the Ombudsman and Andalusian Ombudsman, judges and courts interested in the procedures related to claims presented, as well as other competent bodies and administrations or public entities. Any communication of personal data not provided for in the regulations will require the consent of the interested party.

You can consult the recipients for each of the treatment activities carried out by the entity at the link to the CTAN Activity Register.

The entity, in general, does not transmit Personal Data outside the European Economic Area.

7.- Rights of interested persons

What rights do you have and how can you exercise them?

In accordance with European data protection regulations and local data protection regulations, you have the following rights:

Access
You can request a copy of all your personal data that the entity keeps about you.
If you are a user of the on-demand transport service, you can access this information through your account on the on-demand transport portal.
Rectification
You can modify your personal data when they are inaccurate.
If you are a user of the on-demand transport service, you can make this modification directly through your account on the on-demand transport portal.
Suppression
You can request the deletion of your personal data. If they are necessary for the provision of an active service, this service will be canceled.
Opposition
You can request that your personal data not be processed.

These rights can be exercised through the following Form (spanish version).