This Privacy Policy applies to this website (hereinafter the Website).

Please read the policy carefully. Here you will find important information about the processing of your personal data and your rights under the relevant regulations.

We reserve the right to update our Privacy Policy at any time due to business decisions, as well as to comply with any changes in legislation or case law. If you have any questions or need any clarification regarding our Privacy Policy or your rights, you can contact us through the channels indicated below.

You declare that the data you provide us with, now or in the future, is correct and truthful and you undertake to inform us of any changes. In the event of providing personal data to third parties, you undertake to obtain the prior consent of the data subjects and to inform them of the content of this policy.

As a rule, fields marked as mandatory on our forms must be filled out in order to be able to process your requests.

1. Who is the data controller for your data?
   
   The data controller for your personal data is CONSORCI DE TRANSPORTS DE MALLORCA (CTM), with its address at c/ Eusebi Estada no. 28, 07004 – Palma (Balearic Islands), phone: +34 971 91 31 91. You can contact the Data Protection Officer at protecciodedades@consorcidetransports.com.

2. What will we process your data for and on what legal basis?

   1. Management of the user area and extranet service – We process the data that our customers and users provide us with in order to attend to their requests.
      
      This processing is necessary for executing the legal relationship with the users of the website or for implementing pre-contractual measures at your own request. 

   2. Issue of the Targeta Única – In the event that you apply for your Targeta Única, we will process your data for the purpose of issuing it. This processing will include the first issuance of the card, making duplicates or renewals, as well as verifying your membership of a special group. The categories of data processed for these purposes are the following:
      
         - Identification and contact details: Forename, surname, DNI/NIE, signature;
         - Contact details: Phone number, email address;
         - Health data to access special discounts if the holder has a degree of disability.
      
      The processing of this data is necessary for performing the transport contract, for providing the requested services or for implementing pre-contractual measures at your own request.
      
      Regarding the management of the Targeta Única, you will find more information in the Privacy Policy for the Targeta Única, available here.

   3. Customer service and complaint handling – In the event that you submit a complaint, we will process your personal data to deal with your requests, queries, complaints or claims related to the public transport service.
      The data processed for this purpose would be:
      
         - Identification data: Forename, surname.
         - Contact details: Email address, phone number.
         - Information about the reason for the query or complaint, and any documentation you choose to provide.
         - Data linked to the use of the service (e.g. transport card number, journey history, tickets used or payments made, if relevant to the case).
      
      The legal basis for this processing is the performance of a contract or the adoption of pre-contractual measures, as well as our legitimate interest in serving users properly and improving the quality of the service (Art. 6(1)(f) of the GDPR). In weighing this interest against data subjects’ rights and freedoms, it has been determined that the processing has a limited impact on data subjects’ privacy, corresponds to data subjects’ reasonable expectations and does not pose significant threats.

   4. Quality management and improvement – We will process the identification and contact data provided by our customers and users to evaluate and manage the quality of our services, including sending satisfaction surveys. For the same purpose, we process identification data and contact data provided by our customers in their requests or suggestions. We also perform statistics based on aggregated data obtained from web browsing data, e.g. IP address, weblogs, pages visited or actions performed on the website (+ info in our Cookies Policy).
      
      ​​​​​​​These processing operations are based on our legitimate interest to evaluate and manage the quality of our services and products. In weighing this interest against data subjects’ rights and freedoms, it has been determined that the processing has a limited impact on data subjects’ privacy, corresponds to data subjects’ reasonable expectations and does not pose significant threats.

   5. Monitoring the public transport service – We process your data to monitor and manage the operation of the public transport service. This includes monitoring service utilisation as well as optimising routes, frequencies and itineraries according to demand and actual usage.
      
      ​​​​​​​The legal basis for this processing is our legitimate interest in maintaining control of the service operation. In weighing this interest against data subjects’ rights and freedoms, it has been determined that the processing has a limited impact on data subjects’ privacy, corresponds to data subjects’ reasonable expectations and does not pose significant threats.

   6. Notifications on service changes – We will process your identification and contact details to notify you about possible changes in the public transport service, such as changes in the itinerary of the routes or alteration of timetables.
      
      ​​​​​​​This processing is necessary to provide the requested services or implement pre-contractual measures at your request.

   7. Management of group bookings – The data provided in the group booking form will be processed in order to manage said bookings and provide the services requested. The categories of data we process for these purposes are as follows:
      
         - Identification data (Forename, surname and DNI/passport) and contact details (address, email address and phone number);
         - Details of the booking itself or service requested.
      
      These data are obtained either directly from you or from third parties who have processed the booking or requested the service on your behalf.
      
      ​​​​​​​​​​​​​​The processing of this data is necessary to provide the requested services or implement pre-contractual measures at your request.

   8. Sending commercial communications – We process the identification and contact data provided by our customers and people who register on our distribution lists in order to send them communications relating to our products and services.
      
      This processing is based on your consent. Failure to give your consent or withdrawal of consent does not affect the processing of your booking or provision of the services contracted. 
      
      At any time you may revoke your consent and request to unsubscribe from the processing for commercial purposes by clicking on the link provided for this purpose in the commercial communications themselves or by sending an email with the subject “baja publi” (unsubscribe from marketing communications) to: protecciodedades@consorcidetransports.com.

   9. Operation and security of the website – We process your browsing data (IP addresses or logs) to administer and manage the security of the website and its restricted access areas.
      
      ​​​​​​​This processing is based on our legitimate interest in ensuring the security of the website. This interest is expressly recognised by Recital 49 of the GDPR. In weighing this interest against data subjects’ rights and freedoms, it has been taken into account that this processing corresponds to general security practices and does not pose significant threats to data subjects.

3. To whom may we disclose your data?
   
   Your data will only be disclosed to third parties if required by law, with your consent or when your request involves such disclosure.

4. How long will we keep your data?
   
   In general, we keep your data for the duration of your relationship with us and, in any case, for the periods provided for in the applicable legal provisions, e.g. in accounting and tax matters, and for the time necessary to meet any liabilities arising from the processing. We will delete your data when they are no longer necessary or relevant for the purposes for which they were collected. The information related to browsing will be cancelled once the web connection has been terminated and the statistics have been carried out.
   
   Data processed for marketing purposes will be kept for as long as you do not request its deletion or revoke your consent to receive marketing communications from us.
   
   The media on which your consent to the processing of your data for commercial purposes is recorded, such as electronic form submission logs, will be kept for the duration of the processing and the applicable statute of limitations.

5. What are your rights?
   
   You have the right to obtain confirmation as to whether or not we process your personal data and, if so, to access it. You can also ask for your data correction if they are inaccurate or for incomplete data to be completed, as well as request their deletion if, among other reasons, the data are no longer necessary for the purposes for which they were collected.
   
   Under certain circumstances, you may request that we restrict the processing of your data. In this case, we will only process the data concerned to formulate, exercise or defend claims or to protect the rights of other persons. Under certain conditions and for reasons relating to your particular situation, you may also object to the processing of your data. In this case, we will stop processing the data except where there are compelling legitimate reasons to continue doing so, which override your interests or rights and freedoms, or for the formulation, exercise or defence of claims.
   
   Under certain conditions, you may also request the portability of your data to another data controller.
   
   You can revoke your consent given for certain purposes at any time, without affecting the lawfulness of the processing based on consent prior to its withdrawal.
   
   Please note that the European Personal Data Protection Regulation also recognises the right to data portability.
   
   You also have the right to object to automated individual decisions that produce legal effects concerning you or significantly affect you in a similar way, where this right applies in accordance with Article 22 of Regulation (EU) 2016/679.
   
   You also have the right to lodge a complaint with a data protection authority. The list and contact details of the European Data Protection Agencies can be found on the European Commission’s website at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.
   
   To exercise your rights, you must send us a request by post or email to the relevant data controller at the addresses indicated in the section Who is data controller for your data?
   
   ​​​​​​​You can obtain more information about your rights and how to exercise them on the Spanish Data Protection Agency’s website at www.aepd.es or from the data protection authority in your country.