Last updated: May 2025

This Privacy Policy applies to the handling and management of complaints or claims affecting the CONSORCI DE TRANSPORTS DE MALLORCA (CTM). Please read this Privacy Policy carefully, as it contains important information about the processing of your personal data and your rights under the relevant regulations.

As a rule, fields marked as mandatory on our forms must be filled out in order to be able to process your requests.

1. Who is the data controller for your data?
   The CONSORCI DE TRANSPORTS DE MALLORCA (CTM), with its address at c/ Eusebi Estada no. 28, 07004 – Palma (Balearic Islands), phone: +34 971 91 31 91. You can contact the Data Protection Officer at:
   protecciodedades@consorcidetransports.com.

2. What will we process your data for and on what legal basis?

   1. Complaints management: We will process the data provided for the purpose of handling your complaint.

      The processing of the data provided in your complaint or claim is based on the execution of the service contract that binds you to the company and the fulfilment of its legal obligations, in particular the applicable accounting, tax, tourism or security regulations.

      The processing of any health data is sought under Art. 9(2)(f) GDPR, as such processing is necessary for formulating, exercising or defending claims or when the courts are acting to exercise their judicial function.

   2. Quality management 

      We will process your data to evaluate the quality of the services offered by the Consorci de Transports de Mallorca to its customers.

      This processing is based on our legitimate interest in evaluating and managing the quality of the services and products offered by the chain and improving customer service. For the weighing of this interest against data subjects’ rights and freedoms, the following has been determined:

      - The processing is compatible with data subjects’ reasonable expectations.

      - The impact of the processing on data subjects’ privacy is limited; it does not pose significant threats to data subjects and the processing benefits data subjects by improving the quality of services and the level of customer service.

3. To whom may we disclose your data?
   We will only disclose your data in the following situations: due to legal obligations, with your prior consent or when necessary to handle your complaint or claim. For example, if your complaint concerns services provided by third party suppliers, it will be disclosed to the applicable suppliers. Likewise, depending on the matter, the recipients of your personal information may include public administrations or entities, official bodies, solicitors, judges and courts or insurance companies.

4. How long will we keep your data?
   Your complaint data will be kept for up to one year from case resolution and, in any case, for the legal periods and for the time necessary to address possible liabilities arising from the processing.

5. What are your rights?

   You have the right to obtain confirmation as to whether or not we process your personal data and, if so, to access it. You can also ask for your data correction if they are inaccurate or for incomplete data to be completed, as well as request their deletion if, among other reasons, the data are no longer necessary for the purposes for which they were collected.

   Under certain circumstances, you may request that we restrict the processing of your data. In this case, we will only process the data concerned to formulate, exercise or defend claims or to protect the rights of other persons.

   Under certain conditions and for reasons relating to your particular situation, you may also object to the processing of your data. In this case, we will stop processing the data, except where there are compelling legitimate reasons to continue doing so, which override your interests, rights and freedoms, or for formulating, exercising or defending claims.

   However, you may, at any time, withdraw your consent given for certain purposes and object to the processing of your data for direct marketing purposes. We will then stop processing your personal information for these purposes. Withdrawing your consent will not affect the lawfulness of the processing based on the consent prior to withdrawal.

   Although we do not make automated individual decisions that have legal effects on customers, you have the right to object to such decisions if they are made and they significantly affect you, in accordance with Article 22 of Regulation (EU) 2016/679.

   Under certain conditions, you may also request the portability of your data to another data controller.

   You also have the right to lodge a complaint with the Spanish Data Protection Agency or any other competent supervisory authority. The list and contact details of the European Data Protection Agencies can be found on the European Commission’s website at http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

   To exercise your rights, you must send us a request accompanied by a copy of your national identity card or another valid document identifying you by post or email to the addresses indicated in the section “Who is the data controller for your data?”.

   You can obtain more information about your rights and how to exercise them on the website of the Spanish Data Protection Agency at www.aepd.es.