Privacy policy

DATA OBTAINED FROM WEBSITE SERVICES

METRO BILBAO, S.A. is especially concerned with the protection of its website user’s personal data.

The purpose of METRO BILBAO, S.A. in this privacy policy (hereafter “Policy”), is to inform the users of the its websites, www.metrobilbao.net, www.metrobilbao.com, www.metrobilbao.org, www.metrobilbao.eus and www.metromusika.eus, of the uses of the personal data gathered in them, so that visitors can freely and voluntarily decide whether to give consent to the collection and processing of any information requested.

METRO BILBAO, S.A. reserves the right to modify this Policy if new legislation comes out, if current privacy laws are amended, in case it is necessary to adapt it to industry practices or if the interests of the company so require. Any change in this Policy will be notified to the users in advance so that they have always full knowledge of new terms.

A. RESPONSIBLE ENTITY

The responsible entity for the processing of personal data is:

   METRO BILBAO S.A.
   Calle Navarra 2 – 48001 Bilbao, País Vasco. Spain
   NIF: A-48541957
   https://www.metrobilbao.eus
   Phone number: (+34) 900 840 655
   E-mail: dpo@metrobilbao.eus

B. PURPOSES OF PROCESSING

The purposes of gathering and processing personal data, obtained through the different mechanisms provided by METRO BILBAO, S.A. for its users, are enumerated below:

To appropriately handle and respond to requests for information, suggestions or complaints.
To run the Lost and Found Property service.
For the organisation and management of our Guided Tours.
For marketing purposes and campaigns in the underground trains and its facilities.
To organise events, filming sessions or other similar arrangements.
To manage the user’s preferences (favourite stations and journeys, reporting incidents, news alerts, incidents…)
To manage the professional press preferences (download images, videos and audio, favourite files, news alerts, press releases and press conferences…)
To manage and deal with requests for information, image and recording permits for the professional press
To manage the newsletter.

Consequentially, and for the purposes described above, the types of data to be collected and processed are principally identity and contact details, electronic communications metadata, financial information, bank account details, and other statistics gathered for commercial purposes.

C. DURATION OF PROCESSING

The length of time personal data is retained depends on the duration required to fulfil each particular purpose, in order to determine the possible responsibilities that could derive from it. Once the storage purposes have ceased to apply and existing legal storage periods have expired, the personal data shall be blocked in accordance with the statutory provisions and requirements.
In case the data subject has given consent to the storage and processing of any personal information, the data will be retained so long as the consent is not revoked. Only then will the data be removed, provided that no legal obligation prevents us from doing so and when the processing is proportional.

D. LEGAL BASIS

METRO BILBAO, S.A. has been authorised to process personal data with the consent given by the data subject associated to one or more specific purposes, on the basis of art. 6(1)(a) of the General Data Protection Regulation.

However, when this consent is not applied, we must remind our users that the processing of data may be authorised under other conditions included in the art. 6 of the already mentioned General Data Protection Regulation; such as when the data is needed to execute a contract in which the data subject is involved or if the purpose of the legitimate interests pursued by METRO BILBAO, S.A. so requires.

E. ACCURACY OF THE DATA

The data subject must guarantee that the information provided is real, accurate, complete and up-to-date, becoming entirely responsible for any direct or indirect harm or damage that could be caused as a consequence of not complying with such an obligation.

With the intention of ensuring the veracity of the information we keep in our computer or paper files; all stored data should be regularly updated. Therefore, data subjects must make sure they carry out the necessary modifications. This can be done either directly, if users are authorised to do so, or by contacting the corresponding department at METRO BILBAO, S.A.

F. RECIPIENTS

The personal information which the responsible entity for the data processing collects through its website will never be shared with third parties unless it is absolutely necessary; i.e., to fulfil and control the purposes herein described, in compliance with the law, and other possible circumstances in which the user has to be previously informed.

Moreover, once the section on purposes and aims includes the possibility of managing commercial actions as a specific one, we inform you that if you have subscribed to our Newsletter and have checked the box referring to the international transfer of data, you consent to international data transfers to our service providers located in the United States and Australia, countries that have not been declared adequate level of protection by the European Commission. Therefore, you are informed of the risk of this transfer of data, as it may affect your fundamental rights since there are no data protection regulations in these countries comparable to the European one. In addition, there is no specific data protection authority in the above-mentioned countries and the legislation allows intelligence agencies to access personal data on a massive scale, without judicial control.

G. ENTITLEMENTS OF DATA SUBJECTS

As it is regulated by the GDPR, data subjects are entitled to:

Request access to their personal data,
Request the correction or deletion of their data,
Request the restriction of the data processing,
Object to the data processing,
Request data portability.

Data subjects may exercise any of the aforementioned rights by submitting a request, where they must include a copy of their ID card and specify the points to be addressed. Requests can be sent to the company’s head office at Calle Navarra 2 – 48001 Bilbao, País Vasco (Spain), or emailed to dpo@metrobilbao.eus.

In case you consider that your data protection rights have been breached in any way, you may also make a complaint to the Spanish Data Protection Agency (www.aepd.es).

H. DATA SAFETY AND SECURITY MEASURES

The responsible entity for processing the data, METRO BILBAO, S.A., will implement any necessary technical and organisational measures to ensure the safety, security and confidentiality of the information they store, avoiding unsolicited or accidental modifications, loss of data or unauthorised access; always taking into account technical conditions, implementation costs, the nature, scope, context and purposes of the data, as well as the probability and severity risks of each process. Should you have any other questions about this Privacy Policy, please contact us via email at: dpo@metrobilbao.eus.

VIDEO SURVEILLANCE

Pursuant to the Organic Law on Protection of Personal Data, it is hereby notified that all the personal data collected by our video surveillance system will be processed by METRO BILBAO SA, CIF number A-48541957, with its registered office in Calle Navarra 2, 48001 Bilbao (Bizkaia, Spain), for the management of surveillance cameras. Our legitimate interest is to ensure safety and security on our premises.

The purpose of this processing is to manage the safety and security of our staff and customers on our premises as well as to ensure the proper functioning of the rail transportation system. The data collected can only be shared with public authorities such as judges or courts, law enforcement bodies, or competent administrations in this field, and it will be kept for a maximum period of one month.

You may exercise your rights of access, rectification, deletion, restriction of processing, objection and portability in relation to your data at any time at the headquarters located in Calle Navarra 2, 48001 Bilbao (Bizkaia, Spain) or by sending an email to dblo-lopd1@metrobilbao.eus.

You can also make a claim to the Spanish Data Protection Agency, or contact the Data Protection Officer by email at dpo@metrobilbao.eus.

RECORDINGS OF THE CONVERSATIONS WITH THE CENTRAL COMMAND POST

In accordance with Personal Data Protection legislation, please note that the personal data recorded when speaking to the Central Command Post (PMC) using the intercoms at different points of the line will be processed by METRO BILBAO S.A., whose tax number is A-48541957 and whose registered office is at c/ Navarra 2, 48001, Bilbao (Bizkaia), to provide customer support and manage any incidents that may involve the users.

The legal basis for the data processing is the public interest consisting of the need to guarantee the safety and security of the people and facilities, along with the contractual relationship between Metro Bilbao and the users of public transport.

The purpose of the processing is to manage requests, claims, complaints or suggestions made by Metro Bilbao users, to guarantee the correct use of the rail transport and to manage the safety and security of the people and facilities.

Your personal details will not be transferred or disclosed to third parties, except in the cases established by law and the legal authorities as applicable. The conversations will be kept for a maximum of one month, unless they are part of an incident expressly logged by the PMC.

In any event, you may exercise your rights of access, rectification, erasure or, as applicable, objection, portability, restriction by duly writing to c/ Navarra 2, 48001, Bilbao or to dblo-lopd1@metrobilbao.eus.

Furthermore, you may lodge a claim with the Spanish Data Protection Agency or contact our data protection officer at dpo@metrobilbao.eus.

DATA OBTAINED TO MANAGE MINIMUM FINES/PENALTIES

Who is the controller of your data?

METRO BILBAO S.A.

Calle Navarra, 2 – 48001 Bilbao (Bizkaia)

Website: https://www.metrobilbao.eus/es/politica-de-privacidad.

Telephone: +34 900 840 655

Email: lopd1@metrobilbao.eus

DPO Contact: dpo@metrobilbao.eus

For what purpose do we process your personal data?

The purpose for which the data is processed for the penalty procedure for passengers who are travelling without a valid ticket, in breach of the Metro Bilbao General Terms and Conditions; and to provide the competent authority with the necessary information for the purposes of guaranteeing comfort and safety in the use of the transport, and to defend the interests of the company.

The information gathered on this occasion will not be subject to fully automated decisions.

For how long are we going to keep your personal data?

The storage period of your information will comply with the applicable legal obligations and the necessary time to conduct the legal proceedings for which this information is required.

What is the legitimacy for the processing of your data?

The legitimacy for the processing of your data is compliance of the transport contract, as a user of the service provided by Metro Bilbao.

To whom will your data be disclosed?

The data will only be disclosed in the cases envisaged in the applicable legislation, such as to law enforcement agencies, authorities with jurisdiction in that regard, and to the court and tribunals in order to proceed with the indicated purpose.

International transfers of the data are not envisaged.

What are your rights in relation to the data processing?

You as the data subject may exercise your rights to access, rectify or for your data to be deleted, or, as applicable, the right to the portability of, limit the processing of or to object to your data.

You can exercise your rights by writing to the above address or to our Data Protection Officer (dpo@metrobilbao.eus). You should specify which of the rights you wish to exercise and accompany it with a photocopy of your ID document. If you are acting through a legal or voluntary representative, you must also include the document that accredits the representation and their ID document.

Furthermore, should you consider your right to personal data protection to have been breached, you may lodge a claim with the Spanish Data Protection Agency (www.aepd.es).