The ATM (Autoritat del Transport Metropolità) [Metropolitan Transport Authority], as responsible for data processing, guarantees an adequate and coherent level of protection for natural persons with regard to their personal data, object of processing by the various municipal services of the City Council of Barcelona, in accordance with the General Data Protection Regulation (2016/679).

The ATM only processes personal data with full responsibility and lawfully, and in accordance with the legal bases that allow the legality of the processing, according to the General Data Protection Regulation.

In order to comply with the General Data Protection Regulation, the ATM has prepared a Register of Processing Activities and has adopted timely and appropriate security measures vis-à-vis the risks evaluated and objectively identified regarding the rights and freedoms of the data subjects, to which the processing performed by the ATM could give rise.

The ATM applies the principle of transparency in the processing of personal data, providing data subjects with concise, easily accessible, complete and understandable information and, at the same time, facilitating the exercise of rights through:

• RIGHT OF ACCESS REQUEST FORM
  Article 15 of the General Data Protection Regulation (EU) 2016/679.
• RIGHT TO RECTIFICATION REQUEST FORM
  Articles 16 and 19 of the General Data Protection Regulation (EU) 2016/679.
• RIGHT TO ERASURE REQUEST FORM
  Articles 17 and 19 of the General Data Protection Regulation (EU) 2016/679.
• RIGHT TO OBJECT REQUEST FORM
  Article 21 of the General Data Protection Regulation (EU) 2016/679.
• RIGHT TO RESTRICTION OF PROCESSING REQUEST FORM
  Articles 18 and 19 of the General Data Protection Regulation (EU) 2016/679.
• RIGHT TO DATA PORTABILITY REQUEST FORM
  Article 20 of the General Data Protection Regulation (EU) 2016/679.

Likewise, the ATM has designated a Data Protection Officer (DPO), in accordance with the provisions of article 37.1.a. of the General Data Protection Regulation (2016/679). The contact address of the Data Protection Officer is dpd@atm.cat.

You find below additional and enhanced information regarding the specific processing activity “CONTACTS”, carried out by the ATM:

1. Responsible for data processing
Name: Autoritat del Transport Metropolità
ID: P-5890049-I
Address: carrer Balmes, 49 6ª planta, 08021 Barcelona
Telephone: +34 93 362 00 20
e-mail: atm@atm.cat

2. Data Protection Officer
dpd@atm.cat

3. Retention period
Personal data will be stored during the time needed for the fulfillment of the purposes for which they were obtained, exercising the competencies and functions of the ATM, and in order to determine the possible responsibilities derived from those purposes.

4. Legal basis for data protection
The legal basis that legitimize the processing of personal data by the ATM are the following:
General Data Protection Regulation 2016/679.
Article 6.1.c. Processing is necessary for compliance with a legal obligation applicable to the person responsible for the processing.
Article 6.1.e. Processing is necessary for the fulfillment of a mission carried out in the public interest or in the exercise of public powers conferred on the person responsible for the processing.
Articles 15 to 21 on the rights of data subjects.

5. Purpose of data processing
CONTACTS. The purpose of the processing of personal data refers to the registration, attention, processing and response to the communication of the data subject. ATTENTION OF THE RIGHTS OF THE DATA SUBJECTS. The purpose of the processing of personal data refers to the registration, attention and management of requests for data protection rights, recognized to the data subjects.

6. Your rights
The holders of data processed by the ATM have at all times the right to exercise the right of access to their data, the right of rectification of erroneous or inaccurate data, right to erasure when, among other reasons, the data is no longer needed for the purposes for which they were collected, and the right to data portability. In certain cases the data subjects may request the restriction of the processing of their data, in which case they will only be stored for the exercise or defense of claims.
Also for reasons related to their particular situation, data subjects may object to the processing of their data. The ATM will cease to process the data, except for legitimate reasons or for the exercise or defense of possible claims.
In order to exercise these rights you can contact the ATM by submitting the appropriate request form at AUTORITAT DEL TRANSPORT METROPOLITÀ, C/ Balmes, 49 6ª planta, 08021 Barcelona, or by email writing to atm@atm.cat.
Likewise, in case you are not satisfied with the response to the exercise of your rights, and, in any case, whenever you may deem it appropriate, you can submit a claim to the Catalan Authority of Data Protection at the website www.apd.cat.

7. Data recipients
Data recipients are not contemplated.

8. Personal data provenance
The personal data processed by the ATM in compliance with a mission carried out in the public interest and in the exercise of public powers, come directly from the data subjects or their representatives.

9. Categories of data object of processing.
Identification data.

10. Registration of processing activities.
In compliance with Article 30 of the Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 relating to the protection of individual persons in regard to personal data and the free circulation of this data and Article 31 of Organic Act nº 3/2018 of 5 December on data protection and guarantee of digital rights, the Metropolitan Transport Authority has drawn up the obligatory Register of Processing Activities relating to the processing tasks of personal data conducted by this organisation, and makes it public for consultation by electronic means via the following link.