Privacy and cookies

1. Introduction
This Privacy Policy is intended to inform users who visit our website about the conditions that the Empresa Municipal de Transportes de Madrid S.A. applies to all processed personal data, as well as to the rights that belong to the interested parties (the owners of this data) and the way in which they can exercise these rights.

2. Data Processing Manager
The Empresa Municipal de Transportes de Madrid S.A. municipal transport company, as the personal data controller, has the following identification and contact information
Identity of the Data Controller:
Empresa Municipal de Transportes de Madrid S.A. (hereinafter 'EMT')
NIF/CIF: A-28046316 Registered as Entry 1, Page 19260, Sheet 20, Sect. 3, General 2132, Volume 2808 of the Companies Book of the Madrid Companies Register.
Address: Calle Cerro de la Plata 4, 28007 Madrid
Email: proteccion.datos@emtmadrid.es
URL: www.emtmadrid.es

3. Data Protection Delegate
The contact information for the Data Protection Delegate for the Empresa Municipal de Transportes de Madrid, S.A. is as follows:
Address:

1. Calle Cerro de la Plata 4, 28007 Madrid
   Email: dpd@emtmadrid.es

4. Data processing
Empresa Municipal de Transportes de Madrid S.A. undertakes to treat your data confidentially, pursuant to the requirements established in the applicable legislation on data protection, fundamentally Regulation 2016/679 of the European Parliament and Council of 27 April 2016 relating to the protection of individuals with regard to the processing of personal data and the circulation of said data (GDPR), the Data Protection and Digital Rights Guarantee Act, Organic Law 3/2018 of 5 December 2018 and its implementing regulations and the Information Society and Electronic Commerce Services Act number 34/2002 of 11 July 2002.
 
Personal data will be treated in a fair, legal and transparent manner in relation to the interested party and will be collected for specific, explicit and legitimate purposes. It therefore cannot be treated in a manner incompatible with said purposes.
The data collected from each interested party will be adequate, relevant and not excessive in relation to the corresponding purposes for each case and will be updated whenever necessary.
In cases where it is mandatory under the applicable legislation, the consent of the interested parties must be obtained before collecting their data.

Purposes, legitimation, recipients and origin of the data
 
The personal data for which EMT is responsible for processing comes from different sources, as set forth throughout this Privacy Policy, for the purposes indicated below, to the extent that there is a legal basis for such processing.
 
ElectroEMT App form
 
Purpose: (a) the contracting and management of the fulfilment of the fast electric vehicle charging service contract in its parking lots and (b) the sending of promotional and advertising communications regarding our products or services, including by electronic means (email, SMS, WhatsApp), if the interested party has ticked the acceptance box.
Legitimation: (a) the execution of a contract to which the interested party is a party and (b) in the event of having agreed to receive commercial communications, the consent granted for this purpose.
Recipients: no data will be transferred to third parties, except under legal obligation.
 
EMT Store form
 
Purpose: the contracting and management of the fulfilment of the purchase contract and, where appropriate, the delivery of your order and the performance of administrative tasks associated therewith (http://tienda.emtmadrid.es).
Legitimation: the execution of a contract in which the interested party is a party.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
Form for car parks of concessionaires without a Residents' Community (Elvira, Marqués de Samaranch, Pradillo II, Ginzo de Limia, Francisco Altimiras, Jacinto Benavente).
 
Purpose: data is collected with the purpose of contracting, maintaining and complying with the concession contract for the use of a municipal parking space with Madrid City Council, as managed by EMT. Profiles are not drawn up and no other automated decision is made about the person.
 
Legitimation: the execution of a contract in which the interested party is a party.
 
Recipients: data may be transferred to the municipal body responsible for car parks in the City of Madrid in order to meet the conditions of the concession, statistical data and the undertaking of any informative parking-related activity. International transfers of data are not planned.
 
Form for car parks of concessionaires with a Residents Association (Avenida de Portugal)
 
Purpose: data is collected with the purpose of contracting, maintaining and complying with the concession contract for the use of a municipal parking space with Madrid City Council, as managed by EMT. Profiles are not drawn up and no other automated decision is made about the person.
(http://www.emtmadrid.es/Aparcamiento_Avenida_Portugal/documentacion/solicitud_Portugal.pdf)
 
Legitimation: the execution of a contract in which the interested party is a party.
 
Recipients: data may be transferred to the municipal body responsible for parking in the City of Madrid for the purpose of meeting the conditions of the concession, statistical data and the undertaking of any informative parking-related activity. In the event that a User Community is set up, EMT will transfer the data to the Administrator appointed by said Community, for the sole purpose of parking management, including within this concept the communications that may be sent to convene the Community meetings and the issuance of the receipts corresponding to the monthly maintenance fees approved by said community. International transfers of data are not planned.
 
Form for long-term resident car parks (Barceló, Agustín Lara, Montalbán, Plaza España and Plaza Mayor)
 
Purpose: data is collected with the purpose of contracting, maintaining and fulfilling the resident contract for the parking spaces managed by EMT. Profiles are not drawn up and no other automated decision is made about the person.
 
http://www.emtmadrid.es/aparcamiento_agustin_lara/documentacion/solicitud_Agustin_Lara.pdf
https://www.emtmadrid.es/Aparcamiento_montalban/documentacion/solicitud_Montalban_web1.pdf
https://www.emtmadrid.es/Aparcamiento_plaza_espana/documentacion/solicitud_Espana_web.pdf
https://www.emtmadrid.es/Aparcamiento_barcelo/documentacion/solicitud_barcelo_web.pdf
http://www.emtmadrid.es/Aparcamiento_plaza_mayor/documentacion/solicitud_plaza_mayor.pdf
 
Legitimation: the execution of a contract in which the interested party is a party.
 
Recipients: data may be transferred to the municipal body responsible for parking in the City of Madrid in order to comply with the car park's Organisation and Operation Conditions, statistical data and the undertaking of any informative parking-related activity. International transfers of data are not planned.
 
Form for short-stay car parks (Almagro, Villa de París, Orense, Nuestra Señora del Recuerdo, San Epifanio, Pedro Zerolo, Avenida Portugal, Marqués de Salamanca, Recoletos, Plaza España, Montalbán, Plaza Mayor).
 
Purpose: data is collected with the purpose of contracting, maintaining and fulfilling the payment contract for short-stay parking spaces managed by EMT. Profiles are not drawn up and no other automated decision is made about the person.
 
Legitimation: the execution of a contract in which the interested party is a party.
 
Recipients: data may be transferred to the municipal body responsible for parking in the City of Madrid in order to comply with the car park's Organisation and Operation Conditions, statistical data and the undertaking of any informative parking-related activity. International transfers of data are not planned.
 
EMT Madrid App form
 
Purpose: management of the subscription for sending communications with information about incidents in the EMT service, depending on the geographical location of the interested party.
 
Legitimation: the consent of the interested party when subscribing to the sending of information through our form.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
OPEN DATA form
 
Purpose: management of the delivery of requested information about the different services provided by EMT (bus, public bike, mobility, parking), as well as instructions on how to perform technical integrations in third-party applications (http://opendata.emtmadrid.es/).
Legitimation: the consent of the interested party when subscribing to the sending of information through our form.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
EMT BLOG form
 
Purpose: management of subscriptions and requests that are sent through the blog and its publications (http://blog.emtmadrid.es/).
Legitimation: the consent of the interested party to subscribe to the blog.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
Suggestions and complaints form
 
Purpose: management and resolution of the suggestions and complaints sent by an interested party (https://www.emtmadrid.es/AtencionAlCliente/Reclamaciones).
Legitimation: the consent of the interested party.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
Queries and acknowledgements form
 
Purpose: management of queries and acknowledgements sent by the interested party (https://www.emtmadrid.es/AtencionAlCliente/Agradecimientos).
 
Legitimation: the consent of the interested party to process their requests.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
Service Request Form
 
Purpose: management of requests for informative talks on EMT to certain groups, to accompany these groups on our buses on their journeys through Madrid and to visit the EMT facilities (https://www.emtmadrid.es/SolicitudAcompanamiento)
Legitimation: the consent of the interested party to process their requests.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
Job application form
 
Purpose: management of the application and participation of candidates in EMT recruitment processes and in future job offers and/or vacancies that may occur. (https://www.emtmadrid.es/Empresa/Empleo)
 
Legitimation: the consent of the interested party.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
Employee portal
Purpose: management of the supply of information and services of interest to EMT employees, including access to personal information, such as payroll, certificates of income and deductions and signature control, among others (https://miestacion.emtmadrid.es/).
Legitimation: the execution of a contract in which the interested party is a party and the legitimate interest of EMT.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
Social networks
 
Purpose: management of the registration of users and applications that may be presented through social networks and EMT's presence on social media, reporting activities, products or services and any other purpose that the regulations thereof allow (Twitter, Facebook, Instagram, YouTube etc.) Under no circumstances will the accounts or profiles of followers or users of social media be used to send individual commercial communications.
Legitimation: the consent of the interested party.
 
Recipients: no data will be transferred to third parties, except under legal obligation.
 
Internet access through WiFi on board buses
 
Purpose: management of the registration process and the relationship with the users who access the internet through onboard bus WiFi.
Legitimation: the consent of the interested party when registering using the EMT portal or its social media account login (on Facebook, Twitter etc.)
Recipients: data is shared with Telefónica S.A. where it provides EMT with services that are strictly necessary for the execution of the activity.
 

1. Rights of the interested parties

 
any interested party may withdraw their consent at any time where this has been granted for the processing of their data. Under no circumstances does the withdrawal of this consent condition the execution of the contracts to which it is a party or the relationships generated previously.
 
In the case of commercial communications, the interested parties may withdraw their consent automatically by accessing the link or by ticking the advisory box in each of these communications, or by means of the corresponding form on EMT apps or its website.
 
The interested party may also revoke the consent given and/or exercise their rights of access, rectification, deletion, opposition, portability and limitation, and in general consult all questions relating to the processing of their personal data, before the EMT Data Protection Officer, by sending an email proteccion.datos@emtmadrid.es (FAO Data Processing Manager/General Secretariat), or by mail to Calle Cerro de la Plata 4, 28007 Madrid, attaching a copy of your ID or official document to prove your identity or the representation by means of which you are acting, specifying where appropriate the right you wish to exercise.
 
You may also address your request or query to the EMT Data Protection Delegate, especially when you feel that you have not obtained full satisfaction in the exercise of your rights, by sending an email to dpd@emtmadrid.es, or by post to Calle Cerro de la Plata 4, 28007 Madrid, attaching a copy of the document proving your identity or representation.
 
You may also file a complaint with the Spanish Data Protection Agency, for which the necessary information is available at http://www.agpd.es.
 

1. Data retention period

 
The personal data processed will be kept as long as it is necessary to fulfil the purpose for which it was collected, and then during the retention periods legally required to meet possible responsibilities that may arise from said purpose and the processing of the data, during which time it will remain blocked, only being kept at the disposal of the Public Administrations and Judges and Courts in order to attend to their purposes. Once these deadlines have expired, the data will be destroyed.
 

1. Browsing data and Cookies Policy

 
Visits to the EMT website are made anonymously. Users will only be required to supply personal data essential for the provision of a requested service in order to access certain web services that have specific management or processing actions.
EMT does not use cookies to collect information from users, nor does it register access IP addresses. Only its own session cookies for technical purposes are used (those that allow the user to browse through the website and use the different options and services that exist therein).
 
The web portal contains links to third-party web pages, whose privacy policies are outside its control. By accessing such websites you can decide if you accept their privacy and cookies policies. In general, if you browse the internet you can accept or reject third-party cookies from the settings of your browser.
 
You can also access the internet using the WiFi on board our buses. If you do this from your social media session, please note that you are sharing the username and password of your social profile with us. Visit the platform of the social network in question and review its privacy policy to find out how your personal data is shared and used in this context.
 

1. < >Data provided by the user

 
The personal data requested in the forms are necessary to manage your requests and/or provide the services that are the object of the contract, unless expressly indicated otherwise. If you do not provide or not accept this Privacy Policy, we cannot serve you correctly nor can we provide you with the requested service.
 
In order that we may keep your personal information up-to-date, it is important that you inform us whenever there have been any changes thereto.
The data provided by the interested party shall be assumed to be correct. If any error should occur, EMT will not be liable for the incorrect execution or non-execution of their requests or the contract to which they are party.
The interested party is also responsible for the veracity of the data provided. EMT reserves the right to exclude any interested party who has provided false information from the services provided, without prejudice to any other actions that may be required by law.
We are not responsible for the privacy policy regarding personal data that you may provide to third parties through the links available on our website.
 

1. Special data categories

 
Do not provide us with any personal data in the free text fields of the forms on our website or our apps that may be classified as specially protected, such as personal data that reveal race, ethnic or racial origin, political opinions, religious or philosophical convictions or beliefs, trade union affiliation, genetic and biometric data or data relating to physical or mental health, an individual's sexual life or orientation or any data relating to convictions or criminal offences.
In the event that EMT requires this information at any time, it will request the express consent of the owner of that data (either through a declaration or clear affirmative action) to collect and use that information, previously and unequivocally notifying the data owner of the reason for the collection and processing of that information.
In the event that such information is voluntarily communicated by the user to EMT without it having been requested by the latter party, this communication will constitute an explicit act by the user that implies the existence of a manifestation of express consent by the user regarding the processing of their data by EMT.
 

1. Modification of the Privacy Policy

This Privacy Policy may be amended with regard to legislative requirements and/or self-regulation. Website users are therefore advised to visit it periodically and, at least, every time they provide their information.