Privacy Policy

  1. Home
  2. Barcelona Residents
  3. Privacy Policy

 

PRIVACY POLICY 

BSM complies with the current legislation on data protection and ensures the proper use and processing of personal data. The intended purpose of the requested information is detailed on each personal data collection form. The user can exercise their rights of access, rectification, erasure, right to object, portability and restriction of processing at any time by sending an email to: protecciodades@bsmsa.cat

DATA CONTROLLER

The data controller is Barcelona de Serveis Municipals, SA (BSM.SA), with Corporate tax ID (CIF) No. A08765919. BSM’s contact information is as follows:

The companies that make up the BSM Group can also be data controllers.

Parc d’Atraccions Tibidabo, SAU (Tibidabo Amusement Park- PATSA), with Corporate tax ID )CIF) No. A58819095. PATSA’s contact details are as follows:

Cementiris de Barcelona, SA (CBSA), with Corporate tax ID (CIF) No. A64302367. CBSA’s contact information is as follows:

The data subject is informed that BSM Group has appointed a Data Protection Officer (DPO), who can be contacted in relation to any matter concerning the processing of personal data. The data subject can contact the Data Protection Officer through the following contact details:

  • Postal address: Carrer Calàbria, 66, 08015, Barcelona
  • Tel: (+34) 93 887 50 34
  • Email address:  DPO@bsmsa.cat

What are we processing your personal data for?

Your personal data is processed for the purpose of managing and carrying out the contracted services.

Your personal data may also be processed for the following additional purposes, provided you have given us your consent:

  • To send you information and commercial communications regarding the contracted services and requests to take part in opinion surveys, to which end we may compile purchase profiles and analyse habits based on the information obtained.
  • To include your data on a database shared by BSMSA, PATSA and CBSA.
  • To send you information and communications relating to the BSM Group's services, activities and promotions, to which end we may compile purchase profiles and analyse habits based on the information obtained.

How long will we store the data?

The personal data provided by the data subject will be stored for the duration of the contract between the data subject and BSM Group. Once this contract is terminated, the personal data will be blocked until the applicable time limit has passed.

Where the data subject has given their consent to process their personal data, it will be stored until the data subject requests its erasure. Their personal data will then be blocked until the applicable time limit has passed.

For CCTV recordings, see the specific section.

What gives us legitimacy to process data?

The legal basis for processing the data subject’s data is the performance of the contract. To this effect, the data subject must provide the data required to provide these services. If this information is not provided, the contract cannot be concluded.

Regarding other uses of the personal data, the legal basis is the data subject's previous, unambiguous consent.

Which recipients can we communicate personal data to?

The data subject's personal data can be transferred to the following recipients:

  • Companies within the BSM Group.
  • Public administrations, when this is legally established, and Courts of Law and Tribunals.
  • Services providers that provide the BSM Group with services relating to the management of the contract concluded and which act as data processors. In all cases, third parties with whom certain personal data belonging to the data subject is shared must previously demonstrate that they have adopted suitable measures to properly protect the data.

What are the data subjects'rights concerning the data they provide to us?

All persons have the right to receive confirmation as to whether we are processing personal data that concerns them. Data subjects have the right to access their personal data, to request that erroneous information be rectified or, where necessary, to request its erasure when, among other reasons, the data is no longer required for the purposes for which it was collected.

In certain cases, the data subject has the right to request the restriction of processing of their data, in which case it will only be kept to initiate or defend against claims.

Under certain circumstances and for reasons related to their personal situation, data subjects can object to the use of their personal data. In this case, the BSM Group entities against whom the interested party is exercising this right will stop processing this information, except for where there are compelling, legitimate reasons to not do so or for initiating or defending against possible claims.

In any of the above situations, the BSM Group entity in question shall inform each recipient of the personal data of any rectification to, or erasure of, personal data, as well as of any restrictions on processing, provided that this does not entail an unreasonable effort. The BSM Group entity in question shall, at the data subject’s request, inform the data subject of who received their personal data.

The data subject also has the right to receive the personal data given to BSM that concerns them, in a structured, common-use, machine-readable format, and to communicate this information to another controller when its processing is based on consent or a contract and is effected through digital means.

At any time and for reasons related to their personal circumstances, the data subject has the right to object to their personal data being processed for the public interest or for BSM's or a third party's legitimate interest, including profiling. This means that BSM or another BSM Group entity must stop processing the personal data unless it can prove that there are compelling, legitimate reasons for such processing that prevail over the interests, rights and liberties of the data subject, or that it needs it in order to initiate, conduct or defend any claims.

The data subject is also entitled not to be the subject of a decision based solely on automatic data processing, including profiling, that has legal effects or affects them significantly, unless this decision is needed to enter into or perform a contract with BSM or another BSM Group entity and the entity has been authorised by current European or national legislation or it is based on the data subject's express consent.

The aforementioned rights of access, rectification, erasure, right to object, portability and restriction of processing, as well as not to be the subject of automated individual decisions, can be exercised through the following email address: protecciodades@bsmsa.cat

Finally, the data subject has the right to file a claim before the Data Protection Authorities.

How do we obtain the personal data?

The personal data processed at the BSM Group's various entities originates from the actual data subject and from Barcelona City Council.
The categories of personal data processed are:

  • Personal identity details
  • Postal and email addresses
  • Financial information
  • Commercial information

For the aforementioned purposes, BSM does not process specially protected data.

CCTV

BSM.SA shall process the images captured by cameras and CCTV (in recording and real-time viewing modes) in accordance with the following information:

PURPOSE: To preserve the safety and protection of people and property as well as the safety and operability of the entity’s equipment and facilities.

LEGITIMISATION: The legal basis for processing images by means of cameras or CCTV at the entity's facilities is:

  • The fulfilment of a public interest mission consisting of guaranteeing the safety of people, property and facilities.
  • The legitimate interest consisting of the need for BSM.SA, as controller, to put in place supervision measures to verify that employers comply with their work obligations.

RECIPIENTS: Images may be transferred to the State’s Law Enforcement Agencies as well as to the Courts and Tribunals pursuant to a legal obligation applicable to BSM.SA as controller.

STORAGE: CCTV images shall be kept for a maximum of one month after the date of capture. After that time, they shall be erased unless they must be stored in order to prove the commission of acts against the integrity of people, property or facilities.

In cases where the camera system used consists of real-time viewing, the images shall not be kept insofar as no images are recorded or stored.

RIGHTS: Pursuant to the current data protection legislation, the rights of access, erasure and restriction of processing may be exercised at any time through the following email protecciodades@bmsa.cat

 

© Barcelona de Serveis Municipals S.A.