Add tickets

Privacy policy

This Privacy Policy provides detailed information on how UTE SERVICIO AEROBÚS – CIF U27518471 (en adelante, AEROBÚS), uses and protects your personal data, as well as your rights in this respect.

AEROBÚS is a Temporary Union of Companies (UTE) which is made up of several partner companies (ALCALABUS, S.L., EMPRESA MONFORTE, S.A.U.(EMSA) and CASTROMIL, S.A.U.) which are entities associated to the group of companies with related commercial interests that use the brand Monbus in their commercial activity (hereinafter Monbus) according to what is established in the privacy policy www.monbus.es (see updated list in Legal Notice of the corporate website www.monbus.es).

In this sense, AEROBÚS has the corporate services of Monbus that support all the branches of activity, of which we highlight the central services of Safety and Prevention, Quality and Environment, Innovation and ICT, Maintenance and Infrastructures, Commercial and Marketing, Human Resources, Legal and Financial Services.

These departments have a very direct involvement with the production structure of AEROBÚS, so that the entity enjoys an autonomous and sufficient production organisation, and benefits from numerous synergies and technical contributions from the operational structure of the UTE.

In any case, and in order to conveniently inform you of the policy of use of personal data, we inform you below of our privacy policy:

 

Applicable legislation

The processing of data by the organization is subject to Spanish and European legislation, specifically the following:

 

Identity of the data controller

For the purposes of this Privacy Policy, the person responsible for the processing of personal data is:

  • Company name: UTE SERVICIO AEROBÚS – CIF U27518471 (AEROBÚS)

  • E-mail of contact with Data Protection Responsable Delegate: rgpd@aerobusbarcelona.es             

 

Principles applicable to the processing of personal data

The processing of data by AEROBÚS always complies with the requirements laid down in the new European Data Protection Regulation, in particular the following:

  • Principle of lawfulness, loyalty and transparency: express consent is required prior to the processing of personal data.

  • Principle of data minimization: in any case the strictly necessary data are requested in relation to the purposes for which they are requested.

  • Principle of limitation of the conservation period: the data will not be kept longer than the legitimate one, informing of the conservation period in each case.

  • Principle of integrity and confidentiality: the data you provide will be treated establishing the relevant guarantees to obtain adequate security and ensuring confidentiality.

 

When do we collect your personal data?

  • When you fill in the different contact or request forms, we collect the personal data that you provide us with and any additional personal data that you provide us with in order to manage the Response to Queries, Complaints or Incidents, Requests for Technical or Corporate Information, Resources and/or Activities, as well as in the case of job offers for the management of your incorporation to the same and/or to the AEROBÚS employment exchange.

  • Every time you contact us directly, for example by e-mail, post, through customer service points, by telephone or through social networks to contact or request information about our products and services.

  • When you register or browse this website, “cookies” are stored. You can consult the Cookies Policy at any time to learn more about the use of cookies and how to disable them.

  • Through third parties with whom the person responsible for processing maintains a commercial relationship or provision of services and for which you must have your personal data for processing the service requested or to meet our contractual and regulatory commitments associated with the service object of contracting and / or for verification of compliance with regulations under the responsibility of the organization.

  • If you access facilities or vehicles under the responsibility of AEROBÚS, we may collect your image and access data through the video surveillance and access control systems provided by that facility and/or vehicle.

  • In the case of job offers, through third parties hired to select candidates for vacancies or jobs in entities associated with the Group, as well as, where appropriate, temporary employment agencies (ETTs) and / or entities with which there are training agreements and provide curriculum vitae of candidates for the selection of the profile best suited to the position.

  • If you have given us your consent to receive marketing communications, we may ask for your opinion on certain topics about your experiences with us.

 

What is the legitimacy for the processing of your data?

The legal basis for the treatment of your data is the fulfillment of your request, offer, order and/or commercial contract, for which the data provided will be communicated to the person in charge of the Brand in order to adequately attend, where appropriate, to the guarantees and responsibilities of the products and services you provide. The data requested are necessary for the correct provision of the same.

Comply with a legal obligation applicable to the process in each case: Regulations with the rank of administrative, mercantile, tax, fiscal, accounting and financial law and sectorial, consumer and user defence legislation, as well as, where applicable, labour regulations and applicable occupational risk prevention legislation.

Satisfy a legitimate interest of the person in charge: Processing of data as parts of a commercial relationship and/or contract, which are necessary for its maintenance or compliance, data transmissions within business groups for internal administrative purposes, direct marketing, fraud prevention, cases of legitimate interest in which the responsible party could be harmed and it was necessary to process and communicate the data of the non-compliant party to third parties in order to manage regulatory compliance and defend the interests of the data controller, purposes of video surveillance as a legitimate interest of the organization in the protection of its assets, the legitimate interest of direct marketing enabled by the LSSICE (sending commercial communications on products or services similar to those contracted by the customer with whom there is a previous contractual relationship), as well as cases of legitimate interest of specific treatments contemplated in the LOPDGDD: Article 19. Treatment of contact data and individual entrepreneurs; Article 20. Credit information systems; Article 21.Treatment related to the performance of certain commercial operations (corporate restructuring or business transfers) Article 22. Treatment for video surveillance purposes; Article 23. Advertising exclusion systems; Article 24. Internal complaints information systems.

Likewise, the legal basis may be determined by the consent of the interested party who has unequivocally provided us through formal means and/or by ticking the boxes enabled for this purpose in the data protection clauses enabled in the base document that has regulated the relationship according to the contact channel.

 

What personal data do we collect?

Through the different services and contact channels described in this Privacy Policy, the following types of data may be collected depending on the type of consultation or management that is formalised:

  • Identifying data: name, surname, identity document (tax identification number or code, foreigner identification number, passport or residence permit), date of birth, place of residence.

  • Contact details: postal address, e-mail, fixed telephone number, mobile telephone number.

  • Transactional data: information on purchases, reservations, invoicing and collection, payment methods, bank details and any data relating to your transactions with us.

  • Electronic data: IP address, type and language of the browser, domain through which you access the Website, navigation data, entry profiles.

  • Other type of data: contact details of third parties involved or related to the service object of the contract/application. For quality reasons, recordings may be made of conversations carried out in the call center.

  • Curricular data, in the case of job offers: Academic and professional data relating to training, qualifications and professional experience; Personal data associated with marital status, family data, date and place of birth, age, sex, nationality; Work permit; Employment status data; Other data (career aspirations, leisure and hobbies). In no case should personal data referring to ideology, religion, beliefs, racial origin, health, sexual life or union affiliation be included in the CV.

The structure of the data we process does not contain data relating to criminal convictions and infractions, nor sensitive data, except in cases in which, except in cases in which it is required for a certified offer of employment of sexual crimes in order to be accredited or justified the fulfilment of said condition in the selection process, or the holder is a beneficiary of special conditions, requires adaptation services due to reduced mobility or alleges injuries due to an accident or loss claim and has to provide documentation that incorporates said information in order to be accredited or justified the fulfilment of said condition.

AEROBÚS does not knowingly collect information on minors unless it has the express consent of their legal guardians or guardians, or they provide it (e.g. in the management of purchases and/or ticket reservations).

By accepting the data protection clauses enabled in the base document that has regulated the relationship according to the contact channel and the related privacy policies, you declare that you are over 14 years of age and have legal capacity* and expressly consent to the processing of data in accordance with the provisions of the additional data protection clause and information. If you have ticked the corresponding consent box, the legal basis for these purposes is your consent, which you may withdraw at any time.

(*) In cases in which it represents a minor under 14 years of age or a person with legal incapacity, it declares that it is responsible to have parental authority or guardianship of the minor or the corresponding legal representation, the justification for which may be required by the Data Controller in order to legitimise the accepted consent.

 

Purpose of the personal data collected

AEROBÚS processes the personal data provided for the following purposes:

  • Attention to your queries and requests: Management of Responses to Queries, Complaints or Incidents, Requests for Information, Resources and/or Activities.

  • Contact with the interested party through the means of communication provided (mail, postal address and/or telephone) in order to manage the queries you send us through the channels set up for this purpose, manage warnings, notify you of changes in our services and coordinate actions derived from the services you request from people related to AEROBÚS and/or those in charge of processing related to it for legitimate and/or consented purposes.

  • The contact and sending of personal communications, invitations to events and gifts addressed to clients, congratulating them on special dates, carrying out quality and satisfaction surveys, as well as periodically informing them of new developments, news and corporate information, information on contests, tariffs, offers and promotions of products and services of the organisation, with the aim of evaluating the quality of our processes and providing them with offers of products and services of interest through the different means of communication provided, in accordance with the provisions of the LSSICE or to the extent that they have consented to it.

  • The contact and sending of personal and commercial communications by Monbus entities for the contact and sending of personal communications, invitations to events and gifts addressed to customers, the carrying out of opinion polls, as well as to periodically inform you of news, products and/or services, as well as news and corporate information and offers and promotions of products and services both by telephone, written and electronic means, such information being suitable for your particular profiles, to the extent that you have unequivocally consented to us. (*) You can consult the updated list of entities associated to the group of companies with similar commercial interests that use the brand Monbus in their commercial activity according to what is established in the privacy policy www.monbus.es (see updated list in the Legal Notice of the corporate web www.monbus.es).

  • Management of registration for AEROBÚS conferences and events and/or subscription to the AEROBÚS newsletter and/or news

  • For the Offer and Commercial Management of AEROBÚS products and services. Internal use, performance of operations and administrative, economic and accounting management derived from the relationship with the holder (commercial and/or contractual relationship) and for the Management of the Hiring and provision of services of the organization, as well as compliance with contractual and regulatory requirements linked to the organization or operation requested.

  • Management of the online purchase of services: facilitating the management of the contractual relationship, facilitating access to the website by means of access codes; satisfying a specific request, delivery, query or provision of a service requested by the user; administering the user register, attending to and properly managing the queries, comments, incidents or suggestions submitted; managing the basic administration tasks; attending to and properly managing the requests for quotations that have been sent to us through this means; satisfactorily managing the purchase of tickets; managing the registration, modification or cancellation of the cards and/or vouchers offered. The AEROBÚS online service conditions of purchase are available on our corporate website.

  • Quality control of our products and services, quality management of processes and activities, as well as the evaluation of satisfaction/perception results and performance of the organization’s stakeholders. Statistical and historical purposes that allow us to improve the commercial strategy of our products and services.

  • Providing evidence of justification for campaigns, activities, promotions, competitions, projects and subsidies in which the organization participates.

  • Regulatory Compliance Management (applicable regulations as well as obligatory internal regulations): Investigation, monitoring and auditing of controls established for the prevention of crimes, with the possibility of establishing controls on access to the facilities, as well as controls on the use of images captured by video surveillance systems for the investigation of accidents and/or incidents that may occur, as well as non-compliance with regulations, crimes or illegal behaviour.

  • Evaluation of Capital and Credit Solvency in order to confirm the economic viability of the operation requested, as well as, where appropriate, the communication and management associated with the claim of the amounts agreed for the provision of the service.

  • Consult the advertising exclusion systems that could affect their actions, excluding from the treatment the data of those affected who have expressed their opposition or refusal to it through the consultation of the advertising exclusion systems published by the competent control authority.

  • Associated management, including prior communication thereof, which may derive from the development of any operation for the structural modification of companies or the contribution or transfer of business or branch of business activity, provided that the processing is necessary for the successful outcome of the operation and guarantees, where appropriate, continuity in the provision of services.

  • Inclusion in the complaints channel systems of data associated with the disclosure (even anonymously) of the commission within the organisation or in the actions of third parties that contract with it, of acts or conduct that may be contrary to the general or sectorial regulations applicable to it.

  • The management and audit of management systems and regulatory compliance of the organization’s processes and facilities.

  • The management and processing, where appropriate, of accidents and accident claims through mediators and insurers in charge of processing files: In the event of an accident, record in writing the notifications of loss received and all the data and circumstances that serve to qualify it, as well as the checks carried out for this purpose. Communicate to the insurer the occurrence of the accident, the actions taken to minimise the consequences of the incident and do everything necessary so that the insured or beneficiaries can obtain the benefits of the insurance. Processing and resolution of the claim: Processing of the claim in the insurer, thus initiating the various processes for resolution (expertise / valuation / study / resolution. – Defence if applicable – closure). Use all reasonable measures at its disposal to save or recover the insured effects and, in general, to avoid or reduce the damage resulting from the loss. To carry out the necessary diligences to find out and verify the facts occurred as a consequence of an accident or incident, specifying in it the facts ascertained, the declarations and reports received and all the circumstances that they had observed and that could constitute indications of crimes and/or defence arguments against the same in order to delimit the correct imputation of responsibilities and costs. Collect proof of the bodily harm resulting from the accident, being able to provide facultative certificates of the injuries suffered and literal certification from the Civil Registry, in the event of death. To obtain the justification of the affected person as an insured person by means of the ticket or document that enables transport onerous or free of charge, or by means of a certificate issued by the authority or company that ordered the provision of the service during the journey, as well as by any other means of proof admitted by law.

  • Proceedings in case of incidence or patrimonial responsibility: Internal use, case proceeding in case of incidence or patrimonial responsibility, resolution of initiation of case, as well as in its case, the administrative, economic and accounting management derived from the collection of compensations for damages caused by third parties to AEROBÚS or payment of damages caused by AEROBÚS to third parties. Management of the notification of the incident or liability file: Contact with the interested party through the means of communication provided (mail, postal address and/or telephone). Management of the collection of compensation for damages caused by third parties to AEROBÚS or payment of damages caused by AEROBÚS to third parties.

  • Dissemination of our best practices with regard to the services we have provided and/or the publication and/or communication of graphic material that may incorporate the image of the owner and/or the personnel in charge in corporate media (for example, but not limited to, web, social networks, newsletters, activity reports, reports, presence in the media) and/or other public communication media (sectorial publications and/or reports in the written press, TV, …), as dissemination of the results of the activity, promotion and dissemination, management of campaigns, activities and events and/or as accreditation of technical solvency in the event of requests for evidence of justification in bidding processes, technical offers, projects and subsidies in which entities associated with the Group participate, to the extent that we have unequivocally consented.

  • Access Management and Video Surveillance of the Facilities and vehicles, as well as security and regulatory compliance in them, preserving the safety of people and goods and facilities, the investigation of possible incidents or accidents, management of associated insurance, time control and/or attendance or attendance and monitoring of functional performance, as well as verify compliance by workers of their obligations and duties under Article 20.3 of the Workers Statute which empowers the employer to adopt surveillance and control measures to that effect and the management of warnings or penalties for breaches of safety standards.

  • Registration of accesses and capture of images of vehicles that access the facilities under the responsibility of AEROBÚS for the purpose of accreditation of the state of the vehicle prior to entering the facilities in the event of potential claims for damages by the user and/or claims against the person responsible for treatment.

  • Verify driver’s licenses for access to non-driver rental services or other government-provided identifications to verify the safe driving criteria for qualified drivers; verify the applicant’s eligibility to use a designated or assigned account for the purchaser of the service and discount codes; resolve toll, traffic, or parking violations; process any accident and/or injury claims; provide route assistance services and protect or defend the rights or welfare of ourselves, our employees, customers, and others; and as otherwise necessary to provide the requested services. Some vehicles you rent may be equipped with devices that allow us to send orders and receive certain vehicle information, including geolocation data from a global positioning system (GPS). These devices are on all the time, even when other services or devices in the vehicle are off. The Treatment Manager will be able to collect and process vehicle information about the vehicle itself, such as fuel level, odometer, speed, diagnostic and performance data, tyre pressure, accident or damage information, as well as information about the location and destination of the route. This information is useful to us in providing our services (such as responding to requests to unlock doors, remotely start and stop, and remotely remove and return abandoned vehicles), software updates, product support, location and response in the event of an accident, identification of vehicles subject to misappropriation, reported as lost, not returned, allegedly stolen and stolen, or other information requested by law enforcement agencies or forces. We may also use this information to set some of the fees that will be charged for our services. This information also helps us understand vehicle operation or driver behavior, such as traffic patterns, fuel economy, driving behavior, vehicle use, environmental impacts, and vehicle maintenance improvements. We may share vehicle information with third parties who assist us in providing and improving our services, as well as law enforcement agencies and others, in order to protect our rights or enforce the terms and conditions of our services. For more information about how we share the information we collect, please see the recipients in this privacy policy. Services and similar features provided by the manufacturer, which may be included in the rental, may also collect vehicle information. We recommend that you consult their privacy policies.

  • Compliance with legal and regulatory obligations: to comply with our legal obligations to comply with information requests made by judicial, regulatory and supervisory bodies and State Security Forces and Corps. AEROBÚS, as the data controller, is subject to the laws of the countries in which it operates, and is obliged to comply with them. These obligations include the provision, under certain circumstances, of personal data to judicial bodies, regulatory or supervisory bodies and state security forces. These data processing operations are based on the existence of a legal obligation to cooperate with such bodies.

  • To better understand your purchasing behaviour through your profile in order to develop and improve our products and services in order to provide you with a better shopping experience; to analyse the effectiveness of our marketing communications and offer you offers, advice and information that are more relevant to you and our customers; to create a clearer image vis-à-vis them, as a group and as individuals, and thus provide you with a fluid, relevant and consistent service, to the extent that you have unequivocally consented to us.

Likewise, in the case of candidates who provide us with their curriculum vitae, we also process their data for the following purposes:

  • Internal use for job selection processes, to create the database of the different candidates to cover the jobs offered through the website relating to entities associated with the Association, to carry out the corresponding selection process and communicate the results thereof, as well as for their incorporation to the AEROBÚS Job Centre and for the offer and management of possible job offers or collaboration that may be generated.

  • Management of the evaluation of the competencies of candidates and persons in the selection and/or internal promotion to work posts.

  • Processing and communication of your data by MONFOBUS, S.L., as the entity in charge of carrying out the AEROBÚS selection processes, insofar as vacant posts may be offered from different entities of the grouping, to the company offering the job, as well as, if it has been authorised to do so, to the rest of the companies offering jobs for future selection processes. This communication of data will allow the selection process to be carried out.

  • Use in relation to the development of the application and its incorporation to the AEROBÚS Employment Exchange for the offer and management of possible job offers or collaboration that may be generated, to the extent that it has unequivocally consented. Insofar as this purpose is not consented to, we may not proceed to receive your application as long as the management of candidates is carried out through the aforementioned employment agency.

  • Use of your CV in the technical offer to projects in which your incorporation is valued, if you have unequivocally consented to it.

  • Regulatory Compliance Management (applicable regulations as well as obligatory internal regulations): Investigation, monitoring and auditing of controls established for the prevention of crimes. Controls may be established for access to facilities, information systems and printing of documentation for all personal data under the responsibility of the organization and therefore for all the information systems of said entity, as well as controls relating to the use of images captured by video surveillance systems for the investigation of accidents and/or incidents that may occur, as well as non-compliance with labour regulations, crimes or unlawful conduct.

  • Contact management with the interested party through the media provided (mail and/or telephone) in order to manage warnings and coordinate actions for the management of the selection process by people related to AEROBÚS and/or third parties hired by the selection processes of candidates for vacancies or jobs.

  • The performance of the tests and/or certificates of aptitude that may be required for personnel selection purposes, which shall be optional, shall be understood as an expression of the user’s consent to the inclusion of the data provided, as well as, eventually, their evaluation, in the database of the AEROBÚS Job Centre and their automated processing for the purpose of carrying out that selection. As a consequence of the access to the facilities that may be required to carry out these tests and/or aptitude certificates, treatments associated with the security of these facilities may be carried out by means of access registration and/or video-surveillance systems.

In addition, to the extent that you are a supplier/collaborator of the organization, we also process your data for the following purposes:

  • Internal use, commercial and relational management, performance of operations and administrative, economic and accounting management derived from the relationship with the supplier/collaborator. Management of the Contracting and provision of services by the supplier/collaborator, as well as compliance with contractual requirements.

  • Management of the Selection, Homologation and Contracting of Suppliers/Collaborators and verification of regulatory compliance. Health and safety management (prevention of occupational risks and coordination of business activities), as well as the evaluation of their compliance.

  • Management of Answers to Consultations, Complaints or Incidents, Requests for Information, Resources and/or Activities that could be formulated by the interested party and/or a third party related to the organization in relation to the works and/or services provided by the supplier/collaborator to the organization.

  • Management of quality certificates issued by suppliers for dissemination to all customers or third parties who require it from AEROBÚS.

  • Time and attendance control or attendance and monitoring through access registration, video surveillance and confirmation of functional performance both in the facilities of the organization and in facilities of third parties in which the interested party carried out functions of service provision to the organization (monitoring and control to verify compliance by the supplier / collaborator of contractual obligations).

  • Quality management of processes and activities, as well as the evaluation of satisfaction/perception results and performance of the organization’s stakeholders. Conducting surveys.

  • Contact management with the interested party through the corporate media provided by the organization (mail and/or telephone) in order to manage warnings and coordinate actions by people related to the organization, as well as facilitating such means to third parties who request contact with the interested party. In the cases in which the interested party consents unequivocally, the use and facilitation of private means of contact (mail and private telephones) may be carried out to people related to the organization and to third parties who request it.

  • Statistical and historical purposes: statistics and indicators of performance, safety and health, as well as a history of professional relationship with the organization.

  • The management and auditing of management systems and/or occupational safety management and regulatory compliance of processes and facilities of the organization, as well as the reservation of the right to conduct periodic audits at its facilities as part of the agreements reached in the commercial relationship, in cases where the interested party consents unequivocally.

  • Evidence of Regulatory Compliance of the Organization before a third party that requires it: Communication to third parties of those data relating to the interested party that are required by them in order to comply with the coordination of business activities, evidence of regulatory compliance of the organization and the internal regulations of the third party and / or for the management of access to facilities. In cases in which the interested party unequivocally consents, the communication of the information/documentation required by the third party may be carried out that are not explicitly included in the legal or regulatory obligations established, but in the internal regulations of the third party.

 

Responsibility for the veracity of the data

You are responsible for the veracity of the data provided, AEROBÚS reserves the right to exclude you from the services provided in the event that you have provided false data, without prejudice to other actions that may proceed in accordance with the law.

 

Data retention period

The data provided shall be kept for as long as the relationship of lawfulness of processing is maintained and when the validity of the relationship has expired the data subject does not request its deletion, with the exception of its conservation for the formulation, exercise or defence of claims of the controller or with a view to the protection of the rights of another natural or legal person and/or for reasons of legal obligation.

Data relating to accounting and tax regulations during the statute of limitations for criminal offences.

Data referring to certain debts, due and demandable and unclaimed (Art. 20 of LOPDGDD) – as long as the breach persists, with a maximum limit of five years from the date of expiration of the monetary, financial or credit obligation.

The images/sounds captured by the video-surveillance systems shall be deleted within a maximum period of one month from their capture, except when they have to be preserved to accredit the commission of acts that threaten the integrity of persons, goods or facilities (in which case, the images shall be made available to the competent authority within a maximum period of 72 hours from the time the existence of the recording is known), or are related to serious or very serious criminal or administrative infractions in matters of public security, with an ongoing police investigation or with an open judicial or administrative procedure (Art.22 LOPDGDD).

Audios that may be recorded as a result of the telephone answering service will be kept for 1 month, with the exception of their storage for the formulation, exercise or defence of claims by the data controller or for the protection of the rights of another natural or legal person and/or for reasons of legal obligation.

The data processed in relation to the legal guarantee will be kept during the validity of the legal guarantee and once the validity of the same has expired, for as long as there may be a judicial or administrative claim in relation to the legal guarantee. The data of the person making the communication of a denunciation and of the employees and third parties are kept in the denunciation system in order to decide on the appropriateness of initiating an investigation into the denounced facts, as well as subsequently as evidence of the functioning of the model for the prevention of the commission of crimes by the legal person, in accordance with article 24 of the LOPDGDD.

The data relating to the curriculum you could send us will be kept for 6 months in the cases in which you wish to join the employment agency (except in those cases in which the candidate is selected in which case, will become part of the HR data processing of the contracting organization), as well as the legally provided time limits for the exercise or prescription of any action for liability for breach of contract by the interested party or the Organization. The data of those candidates who only wish to remain in the offer would be destroyed after the selection process.

The data processed for the purpose of sending commercial communications will be kept until you revoke your consent.

They will then be blocked, unless the law requires or permits a longer retention period (for example, for the formulation of the exercise or the defense of claims), in which case, they will be duly retained blocked for the time necessary before proceeding with their deletion.

 

Recipients of the data

We only use, transfer or share personal data with third parties in the terms described in this Privacy Policy. AEROBÚS does not sell or rent your personal data to third parties and will only disclose it to persons or entities if we obtain your prior consent or in compliance or compliance with applicable law when such consent is not necessary for a specific transfer.

We will share or give third parties access to your personal data when doing so is necessary to achieve one of the objectives described below and in accordance with applicable law:

  • Group of companies with similar commercial interests that use the Monbus* brand in their commercial activity in accordance with the provisions of the privacy policy (*)You can consult the updated list of entities associated to the group of companies with similar commercial interests that use the brand Monbus in their commercial activity according to what is established in the privacy policy www.monbus.es (see updated list in the Legal Notice of the corporate web www.monbus.es).

  • Our suppliers: AEROBÚS will communicate or allow access to your personal data to companies that provide services to us under a contract for the provision of services, when it is necessary for the fulfilment of the purposes previously described in this Privacy Policy. If any of these service providers needs access to your personal data, we ensure that they use it only to provide us with a service and in accordance with our instructions. We also require them to maintain the confidentiality and security of the data and to return or destroy the data when they no longer need it.

  • Legal Obligations: AEROBÚS may communicate your personal data when the transfer is authorised by law or is necessary to fulfil a legal obligation, including transfer to competent authorities, judges and courts.

  • Travel Agencies that have processed the service on behalf of the holder and/or the person or entity that proceeds to pay the invoice, to the extent that we have unequivocally consented.

  • Responsible for the vehicle and/or the Brand for the purposes derived from the contractual relationship (guarantees and responsibilities of the vehicle indicated and of the products and services it supplies) and if it has consented, for the purposes described in the additional consents.

  • The owner of the establishment and/or vehicle, for legitimate interest in the protection of the assets under their ownership.

  • Bodies or organs of the Public Administration with competence in matters subject to the purposes of treatment: AEAT, as well as governmental, regulatory and law enforcement agencies in the following cases: to verify your driver’s license and ensure that you meet our criteria for safe driving; as required by these agencies when disclosure is required or permitted by law; to take action against illegal activities or violations of service conditions; when we believe in good faith that there is an emergency involving a threat to your safety or that of another person; and when required or permitted by law, agencies or organs of the Public Administration with competence in the matters targeted for treatment purposes.

  • Insurance Companies, in cases of investigation of incidences and/or crimes or illicit and that are necessary for the coverage of responsibilities.

  • Mediators and Insurance Companies: In the event of a claim, incident or accident, insurance companies are provided for the investigation of the event in order to delimit the scope and coverage of the insurance premium contracted by the person responsible for treatment.

  • Financial Entities: Direct debiting of receipts and/or management of collection of bills and other means of payment, as well as for the management of the electronic commerce payment gateway.

  • Security Forces and Bodies: Insofar as a justified right of access was required in the investigation of a regulatory non-compliance.

  • Compliance Complaints Channel (Complaints regarding violations of regulations and code of conduct are transmitted to the Regulatory Compliance Unit): Access to the data contained in these systems will be limited exclusively to those who, whether or not included within the entity, carry out the internal control and compliance functions, or to those in charge of processing that may be designated for this purpose. However, access by other persons, or even communication to third parties, shall be lawful when necessary for the adoption of disciplinary measures or for the processing of legal proceedings as appropriate.

  • In the case of CVs, entities associated with Monbus: To the extent that vacancies may be offered from different companies with similar commercial interests that use the Monbus brand in their activity, by registering for the offer and/or sending your CV and accepting the clause you expressly consent to us communicating your data for the same purpose to the company offering the job, as well as, if you have so authorized in the previous box, to other companies that offer jobs for future selection processes.

 

Under what guarantees are your data communicated

The communication of data to third parties is made to entities that accredit the provision of a Personal Data Protection System in accordance with current legislation.

 

Surfing AEROBÚS website

When browsing this website, non-identifiable data may be collected, which may include, but is not limited to, IP addresses, geographic location (approximately), a record of how the services and sites are used, and other data that cannot be used to identify the user, unless the user registers at the site.

Among the non-identifying data are also those related to your browsing habits through third party services.

For further information, please refer to our Cookies Policy.

 

Data Security

AEROBÚS is committed to the use and processing of the personal data you provide to us, respecting your confidentiality and using them in accordance with legitimate purposes. It also undertakes to comply with the obligation to store them and apply appropriate measures to prevent alteration, loss, treatment or unauthorized access, as established by current data protection legislation.

In relation to the treatment of your personal data, we inform you:

The person responsible for processing takes all necessary measures to keep your personal data private and secure. Only authorized persons of AEROBÚS, authorized personnel of third parties directly contracted by the Responsible of Treatment for the rendering of services linked with the purposes of treatment or authorized personnel of entities associated to AEROBÚS that have the legal and contractual obligation to keep all the information of sure form) have access to their personal data. All AEROBÚS personnel who have access to your personal data are required to undertake to respect the Privacy Policy of the person responsible for Processing and the data protection regulations, and all employees of Third Parties who have access to your personal data are required to sign confidentiality commitments in the terms established in current legislation. In addition, it is contractually assured that third party companies that have access to your personal data keep it secure. To ensure that your personal data is protected, AEROBÚS has an IT security environment and takes the necessary measures to prevent unauthorised access.

The person responsible for processing has entered into agreements to ensure that we process your personal data correctly and in accordance with current data protection regulations. These agreements reflect the respective roles and responsibilities in relation to you, and consider which entity is in the best position to meet your needs. These agreements do not affect your rights under the Data Protection Act. For more information about these agreements, please do not hesitate to contact us.

AEROBÚS cannot, under any circumstances, guarantee the absolute impregnability of the Internet and therefore the violation of data through fraudulent access by third parties such as hackers and others.

In the event of any security incident, it will be notified to the AEPD in accordance with the protocol for security breaches based on current regulations.

 

Acceptance and Consent

It is necessary that you read and agree with these conditions on the protection of personal data, accepting and consenting to the processing of them, in the manner and for the purposes indicated in this Policy and the Legal Notice.

In compliance with personal data protection regulations, we treat the information you provide us during your relationship with AEROBÚS (as well as the personal data of other people you may provide us with) for the purposes specified in this privacy policy. In this sense, it declares to have been informed, to consent, as well as to inform and to have the consent of third parties of which it facilitates us personal data for this treatment.

By accepting and/or validating the process, you declare that you are over 14 years of age and have legal capacity* and expressly consent to the processing of data in accordance with the provisions of the clause and additional information on data protection. If you have ticked the corresponding consent box, the legal basis for these purposes is your consent, which you may withdraw at any time. (*) In cases in which it represents a minor under 14 years of age or a person with legal incapacity, it declares that it is responsible to have parental authority or guardianship of the minor or the corresponding legal representation, the justification for which may be required by the Data Controller in order to legitimise the accepted consent.

 

Revocability

The consent given by you, both for the treatment and for the transfer of data, can be revoked at any time by communicating it to AEROBÚS, in accordance with the provisions of this Privacy Policy for the exercise of rights.

Under no circumstances will this revocation be retroactive.

 

Your rights regarding the processing of your personal data

You, as the owner of the personal data, have the right to obtain confirmation of the possible processing of your personal data by AEROBÚS. Thus, you have the right to access your personal data, as well as the right to request the rectification of inaccurate data or, where appropriate, to request the deletion of such data when, among other things, the data are no longer necessary for the purposes for which they were collected.

Similarly, in certain circumstances, you may request the limitation of the processing of your data, in which case they will only be kept for the exercise or defense of possible claims or similar.

For reasons related to your particular situation, you may object to the processing of your data, after a legitimate reason, at which time AEROBÚS will cease processing the data, except for the exercise or defence of possible claims.

You have the right to have your data transmitted to another data controller in a structured, commonly used and machine-readable format. This right of portability applies when the processing of your personal data is based on the consent or execution of a contract and this processing is carried out by automated means.

You may at any time withdraw the consent given for the processing of your data.

The exercise by you of these rights is subject to certain exceptions for reasons of general interest (e.g. the prevention or detection of criminal offences) and for our own interests (e.g. the maintenance of the confidentiality of legal advice). If you exercise any of these rights, we will check that you are really entitled to do so, and we will respond within one month or the maximum period provided for in Spanish law, if this is lower.

  • Where to go to exercise your rights: If you wish to exercise your rights, please go to the channel established for the exercise of rights by the data controller: rgpd@aerobusbarcelona.es so that we can respond to your request in a managed manner.

  • Information required to exercise your rights: In order to exercise your rights, we need to accredit your identity and the specific request you make to us, as we request the following information:

    • Documented information (written/electronic mail) of the request in which the request is specified.

    • Accreditation of identity as holder of data object of exercise (Name, surnames of the interested party and photocopy of the DNI of the interested party and/or of the person who represents him, as well as the document accrediting such representation.

    • Address for the purposes of notifications, date and signature of the applicant (in case of writing), or full name and surname (in case of e-mail), or validation of the application in the private area of the communication channel with personal authentication key of his identity.

When the controller has reasonable doubts as to the identity of the natural person making the request, he may request that additional information necessary to confirm the identity of the data subject provided.

  • General Procedure for the Exercise of your rights: Once the required information has been received, we will proceed to respond to your request in accordance with the general procedure for exercising the rights of the organisation:

    • The data controller shall provide the data subject with information concerning his or her actions on the basis of a request in accordance with Articles 15 to 22 (Rights of the data subject), and in any event within one month of receipt of the request. This period may be extended by a further two months if necessary, taking into account the complexity and number of requests. The official shall inform the person concerned of any such extension within one month of receipt of the request, stating the reasons for the delay.

    • When the data subject submits the request by electronic means, the information shall be provided by electronic means where possible, unless the data subject requests otherwise. Only in cases where the controller’s processing systems permit, the right of access may be provided through a system of remote, direct and secure access to personal data which guarantees, on a permanent basis, access to all personal data. To this end, communication by the data controller to the data subject of the manner in which the data subject may access said system shall be sufficient to ensure that the request for exercise of the right has been complied with. Nevertheless, the interested party may request from the Data Controller the information referred to in article 15.1 of the RGPD that is not included in the remote access system.

    • If the data controller does not comply with the data subject’s request, he shall inform the data subject without delay, and no later than one month after receipt of the request, of the reasons for his failure to act and of the possibility of submitting a complaint to a supervisory authority and taking legal action.

    • The information provided shall be free of charge, except where there is a reasonable charge for administrative costs. Where the person concerned chooses a means other than the one offered to him which entails a disproportionate cost, the request shall be considered excessive and the person concerned shall bear the excess costs involved in his choice. In this case, only the satisfaction of the right of access without undue delay will be demandable to the Responsible of the Treatment.

    • The controller may refuse to act on the request, but will bear the burden of proving the manifestly unfounded or excessive nature of the request. For the purposes of article 12.5 of the RGPD, the exercise of the right of access may be considered repetitive on more than one occasion during the six-month period, unless there is a legitimate reason to do so.

    • In the cases in which it proceeds to the exercise of rectification or deletion, it will proceed to the blocking of its data: Data blocking consists of identifying and reserving data, adopting technical and organisational measures to prevent their processing, including their visualisation, except for making the data available to judges and courts, the Public Prosecutor’s Office or the competent Public Administrations, in particular the data protection authorities, for the purpose of demanding possible responsibilities arising from the processing and only for the period of limitation of the same. Once this period has elapsed, the data will be destroyed. Blocked data may not be processed for any purpose other than that indicated above. (art. 16 RGPD and art.32 LOPDGDD).

    • When the deletion derives from the exercise of the right of opposition under Article 21.2 of the RGPD, the Data Controller may retain the identification data of the data subject necessary to prevent future processing for direct marketing purposes. In cases where you do not wish your data to be processed for the purpose of sending commercial communications, we refer you to the existing advertising exclusion systems, in accordance with the information published by the competent control authority (AEPD) in its website www.aepd.es.

    • In cases where the processing of personal data is limited, this will be clearly stated in the information systems of the Data Controller.

    • In view of the existence of a certain, overdue and enforceable debt, a communication is sent to the debtor at the time of requesting payment regarding the possibility of inclusion in such systems (processing of the organisation’s arrears), with an indication of those in which it participates (collecting societies for the management of the relevant claim …) in the event that the debt is not resolved within a maximum period of 15 days from the notification of insolvency, the possibility of exercising the rights laid down in Articles 15 to 22 of the RGPD within 30 days of the notification of the debt to the system is reported, the data remaining blocked during that period.

    • The persons linked to the deceased for family reasons or de facto as well as their heirs may contact the data controller or data processor in order to request access to the personal data of the deceased and, where appropriate, its rectification or deletion. As an exception, the persons referred to in the previous paragraph may not access the data of the data subject, nor request their rectification or deletion, when the deceased person has expressly prohibited it or when a law so provides. Such prohibition shall not affect the right of heirs to access the deceased’s property data.

If you consider that your rights have not been properly addressed, you have the right to file a complaint with the competent data protection authority (www.aepd.es).

 

Changes to this Privacy Policy

AEROBÚS reserves the right to carry out, at any time, as many modifications, variations, deletions or cancellations in the contents and in the form of presentation of the same as it deems appropriate to adapt it to new legislation or case law, as well as to the practices of the organization, as we recommend that you consult our privacy policy whenever it deems appropriate. If you do not agree with any of the changes, you can exercise your rights in accordance with the procedure described by sending an email to rgpd@aerobusbarcelona.es.