PERSONAL DATA PROTECTION POLICY
Who is the Data Controller of your personal data?
The Data Controller of your personal data is Barcelona de Serveis Municipals, S.A. (hereinafter “BSM”), with registered address on Carrer Calàbria 66, 08015, Barcelona, telephone no. 93.887.50.34 and email protecciodades@bsmsa.cat.
Interested parties are also informed that BSM has appointed a Data Protection Delegate who can be contacted by phone on 93.887.50.34 or by email to dpo@bsmsa.cat.
What is the purpose of us processing your data, and what is the legal basis of this processing?
1. Managing use of the Smou app
BSM will process the personal data you provide us with in order to manage your registration and use of the services provided by the Smou app.
The legal basis for this processing is the execution of the contract in which the interested party is involved or the application of pre-contractual measures, at the interested party‘s request, under Article 6.1(b) of the GDPR.
2. Controlled access to the app via the authentication of biometric data
BSM will process your personal data for the purpose of controlling access to the app via biometric data authentication. In that regard, BSM will not store your biometric data, it will simply check that said data matches the data stored on your mobile device.
The legal basis that legitimises this processing is the execution of the contract in which the interested party is involved or the application of pre-contractual measures, at the interested party‘s request, under Article 6.1(b) of the GDPR.
Likewise, the exception to Article 9.2, which is applied to processing of special categories of data, more specifically, the processing of the interested party‘s biometric data, is the explicit consent of the interested party (letter a).
3. Geolocation
If you provide your consent, BSM will be able to access your location in order to offer you a better service.
The legal basis for this processing is the consent of the interested party, under Article 6.1(a) of the GDPR.
4. Managing commercial communications
If you provide your consent, BSM will process the personal data you provide us with in order to manage the sending of commercial communications from Smou and all other BSM businesses.
The legal basis for this processing is the consent of the interested party, under Article 6.1(a) of the GDPR.
5. Satisfaction surveys
BSM will process the personal data you provide us with for the purpose of managing the sending of satisfaction surveys in order to find out the opinions of interested parties and to make any improvements that may be necessary.
The legal basis for this processing is the legitimate interest of the data controller under Article 6.1(f) of the GDPR. Specifically, the legitimate interest pursued by BSM is improvement of its service provision.
How long do we keep your personal data?
BSM will keep your personal data for the time required to fulfil the purpose for which they have been collected, provided you do not request the deletion of said data or withdraw your consent.
Once the purpose for which the personal data was collected has been fulfilled, or their deletion has been requested, or consent withdrawn, according to Article 32 of Organic Act 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights, the personal data will be duly blocked for the time necessary to meet the corresponding legal obligations in each case.
To whom will the personal data be disclosed?
BSM may disclose your data to public or private third parties when there is an obligation or legal authorisation to do so.
Likewise, in order to provide you with the services, BSM may use service providers who may have access to your data and who will be acting in the name of and on behalf of BSM, following our instructions, and under no circumstances will they be able to use your data for their own purposes.
Are there any international personal data transfers?
BSM does not anticipate any international data transfers. However, should such transfers take place in the future, the provisions of the applicable data protection regulations shall be taken into account and applied.
Is automated decision-making and profiling carried out with the personal data?
BSM may carry out profiling using your personal data, based on the legitimate interests of the data controller, for the purpose of creating effective customer profiles in order to facilitate business decision-making processes (data analytics).
What are your rights as a data subject?
• Withdrawing consent: you will have the right to withdraw your consent at any time. However, withdrawing your consent shall not affect the legality of the processing carried out up to that moment.
• Access: You may receive confirmation if BSM processes your personal data and view the personal data that BSM processes.
• Rectification: You may correct your personal data if they are inaccurate and complete them if they are incomplete.
• Erasure: You may request that your personal data be deleted for several different reasons, including on the grounds that the data are no longer necessary for the purposes for which they were collected.
• Objection: You may request that your personal data not be processed. BSM shall stop processing the data, unless there are overriding legal reasons for the processing or it is necessary for the exercise or defence of legal claims.
• Restriction of processing: You may request the restriction of data processing in the following cases:
- While a challenge regarding the accuracy of the data is being investigated;
- When the processing is unlawful and you oppose the deletion of the data and request the restriction of their use instead;
- When BSM does not need to process the data, but you need that data to exercise or defend legal claims;
- When you have objected to the processing of the data for the performance of a task in the public interest or for the fulfilment of a legitimate interest, pending the verification of whether the legitimate grounds of BSM override yours.
• Portability: You may receive an electronic copy of any personal data you have provided us with and any data that has been obtained through your relationship with BSM and forward them to another entity.
You may exercise these rights by means of a written request addressed to Barcelona de Serveis Municipals, S.A., Carrer Calàbria, 66, 08015, for the attention of the Data Protection Officer, or you may send an email to the following email address: protecciodades@bsmsa.cat. Please be informed that in order to exercise your rights, you will have to provide sufficient evidence of your identity, indicating which right you wish to exercise.
Lastly, the interested party will have the right to file a claim before the Catalan Data Protection Authority (https://apdcat.gencat.cat/) if they believe that BSM has not processed their data in accordance with applicable legislation.