Application privacy policity

APPLICATION PRIVACY POLICY
(Tibidabo Amusement Park)

Pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation) and other applicable legislation, BARCELONA SERVEIS MUNICIPALS, S.A. (hereinafter, ‘BSM’) hereby informs you, the user of the application (Tibidabo Amusement Park), of its data protection policy to enable you to expressly, freely and voluntarily choose to provide BSM with the personal data requested from you in connection with the various services offered in relation to the Tibidabo amusement park.

Identification of the controller
 

BARCELONA DE SERVEIS MUNICIPALS, S.A.
 

• Postal address: Carrer Calàbria, 66, 08015, Barcelona
• Tel: 93 887 50 34
• Email: protecciodades@bsmsa.cat

You, the user, are hereby informed that the BSM Group has appointed a Data Protection Officer (DPO), who can be contacted in relation to any matters concerning the processing of your personal data. You may contact the Data Protection Officer through the following contact details:

Postal address: Carrer Calàbria, 66, 08015 Barcelona Email: DPO@bsmsa.cat

Before using the application, you must take the following important aspects into account:
 

By using the application, you become a ‘user’. This entails acceptance of the terms of this privacy policy.

Before using the application, you must take into account certain aspects relating to the application’s minimum age of use and the quality of the data provided by you.

Minimum age of use: Users under fourteen (14) years of age may only use the application with their parents’ or legal guardians' authorisation. Therefore, by using the application, you declare that either you are fourteen years old or more or you have such authorisation.

What is the purpose of the processing?
 

In order to access and subsequently use the application, you must voluntarily provide personal data (mainly location and contact details). All data provided will be processed for the following purposes:

• To ensure the proper operation of the application.
• To maintain the service relationship that may be established.
• To provide information and to manage, administer, provide and improve the services.
• To send commercial communications regarding our goods and services.
• Other compatible communications of various kinds.

All data will be retained for no longer than necessary for the purposes of the processing and will be deleted after that time. The data will not be destroyed if it has to be retained pursuant to a legal provision. In such cases, the data will be blocked and will be stored in a way that makes it available only to government bodies, judges and courts during the limitation period of the legal actions that may arise as a result of using the Application and/or the retention periods envisaged by law.
 

Lawful basis of processing
 

Any processing of your personal data has been previously and expressly consented to by you, the user.

In order to know where you are on the map of the park, the Application will need to access the location of your mobile device in the foreground. To enable it to do this, you must grant the application the permission that will be requested of you in advance. You are free to choose the configuration of this permission by selecting the extension that is most appropriate to your needs.

Notwithstanding the foregoing, you can review and manage the permissions granted by you to this application and their extension at any time through the settings on your mobile device in order to decide at any time whether you wish to grant or withdraw such permissions or under what conditions you wish to grant them.
 

Recipients, assignments and transfers of data
 

Your data will only be transferred when this is strictly necessary in order to comply with the above-mentioned purposes or pursuant to a legal obligation.

Furthermore, your data will not be transferred to countries outside the European Union, unless expressly authorised by you, if this is not essential for the same purposes.

How do we obtain users’ data, and where does this data come from?
 

In order to provide location services, BSM may collect, use and share accurate location data, including the real-time geographic location of your computer or device. Unless you give your consent, the said location data is collected anonymously in such a way that it cannot be used to personally identify you, and it is used to supply and improve your location services and products.

If you allow the application to access the location of your mobile device, it may only use in the foreground an approximate location, an accurate location or both, depending on how you have configured the accuracy of such location, and it will access the following information on that basis.

• Google location services
• WiFi networks
• Mobile networks
• Your device's IP address

In any event, the basis on which the application is allowed to process the above information is the express permission granted by users before using each of its features.
 

Rights of data subjects
 

You may exercise the following rights at any time by writing to BARCELONA DE SERVEIS MUNICIPALS, S.A. at Carrer de Calàbria, 66 - 08015 Barcelona. The company is registered in Barcelona Commercial Register under number: 6165/03, Volume: 35452, Sheet: 28, Page B 108458, Entry 87. Tax Identification Code (CIF): A08765919. Contact email address: protecciodades@bsmsa.cat. Contact telephone number: 93 887 50 34

You have the following rights in relation to your personal data.
 

Right of access: You have the right to know if the controller is processing data concerning you, to know what data it is processing by obtaining a copy thereof, and to obtain the following information in relation thereto:

The purposes of the processing; the categories of data processed; the recipients of the data; the retention period for the data, or the retention criteria; the existence of automated decisions, including profiling, as well as their consequences for the data subject; your other rights; the right to file a complaint with a supervisory authority; and, if the data has not been obtained directly from you, the origin of such data.
 

Right to rectification: In accordance with the principle of accuracy and truthfulness of personal data, data subjects are entitled to rectify or supplement false or inaccurate data at any time.
 

Right to erasure: You have the right to obtain from the controller, without undue delay, the erasure of personal data concerning you. The controller must erase such personal data without undue delay in any of the following cases:

• If the data collected is no longer necessary for the purposes for which it was processed.
• If you withdraw the consent given or object to the processing of the data and there is no other reason justifying the retention of the data by the controller.
• If the data has been unlawfully processed.
• If the data has to be deleted pursuant to a legal obligation.

If the controller has made the personal data public, it must take reasonable steps to inform the third-party controllers that are processing such data of the data subject’s request to delete it.
 

Right to restriction of processing: You have the right to restrict the controller’s processing of your personal data in any of the following cases:

• If the accuracy of the personal data has been challenged, for an amount of time that enables the controller to check its accuracy.
• If unlawful processing is taking place but the user opposes its erasure and instead requests the restriction of processing.
• If the Controller no longer needs the personal data based on its purpose but you still need it in order to file, pursue or defend claims.
   

Right to data portability: You are entitled to receive personal data concerning you that you have provided to a controller, in a structured, commonly used, machine-readable format, and to send this information to another controller where the processing is based on consent or is necessary for the performance of a contract and is carried out by automated means. This right will in no event affect any data inferred or deduced by the controller from other data. This includes, for example, all data obtained through the controller’s use of algorithms.
 

Right to object: Pursuant to Article 21 of the General Data Protection Regulation, you may object at any time, for reasons relating to your specific situation, to the processing of personal data concerning you based, among others, on the controller’s legitimate interests. Furthermore, if the data is being processed for direct marketing purposes, you may object to the processing of personal data concerning you at any time.
 

Withdrawal of consent: Any user who has previously consented to the processing of their personal data may withdraw such consent just as easily. The withdrawal of consent will not render any previous processing unlawful.

You may also file a claim before the competent Supervisory Authority.

Where personal data has to be subsequently processed for different purposes, the controller will inform you of this fact.
 

Security measures: BSM states that it has taken all necessary technical and organisational measures to ensure the security of the data and to prevent its loss or alteration or its unauthorised access or processing, taking into account the state of the art, the nature of the data stored and the risks to which it is exposed, whether they are from human action or from the physical or natural environment.

protecciodades@bsmsa.cat