Privacy Policy - Mobility Observatory in Catalonia (OMC)

Privacy policy and Terms of use


The ATM, as the Data Controller, guarantees an adequate and consistent level of protection for individuals regarding their personal data, subject to possible processing, in accordance with the General Data Protection Regulation (2016/679) and Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights.

The ATM only processes personal data with full responsibility and fairness, and in accordance with the legal bases that permit the lawfulness of the processing, as per the General Data Protection Regulation.

To comply with the General Data Protection Regulation, the ATM has developed a Record of Processing Activities and has adopted appropriate and suitable security measures based on objectively assessed and identified risks to the rights and freedoms of the data subjects, arising from the processing carried out by the ATM.

The ATM applies the principle of transparency in the processing of personal data, providing data subjects with concise, easily accessible, comprehensive information in clear and simple language, while facilitating the exercise of rights through:

Furthermore, the ATM has appointed a Data Protection Officer, in accordance with Article 37.1.a. of the General Data Protection Regulation (2016/679). The contact address for the Data Protection Officer is

Below, additional and expanded information regarding the specific processing activity "CONTACT FORMS" carried out by the ATM is provided:

1. Data Controller
Identity: Autoritat del Transport Metropolità
CIF: P-5890049-I
Postal Adress: carrer Balmes, 49 6ª planta, 08007 Barcelona
Phone number: +34 93 362 00 20

2. Data Protection Officer

3. Retention period
The personal data of the data subjects will be retained for the necessary time to fulfill the purposes for which they were obtained, in the exercise of the ATM's powers and functions, and to determine possible responsibilities arising from these purposes.

4. Legal basis for processing
The legal bases that legitimize the processing of personal data by the ATM are as follows:

  • General Data Protection Regulation 2016/679.
  • Article 6.1.a. The data subject has given consent to the processing of their personal data for one or more specific purposes;
  • Article 6.1.c. The processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Article 6.1.e. The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

5. Purposes and processing of personal data
The purposes of processing personal data relate to the attention of individuals who contact the ATM with complaints, suggestions, and/or exercise of rights requests. The processing of personal data relates to the registration, attention, and management of complaints, suggestions, and/or data protection rights requests recognized to the data subjects.

6. What are your rights?
Data subjects whose data are processed by the ATM have the right to exercise their right of access to their data, rectification of incorrect or inaccurate data, erasure when, among other reasons, the data are no longer necessary for the purposes for which they were collected, and data portability. In certain circumstances, data subjects may request the restriction of the processing of their data, in which case they will only be retained for the exercise or defense of claims.

Also, for reasons related to their particular situation, data subjects may object to the processing of their data. The ATM will stop processing the data, except for compelling legitimate reasons or for the exercise or defense of possible claims.

To exercise these rights, you may contact the ATM by submitting the corresponding form to AUTORITAT DEL TRANSPORT METROPOLITÀ, Carrer Balmes, 49 6ª planta, 08007 Barcelona, or via email at

Additionally, if you are not satisfied with the response to the exercise of your rights, and in any case, whenever you consider it appropriate, you may file a complaint with the Catalan Data Protection Authority through its electronic headquarters at

7. Data recipients
Personal data will not be disclosed or transferred to third parties unless there is a legal obligation or to those providers linked to the Controller who act as processors. In no case will any international transfer of personal data be made.

8. Source of personal data
The personal data processed by the ATM come directly from the data subjects or their representatives.

9. Categories of data processed.

Identification data.

10. Record of processing activities
In compliance with Article 30 of Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and Article 31 of Organic Law 3/2018, of December 5, on the protection of personal data and guarantee of digital rights, the Autoritat del Transport Metropolità has developed the mandatory Record of Processing Activities, related to the processing of personal data carried out by this organization and, through the following link, makes it publicly available electronically for consultation.