I. Object
The purpose of this Privacy Policy is to define the conditions
regarding the processing and protection of personal data of
users and customers that may be collected through browsing or
contracting services from the website https://www.trendelafresa.es
The Fundación de los Ferrocarriles Españoles, FSP, as the owner
of the website, guarantees compliance with current regulations
on the protection of personal data reflected in Organic Law
3/2018, of December 5, on Protection of Personal Data and
Guarantee of Digital Rights (LOPD GDD) and in Regulation (EU)
2016/679 of the European Parliament and of the Council of April
27, 2016, regarding the protection of natural persons (RGPD).
By virtue of these provisions, we inform you that the data that
you voluntarily provide us using any of the web forms available
on the website will be incorporated into the appropriate
computer files for each purpose and subject to processing in
accordance with the considerations that are detailed below.
The use of the website implies acceptance of this Privacy Policy
as well as the conditions included in the Legal Notice.
II. Data Controller
The data controller is the Fundación de los Ferrocarriles
Españoles, FSP (hereinafter, the Foundation), a State Public
sector foundation established on February 20, 1985, CIF
G-78043700, registered on May 14, 1985, with number 146 in the
Registry of the Protectorate of Foundations of the Ministry of
Culture (BOE of 07-09-85) and with registered office at:
C/ Santa Isabel 44
28012 – Madrid
https://www.ffe.es
Data Protection Delegate Contact (DPD):
For any application or request related to our personal data
protection policy, you can contact our Data Protection Delegate
through
dpd@ffe.es
Processing Activity Register:
If you wish, you can consult the Processing Activity Register at
the Data Controller’s website:
https://ffe.es/fundacion/registro_actividades.htm
III. For what purpose do we process your personal data?
We inform users of the existence of personal data processing created from the data obtained from the portal forms, the main purposes that we have identified being the following:
- Addressing your request to purchase tickets for the Strawberry Train
- Channeling requests for information, suggestions and claims that you can send us
- Keeping you informed, as long as you have given us your consent, about events, offers, products and services that may be of interest to you through the Foundation’s different communication channels
Thus, the legality of the processing of personal data will be justified by:
- Regarding the management and hiring of the products and services offered from the web portal, the legal basis is the fact that the treatment is necessary for the execution of a contract in which the interested person is a party or for the application of pre-contractual measures requested by the latter (Art. 6.1.b RGPD)
- With regard to requests for information and/or, where appropriate, the sending of information related to the activities of the Railway Museum, the legal basis will be the consent of the user for one or more specific purposes (art. 6.1.a RGPD)
IV. How do we collect your information?
We collect your personal information through different means, but
you will always be informed at the time of collection through
informative clauses about the person responsible for the
processing, the purpose and legal basis thereof, the recipients
of the data and the period of conservation of your data, as well
as how you can exercise your data protection rights.
In general, the personal information that we process is limited
to identification data (name and surname, address, DNI,
telephone and email), contracted services and payment and
billing data.
Through this website, we collect personal information related to
your browsing through the use of cookies. To clearly and
precisely know the cookies we use, what their purposes are and
how you can configure or disable them, see our Cookies Policy.
V. Responsibility of the user
By providing us with your data through electronic channels, the user guarantees that they are over 14 years of age and that the data provided is true, accurate, complete and up-to-date. For these purposes, the user confirms that they are responsible for the veracity of the data communicated and that they will keep said information suitably updated so that it corresponds to their real situation, being responsible for the false and inaccurate data that they may provide, as well as for the damages, direct or indirect, that may arise.
VI. How long do we keep the information?
We will only keep your information for the period of time
necessary to fulfill the purpose for which it was collected, to
comply with the legal obligations that are imposed on us and to
manage potential responsibilities that may derive from the
fulfillment of the purpose for which the data was collected.
In any case, and as a general rule, we will keep your personal
information as long as there is a contractual relationship that
binds us or you do not exercise your right of deletion and/or
limitation of processing, in which case, the information will be
blocked and not used apart from for its conservation for the period
that may be necessary to bring or respond to claims or when some
form of responsibility may need to be addressed.
VII. To whom do we communicate your data?
In general, the Foundation will not share your personal
information, except that necessary to facilitate access to the
service and those transfers that we must make based on legal
obligations.
Likewise, your personal information will be available to the Public
Administrations, Judges and Courts, to respond for possible
liabilities arising from the processing.
VIII. International data transfers
There are no international transfers of your data to countries outside the European Economic Area (EEA).
IX. What are your rights concerning the processing of your data and how can you exercise them?
The regulations on data protection allow you to exercise your
rights of access, rectification, deletion and portability of data
and opposition and limitation to its processing, as well as not
being the subject of decisions based solely on the automated
treatment of your data, when appropriate.
These rights are characterized by the following:
- Their exercise is free, except in the case of manifestly unfounded or excessive requests (e.g., repetitive in nature), in which case the Foundation may charge a fee proportional to the administrative costs incurred or refuse to act
- You can exercise your rights directly or through your legal or voluntary representative
- We must respond to your request within one month, although, taking into account the complexity and number of requests, the deadline can be extended for another two months
- We have the obligation to inform you about the means to exercise these rights, which must be accessible, not being able to deny you the exercise of the right for the sole reason of choosing another means. If the request is submitted by electronic means, the information will be provided by these means whenever possible, unless you ask us to do otherwise
- If the Foundation does not process the request, it will inform you, not more than one month later, of the reasons for not taking action and the possibility of claiming before a Control Authority
In order to facilitate their exercise, we provide you with links to the application form for each of the rights:
Form for exercising the right of access
Form for exercising the right to rectification
Form for exercising the right to oppose
Form for exercising the right to suppression (right "to be
forgotten")
Form for exercising the right to limitation of processing
Form for exercising the right to portability
Form for exercising the right not to be subject to automated
individual decisions
To exercise your rights, the Foundation places the following means at your disposal:
- By written and signed request addressed to the postal address of the Railway Museum or the Foundation, with the reference "Exercise of Rights LOPD".
- Sending a scanned and signed form to the email address of the Data Protection Officer (dpd@ffe.es) indicating the subject Exercise of LOPD Rights.
In both cases, you must prove your identity by attaching a
photocopy or, where appropriate, a scanned copy, of your DNI
[National ID Document] or equivalent document in order to verify
that we only respond to the interested party or their legal
representative, and in this case, you must provide a document
accrediting the proxy.
Likewise, and especially if you consider that you have not obtained
full satisfaction in the exercise of your rights, we inform you that
you can file a claim with the national control authority by
contacting the Spanish Data Protection Agency, C/ Jorge Juan, for
these purposes. 6 – 28001 Madrid.
X. How do we protect your information?
We use measures, controls and procedures of a physical,
organizational and technological nature, reasonably reliable and
effective, aimed at preserving the integrity and security of your
data and guaranteeing your privacy.
In addition, all personnel with access to personal data are aware of
their obligations in relation to the processing of your personal
data.
All these security measures are reviewed periodically to ensure
their suitability and effectiveness.
However, absolute security cannot be guaranteed and there is no
security system that is impenetrable, therefore, in the event that
any information subject to processing and under our control is
compromised as a result of a security breach, we will take the
adequate measures to investigate the incident, notify the Control
Authority and, where appropriate, those users who may have been
affected so that they may take the appropriate measures.
XI. Acceptance and changes to this privacy policy
It is necessary that the user read and be in agreement with the
conditions on the protection of personal data contained in this
Privacy Policy, accepting the processing of their personal data so
that the Data Processor can continue with processing in the manner,
during the periods and for the indicated purposes. The use of the
website will imply the acceptance of its Privacy Policy.
The Foundation reserves the right to modify its Privacy Policy,
according to its own criteria, or motivated by a legislative,
jurisprudential or doctrinal change of the Spanish Data Protection
Agency. Changes or updates to this Privacy Policy will be explicitly
notified to the user.