1.- Introduction.

Through this Legal notice, ALSA GRUPO, S.L.U., domiciled in Madrid at Calle Josefa Valcárcel, 20, informs the users of its website (hereinafter the “Website”) and of its mobile application (hereinafter the “App”) regarding the terms of use of the Website and the App as well as of its privacy and personal data protection policy to enable users to freely and voluntarily determine whether or not they want to provide the personal details that may be asked of them in order to benefit from the offers made by the transport and logistics companies within its scope, hereinafter THE COMPANIES, through these channels.

2.- Website owner.

Pursuant to Article 10 of Act 34/2002 of 11 July on Information Society Services and Electronic Commerce, the users of this Website are hereby informed of the following:

Owner of the Website www.alsa.es: ALSA GRUPO, S.L.U.

Registered Office: Calle Josefa Valcárcel, 20, 28027, Madrid.

CIF: B-82059478.

Entered in the Mercantile Register of Madrid in Volume 13281, Folio 119, Page M-215156.

E-mail address: asesoria@alsa.es.

3.- Terms of use.

Any person that accesses the Website or the App thereby takes on the role of user and as such undertakes to observe and strictly comply with the provisions set forth herein, as well as with any other applicable legal provision.

Users undertake not to use this Website or its App for fraudulent purposes and to refrain from behaving in any way that might damage the image, interests and rights of ALSA GRUPO, S.L.U. or THE COMPANIES. In the event of a breach of these terms and conditions by the user of this website, or any reasonable suspicion of the company to this effect, ALSA GRUPO, S.L.U. reserves the right to restrict, suspend or terminate that user's access to the website and to adopt any technical measures required to that end.

4.- Liability.

ALSA GRUPO, S.L.U. does not accept any liability arising from the information published on its website, whenever this information has been manipulated or posted by a third party unrelated to it.

ALSA GRUPO, S.L.U. assumes no liability under any circumstance for content, commercial activities, products and services that might be displayed through links on the website, either directly or indirectly. The presence of links on the website, except where otherwise expressly stated, have been included for merely information purposes and in no way constitute any suggestion, invitation or recommendation as regards the same. These links do not represent any relationship between ALSA GRUPO, S.L.U. and individuals or companies that may access websites unrelated to ALSA GRUPO, S.L.U. through these links. ALSA GRUPO, S.L.U. reserves the right to unilaterally withdraw the links on the website at any given moment in time.

ALSA GRUPO, S.L.U. provides its services and content continuously, using all the technical resources within its reach to do so satisfactorily. ALSA GRUPO, S.L.U. accepts no liability for damages of any kind that may be caused by any lack of availability and/or technical continuity of website functioning. Whatever the case, ALSA GRUPO, S.L.U. shall take all the actions required to restore their services in the event of technical failure.

5. - Data protection.

5.1. Data Controller.

The personal data that you provide us with will be processed by ALSA GRUPO, S.L.U., Tax No. B-82059478, Calle Josefa Valcárcel, 20, 28027, Madrid, with contact email address: asesoria@alsa.es, and Data Protection Officer contact details: dpo@alsa.es, as well as by THE COMPANIES acting as Data Controllers, when necessary, depending on the services contracted via this website, app, or any channels and digital media, and/or person through whom you may have interacted with us.

For any matter relating to the processing of your personal data, please contact the Alsa Data Protection Officer by sending an email to the following address: dpo@alsa.es

5.2. Type of personal data processed.

In general, the company processes the personal data the user provides when hiring our services, collecting the personal data of the buyer and/or the personal data of the passenger, whether in person at our physical points of sale, through the forms for providing data online, via call centres, or any sales channels made available by the company.

However, on many occasions our customers’ personal data is provided to us by third parties, such as travel agencies, or by other natural persons who request or hire, on your behalf, the products and/or services that we offer through our different sales channels.

The categories of data processed are usually identifying data such as name, surname, ID card, date of birth, gender, email address, contact number, purchase history, login session details as a registered user, payment, card or PayPal details for faster purchases, login details, GPS and browsing data (should you interact with us from your mobile device). In very specific cases, and depending on the intended use and purpose of your data, we may collect information on personal characteristics, for example, when you request the special assistance service (PRM); sensitive personal data, for example, when you request the discount for people with intellectual or developmental disabilities; data relating to your status as a large family, all with a view to confirming your eligibility for these discounts.

The personal data required on our different sales channels is necessary to be able to provide you with the hired service or attend to you properly. If you fail to provide us with the required details, the company will be unable to attend to your request, as the personal data in question is required to meet our legal and/or contractual obligations.

If you interact with us using mobile devices, we will process your connection data, geolocation, and browsing data, under the terms set out in this privacy policy. Likewise, if you use our online chat or social media, we will keep a record of your communication with us.

5.3. Purpose of personal data processing.

In general, personal details are collected and processed for the purposes set forth below:

A) Based on the contractual relationship:

i. To be able to contact users to send status updates and notifications on the transport service contracted.

ii. To properly attend to and manage the queries, comments, incidents, complaints and suggestions that are received.

iii. To manage basic administrative tasks.

iv. To properly attend to and manage the requests for quotation we receive through this channel.

v. To effectively manage the purchasing of tickets, travel passes, and/or other contracted services, including checking the status of beneficiary of any kind of discount.

vi. To properly attend to and manage requests received to issue invoices.

vii. To facilitate the use of other available features or services, such as on-board entertainment or access and use of the Wi-Fi network on our buses.

viii. To manage the registration, modification, or deregistration of a loyalty card offered by the company.

ix. To manage payment via the website or application, if you select the option to save your card details for future purchases.

B) Based on a legal requirement:

i. To comply with any legal obligations pertaining to us and to communicate your personal data to the State Armed and Security Forces as well as any other agencies with competence in this area, if we are required to do so.

ii. To correctly handle any situations of emergency, disaster or force majeure it may be necessary to communicate your personal data to institutions or agencies with competence in this area.

iii. Contact the user to inform them, if necessary, with regards to contact traceability in situations of epidemic control and its propagation. The personal data will be kept for 90 days from the date of your trip. During this period it will be available to the health authorities who require it.

C) On the basis of the data subject’s consent:

i. Complete management of the registration process, the administration and management of your user account (including when you decide to interact with us by registering with your profile on social media, for example, on Facebook or Twitter).

ii. To keep users informed, by electronic means, through a mobile device (push notifications), or by any other means provided, of personalised offers and discounts from Alsa or our partners that may be of interest to.

iii. To properly manage your participation in competitions, draws, and promotions offered by Alsa.

The consent given for each process described may be withdrawn at any time without affecting the lawfulness of any processing carried out before consent was withdrawn. You may withdraw consent by emailing the following address: asesoria@alsa.es, and/or by clicking on the “unsubscribe” button in the commercial communication.

D) On the basis of Alsa’s legitimate interests:

i. To properly attend to and manage the queries, comments, incidents, complaints and suggestions that are received.

ii. To provide additional services, improvements to our services and to the customer experience by using the website or app.

iii. To perform statistical analyses of website visits and how its users behave. This data processing is carried out on an aggregate (i.e. in such a way as to ensure that you cannot be identified) or pseudoanonymised basis.

iv. To properly manage browsing of this website.

v. To perform analytics and market research on the services hired.

This data processing is carried out on an aggregate (i.e. in such a way as to ensure that you cannot be identified) or pseudoanonymised basis.

vi. In the event that you have given your consent for Alsa to process your data for marketing, promotional and/or advertising purposes, we will store your purchase history and use details of the services you have purchased previously to suggest other services that we believe may be of interest to you.

vi. In order to guarantee order and safety on board our buses, your photo may be taken by the video surveillance systems installed in our buses.

vii. To control, analyse and manage situations of risk, fraud, or incidents in order to prevent potential fraud. If we consider that a transaction may be fraudulent, this processing could result in the transaction being blocked.

viii. To take actions and conduct quality surveys aimed at knowing our customers’ and users’ level of satisfaction and to detect those areas where we could improve.

We believe that we have a legitimate interest as the processing of this data is also beneficial to you in that it allows us to properly attend to you, to provide you with a better service that suits your needs, expectations and level of customer satisfaction, as well as benefiting and guaranteeing transactional security.

With regard to the processing of your data for marketing, promotional and/or advertising purposes, in addition to the data collection form, data subjects will be provided with a suitable procedure that is simple and free of charge, in order to freely give their consent to said processing. This consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal. You may withdraw consent by emailing the following address: asesoria@alsa.es, and/or by clicking on the “unsubscribe” button in the commercial communication.

The processing of data for marketing, promotional, and/or advertising purposes involves the analysis of your customer profile to determine your preferences and which Alsa products and services most suit your profile. To do so, we will use information that you provide us with based on your purchase and browsing history. We believe we have a legitimate interest to perform a customer profile analysis with the information we have about you (purchase history, browsing data, preferences, etc.) and the personal data that you provided us with during the purchase process or when registering on the website. We understand that the processing of such data is also beneficial for the user or customer as it helps to improve your experience as a user and lets you receive information about Alsa products and services that most suit your preferences.

With regard to sending you advertising, no automated decisions affecting you will be taken.

We have balanced the interests and concluded that the company has a legitimate interest in adapting Alsa’s commercial strategy and offering using the information obtained from the transactions carried out on the different sales channels, as well as in obtaining information that enables us to better know the market in which Alsa operates and any changes it may experience. The aim of all of this is to organise resources as efficiently as possible in the process of selling our services.

The images captured by our video surveillance systems are processed on the grounds of our legitimate interest in safeguarding the security of people and facilities. We have carefully considered the interests involved and reached the conclusion that we have a legitimate interest in using video surveillance cameras to ensure that our transport and business activities are carried out in secure conditions for customers and employees.

5.4. Lawful basis.

The lawful bases for processing this information are the performance of the previously contracted transport contract, the user’s consent, compliance with a legal requirement and Alsa’s legitimate interest, in the terms set out in point 5.3. The assessment of interests is described in greater detail in 5.3.

5.5. Recipients of personal data.

The recipients of the information provided will be ALSA GRUPO, S.L.U. and THE COMPANIES.

Users’ personal data will be communicated to the company that provides the transport service contracted by said users. Your personal data may also be communicated to the transport companies that Alsa is partnered with when the service contracted is provided by a third-party partner. This communication is essential to be able to provide the transport service contracted in accordance with our legal and contractual obligations.

Users’ personal data may also be communicated to the insurance entity with which the transport company has contracted the travel insurance (“SOV” in Spanish). Said communication of personal data is a mandatory requirement for executing the contract of which the user is part, as well as for complying with the legal obligations that apply to the transport company.

Should the user take out additional travel insurance, the company will communicate the personal data necessary to process said additional travel insurance. Said communication of personal data is necessary for executing the contract of which you are part.

The recipients of the information provided agree to respect the privacy of the data subjects and use the data only for the authorised purposes.

We will not transfer your data to third parties for commercial purposes. Alsa will send you commercial information offering you discounts and benefits from Alsa and the companies with which Alsa operates commercial agreements only if you have agreed to receive commercial communications.

Your data will not be transferred internationally. We work with external suppliers such as technological services providers and marketing and publicity services providers, who are always required to work with servers located in the European Economic Area that guarantee an adequate level of protection for the data processed. In the event that we work with external suppliers who do not offer the same level of protection as they are located outside the European Economic Area, they will be required to supply appropriate guarantees by signing the relevant Binding Corporate Rules (BCR) in accordance with the current data protection legislation to guarantee appropriate management of your personal data, as well as the Standard Contractual Clauses adopted by the European Commission.

5.6. Rights of data subjects.

Data subjects may exercise their rights to access, rectification, erasure, portability, restriction and objection to processing, as well as the right not to be subject to a decision based solely on automated processing of their data, when applicable, by contacting ALSA GRUPO, S.L.U. with their request at the following email address: asesoria@alsa.es, or by writing to the following address: ALSA GRUPO, S.L.U., Dpto. Asesoría Jurídica, Calle Josefa Valcárcel, 20, 28027, Madrid, Spain. Any such requests must be accompanied by a photocopy of a valid National ID card or equivalent document accrediting the data subject’s identity and must specify the right being exercised. Furthermore, all data subjects have the right to obtain information on how their data is processed in the company.

Data subjects may, at any time and under the terms set out in the applicable data protection regulations, withdraw their consent, without affecting the lawfulness of processing based on consent before its withdrawal.

The data subject has the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) as well as with the Alsa Data Protection Office (dpo@alsa.es).

Whatever the case, users must answer for the truth of the data provided. ALSA GRUPO S.L.U. reserves the right to ban any user providing false information from using the services, without prejudice to any other legal actions which may be taken. Users are responsible for notifying of any changes to their personal information.

5.7. Data retention period.

We only store users’ personal data to use it for the purpose it was originally collected and in accordance with the legal basis for processing it. We will retain personal data as long as there is a contractual and/or commercial relationship with the user, and as long as the user does not exercise the right to erasure, cancellation, and/or restriction with regard to the processing of such data.

Should this occur, said data will be blocked and not used as long as it may be needed to lodge or defend complaints or when any kind of legal or contractual responsibility may be derived from processing it that must be addressed and for which the data must be retrieved.

ALSA GRUPO, S.L.U. must comply with current legislation as regards its obligation to cancel the personal information that is no longer needed for the purpose or purposes for which it was collected, blocking the same so as to be able to respond to any possible liabilities arising from the processing of data, and solely for the duration of the limitation periods for any such liabilities. After the aforementioned limitation periods have elapsed the information in question shall be erased by secure methods.

5.8. Information we collect about visits to the website.

We collect and store limited personal information and anonymous statistics of all users that visit our website, either because the user actively provides said information or is simply browsing our website. The information we collect includes the Internet Protocol (IP) address of the device being used by the user, the browser and operating system being used, the time and date of access, the web address accessed by the user, as well as information on how our website is being used.

We use this information to know how long our website takes to load, how it is used, the number of visits, and the information that is most consulted by the user. This information helps us know whether the website is working correctly, so that if we detect errors or bugs we can fix them and improve our website's performance to be able to offer a better service for all our users.

In view of the above, we collect usage and browsing data for statistical and advertising purposes, to monitor the use of our website, and to improve our knowledge of our website users’ interests.

Likewise, our Apps may have a geolocation tool, the purpose of which is to know your location, if you have given it permission to do so. Activating this geolocation feature on your mobile phone allows you to benefit from all the features of the applications. If you do not have geolocation activated, we will let you know and will ask for your prior permission with a notification.

5.9. Processing of data collected on social media.

If you register as a user via social media, the company will process certain information associated with your person. If you do not accept the processing of the type of data we will collect, you should not register with your social media profile and instead opt to sign up the traditional way by filling out the form for that purpose.

The data from your social media profile that you choose to share with Alsa will also be processed for the purpose of enriching our database and compiling/refining commercial profiles to gain better and more detailed knowledge from a commercial perspective of individual users and users as a whole (needs, tastes, preferences, etc.), to be able to design, plan and personalise our products and services, as well as our commercial and marketing actions. Notwithstanding the foregoing, automated decisions will not be made based on that commercial profile.

If you expressly agree to it when registering, your data will be used to send you personalized commercial communications, as described in this Privacy Policy.

The data categories that Alsa will obtain and process when you register as a user via social media, are as follows:

  • Your “Public profile” data (this data category is mandatory): information that you have provided to the social network in question when you completed your profile, and specifically that section. It includes: your name and surname, gender, social network user identification (ID-account number), profile picture, cover photo and networks, age range, language and country.
  • Other social media profile data that you have decided to share with Alsa, for example, contact details, images, personal characteristics, social circumstances, academic and professional details, employment details, etc.
  • Data generated from using the social network that you chose to share with Alsa (for example, likes and comments).
  • Email (mandatory).

The personal data marked as required must be provided in order to be able to complete the registration with your social profile. If you do not agree, you should not register with your social media profile and instead opt to sign up to our website the traditional way by filling out the form for that purpose.

We inform you that we also use Facebook and Instagram marketing tools to advertise our products and services. We use the email addresses of customers who have agreed to receive commercial communications to find similar people on the user databases held by Facebook and Instagram and to target these users with advertising campaigns on Facebook and Instagram. We also use the parameters offered by Facebook and Instagram to create audiences for marketing campaigns based on the user databases held by these social networks. Facebook and Instagram offer you the option of controlling the advertisements you see on their platforms. You can configure your advertising preferences on Facebook and Instagram. Data compiled and processed by Facebook and Instagram are governed by their privacy policies, which you should consult prior to using these platforms.

5.10. Minors.

The processing of data belonging to people under 14 years of age requires consent from a parent or guardian. Minors under 14 must not send any personal information without consent from a parent or guardian. ALSA GRUPO, S.L.U. assumes no liability for information sent by under 14 minors without due authorisation.

5.11. Security measures.

ALSA GRUPO, S.L.U. has taken the personal data protection safety measures required by current legislation in accordance with the type of information processed and have implemented other media and additional technical measures within their reach to avoid the unauthorised alteration, loss, processing of or access to the data received. ALSA GRUPO, S.L.U. hereby guarantees that it has adopted the appropriate security measures to ensure the security of the information and the confidentiality of the data that you send us over the Internet. Secure Socket Layer (SSL) technology is used for this purpose, which is a system that allows the information you send us to be encrypted, thus avoiding its reading even if it has been unlawfully intercepted. Alsa server is certified in such a way that its browser can confirm the identity of Alsa before any information is transmitted. This certificate ensures the identity of the target computer to which your personal details are being sent. You can check that SSL security is operating if the padlock icon comes up in the bottom edge of most browsers. If you click on this icon a certificate associated with connection security will come up. Notwithstanding, users should be conscious of the fact that internet security measures are not fail-safe.

5.12. Cookies.

Access to the website can mean using cookies. Cookies are small files which are stored on a user’s browser. They allow the server to retrieve certain information for future use. This information makes it possible to identify you as a particular user and enables the saving of your personal preferences, as well as technical information, such as the number of visits or particular pages you visit.

Those users that do not want to receive cookies or want to be informed before they are stored on your computer can configure their browser accordingly. Consult our "Cookies Policy" for further information.

6.- Security in transactions.

ALSA guarantees that it will process all data corresponding to the payment method used with complete security and privacy. The details of the card used during payment are encrypted and transferred using a secure SSL protocol that ensures the privacy of the communication through an exchange of encryption keys.

In order to guarantee the security of transactions made on this Website, ALSA’s control processes include the prior verification and management of the information provided by the customer regarding the payment card ALSA reserves the authority to reject requests to contract and purchase tickets by customers paying with cards that are not their own, that have been obtained fraudulently, or with which they intend on carrying out a fraudulent transaction to the detriment of the legitimate card holder, ALSA, or any third party.

Any requests by state law enforcement agencies should be sent to the following e-mail address: asesoria@alsa.es

Bear in mind also that the issuers of the payment methods used may also have other anti-fraud measures that could result in the rejection of certain transactions. ALSA does not control nor is it responsible for any damages that could arise due to the application of policies approved by any payment method issuer.

The use of a payment method owned by a third party is not permitted, unless said third party has provided express authorisation. The person using said payment method is responsible for providing proof of such authorisation and for any damages that ALSA may sustain as a result.

7.- Intellectual and Industrial Property Rights.

All contents, elements, designs, and applications housed on this Website, regardless of their format or characteristics, and all Industrial and Intellectual Property Rights inherent to the Website are owned by ALSA GRUPO, S.L.U. and are protected by Industrial and Intellectual Property regulations and by any other legislation that may apply. The aforementioned content cannot be used, reproduced, distributed, modified, publicly communicated, assigned, transformed or subject to any other disseminating procedure that has not been expressly authorised beforehand in writing. ALSA GRUPO, S.L.U. reserves the right to take any legal proceedings open to it against those who infringe upon its aforementioned owner rights.

8.- Modifications.

ALSA GRUPO, S.L.U. reserves the right to amend this Legal Notice and Privacy Policy to adapt to legislative and case law developments or to changes in the corporate strategy or activity of ALSA and its associated companies, and we thus recommend that you read it each time prior to accessing and browsing the Website. Notwithstanding the foregoing, any relationships established with users prior to the amending of this Legal Notice and Privacy Policy shall be governed by the terms in place at the time of accessing the Website to establish the aforementioned relationships.

ALSA GRUPO, S.L.U. provides users with the appropriate technical resources to be able to first access this Legal Notice and Privacy and Data Protection Policy.

9.- Applicable legislation and Jurisdiction.

Any disputes or issues relating to this Website or the activities taking place on this Website will be resolved under Spanish law, to which the parties expressly submit. All conflicts deriving from or relating to the use of the Website will be resolved by the competent courts and tribunals in accordance with applicable legislation.

In the event that any of the terms of this document be declared null, they will be removed or replaced. Should this occur, the validity of the rest of the terms included in this document will not be affected.