1. Data Controller.

The personal data that you provide us with will be processed by ALSA GRUPO, S.L.U., Tax No. B-82059478, Calle Josefa Valcárcel, 20, 28027, Madrid, with contact email address: asesoria@alsa.es, and Data Protection Officer contact details: dpo@alsa.es, as well as by THE COMPANIES acting as Data Controllers, when necessary, depending on the services contracted via this website, app, or any channels and digital media, and/or person through whom you may have interacted with us.

For any matter relating to the processing of your personal data, please contact the Alsa Data Protection Officer by sending an email to the following address: dpo@alsa.es

2. Type of personal data processed.

In general, the company processes the personal data the user provides when hiring our services, collecting the personal data of the buyer and/or the personal data of the passenger, whether in person at our physical points of sale, through the forms for providing data online, via call centres, or any sales channels made available by the company.

However, on many occasions our customers’ personal data is provided to us by third parties, such as travel agencies, or by other natural persons who request or hire, on your behalf, the products and/or services that we offer through our different sales channels.

The categories of data processed are usually identifying data such as name, surname, ID card, date of birth, gender, email address, contact number, purchase history, login session details as a registered user, payment, card or PayPal details for faster purchases, login details, GPS and browsing data (should you interact with us from your mobile device). In very specific cases, and depending on the intended use and purpose of your data, we may collect information on personal characteristics, for example, when you request the special assistance service (PRM) or the special menu from our premium services; sensitive personal data, for example, when you request the discount for people with intellectual or developmental disabilities; data relating to your status as a large family, all with a view to confirming your eligibility for these discounts.

The personal data required on our different sales channels is necessary to be able to provide you with the hired service or attend to you properly. If you fail to provide us with the required details, the company will be unable to attend to your request, as the personal data in question is required to meet our legal and/or contractual obligations.

If you interact with us using mobile devices, we will process your connection data, geolocation, and browsing data, under the terms set out in this privacy policy. Likewise, if you use our online chat or social media, we will keep a record of your communication with us.

3. Purpose of personal data processing.

In general, personal details are collected and processed for the purposes set forth below:

A) Based on the contractual relationship:

i. To be able to contact users to send status updates and notifications on the transport service contracted.

ii. To properly attend to and manage the queries, comments, incidents, complaints and suggestions that are received.

iii. To manage basic administrative tasks.

iv. To properly attend to and manage the requests for quotation we receive through this channel.

v. To effectively manage the purchasing of tickets, travel passes, and/or other contracted services, including checking the status of beneficiary of any kind of discount.

vi. To properly attend to and manage requests received to issue invoices.

vii. To facilitate the use of other available features or services, such as on-board entertainment or access and use of the Wi-Fi network on our buses.

viii. To manage the registration, modification, or deregistration of a loyalty card offered by the company.

ix. To manage payment via the website or application, if you select the option to save your card details for future purchases.

B) Based on a legal requirement:

i. To comply with any legal obligations pertaining to us and to communicate your personal data to the State Armed and Security Forces as well as any other agencies with competence in this area, if we are required to do so.

ii. To correctly handle any situations of emergency, disaster or force majeure it may be necessary to communicate your personal data to institutions or agencies with competence in this area.

iii. Contact the user to inform them, if necessary, with regards to contact traceability in situations of epidemic control and its propagation. The personal data will be kept for 90 days from the date of your trip. During this period it will be available to the health authorities who require it.

C) On the basis of the data subject’s consent:

i. Complete management of the registration process, the administration and management of your user account (including when you decide to interact with us by registering with your profile on social media, for example, on Facebook or Twitter).

ii. To keep users informed, by electronic means, through a mobile device (push notifications), or by any other means provided, of personalised offers and discounts from Alsa or our partners that may be of interest to.

iii. To properly manage your participation in competitions, draws, and promotions offered by Alsa.

The consent given for each process described may be withdrawn at any time without affecting the lawfulness of any processing carried out before consent was withdrawn. You may withdraw consent by emailing the following address: asesoria@alsa.es, and/or by clicking on the “unsubscribe” button in the commercial communication.

D) On the basis of Alsa’s legitimate interests:

i. To properly attend to and manage the queries, comments, incidents, complaints and suggestions that are received.

ii. To provide additional services, improvements to our services and to the customer experience by using the website or app.

iii. To perform statistical analyses of website visits and how its users behave. This data processing is carried out on an aggregate (i.e. in such a way as to ensure that you cannot be identified) or pseudoanonymised basis.

iv. To properly manage browsing of this website.

v. To perform analytics and market research on the services hired.

This data processing is carried out on an aggregate (i.e. in such a way as to ensure that you cannot be identified) or pseudoanonymised basis.

vi. In the event that you have given your consent for Alsa to process your data for marketing, promotional and/or advertising purposes, we will store your purchase history and use details of the services you have purchased previously to suggest other services that we believe may be of interest to you.

vi. In order to guarantee order and safety on board our buses, your photo may be taken by the video surveillance systems installed in our buses.

vii. To control, analyse and manage situations of risk, fraud, or incidents in order to prevent potential fraud. If we consider that a transaction may be fraudulent, this processing could result in the transaction being blocked.

viii. To take actions and conduct quality surveys aimed at knowing our customers’ and users’ level of satisfaction and to detect those areas where we could improve.

We believe that we have a legitimate interest as the processing of this data is also beneficial to you in that it allows us to properly attend to you, to provide you with a better service that suits your needs, expectations and level of customer satisfaction, as well as benefiting and guaranteeing transactional security.

With regard to the processing of your data for marketing, promotional and/or advertising purposes, in addition to the data collection form, data subjects will be provided with a suitable procedure that is simple and free of charge, in order to freely give their consent to said processing. This consent may be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal. You may withdraw consent by emailing the following address: asesoria@alsa.es, and/or by clicking on the “unsubscribe” button in the commercial communication.

The processing of data for marketing, promotional, and/or advertising purposes involves the analysis of your customer profile to determine your preferences and which Alsa products and services most suit your profile. To do so, we will use information that you provide us with based on your purchase and browsing history. We believe we have a legitimate interest to perform a customer profile analysis with the information we have about you (purchase history, browsing data, preferences, etc.) and the personal data that you provided us with during the purchase process or when registering on the website. We understand that the processing of such data is also beneficial for the user or customer as it helps to improve your experience as a user and lets you receive information about Alsa products and services that most suit your preferences.

With regard to sending you advertising, no automated decisions affecting you will be taken.

We have balanced the interests and concluded that the company has a legitimate interest in adapting Alsa’s commercial strategy and offering using the information obtained from the transactions carried out on the different sales channels, as well as in obtaining information that enables us to better know the market in which Alsa operates and any changes it may experience. The aim of all of this is to organise resources as efficiently as possible in the process of selling our services.

The images captured by our video surveillance systems are processed on the grounds of our legitimate interest in safeguarding the security of people and facilities. We have carefully considered the interests involved and reached the conclusion that we have a legitimate interest in using video surveillance cameras to ensure that our transport and business activities are carried out in secure conditions for customers and employees.

4. Lawful basis.

The lawful bases for processing this information are the performance of the previously contracted transport contract, the user’s consent, compliance with a legal requirement and Alsa’s legitimate interest, in the terms set out in point 5.3. The assessment of interests is described in greater detail in 5.3.

5. Recipients of personal data.

The recipients of the information provided will be ALSA GRUPO, S.L.U. and THE COMPANIES.

Users’ personal data will be communicated to the company that provides the transport service contracted by said users. Your personal data may also be communicated to the transport companies that Alsa is partnered with when the service contracted is provided by a third-party partner. This communication is essential to be able to provide the transport service contracted in accordance with our legal and contractual obligations.

Users’ personal data may also be communicated to the insurance entity with which the transport company has contracted the travel insurance (“SOV” in Spanish). Said communication of personal data is a mandatory requirement for executing the contract of which the user is part, as well as for complying with the legal obligations that apply to the transport company.

Should the user take out additional travel insurance, the company will communicate the personal data necessary to process said additional travel insurance. Said communication of personal data is necessary for executing the contract of which you are part.

The recipients of the information provided agree to respect the privacy of the data subjects and use the data only for the authorised purposes.

We will not transfer your data to third parties for commercial purposes. Alsa will send you commercial information offering you discounts and benefits from Alsa and the companies with which Alsa operates commercial agreements only if you have agreed to receive commercial communications.

Your data will not be transferred internationally. We work with external suppliers such as technological services providers and marketing and publicity services providers, who are always required to work with servers located in the European Economic Area that guarantee an adequate level of protection for the data processed. In the event that we work with external suppliers who do not offer the same level of protection as they are located outside the European Economic Area, they will be required to supply appropriate guarantees by signing the relevant Binding Corporate Rules (BCR) in accordance with the current data protection legislation to guarantee appropriate management of your personal data, as well as the Standard Contractual Clauses adopted by the European Commission.

6. Rights of data subjects.

Data subjects may exercise their rights to access, rectification, erasure, portability, restriction and objection to processing, as well as the right not to be subject to a decision based solely on automated processing of their data, when applicable, by contacting ALSA GRUPO, S.L.U. with their request at the following email address: asesoria@alsa.es, or by writing to the following address: ALSA GRUPO, S.L.U., Dpto. Asesoría Jurídica, Calle Josefa Valcárcel, 20, 28027, Madrid, Spain. Any such requests must be accompanied by a photocopy of a valid National ID card or equivalent document accrediting the data subject’s identity and must specify the right being exercised. Furthermore, all data subjects have the right to obtain information on how their data is processed in the company.

Data subjects may, at any time and under the terms set out in the applicable data protection regulations, withdraw their consent, without affecting the lawfulness of processing based on consent before its withdrawal.

The data subject has the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) as well as with the Alsa Data Protection Office (dpo@alsa.es).

Whatever the case, users must answer for the truth of the data provided. ALSA GRUPO S.L.U. reserves the right to ban any user providing false information from using the services, without prejudice to any other legal actions which may be taken. Users are responsible for notifying of any changes to their personal information.

7. Data retention period.

We only store users’ personal data to use it for the purpose it was originally collected and in accordance with the legal basis for processing it. We will retain personal data as long as there is a contractual and/or commercial relationship with the user, and as long as the user does not exercise the right to erasure, cancellation, and/or restriction with regard to the processing of such data.

Should this occur, said data will be blocked and not used as long as it may be needed to lodge or defend complaints or when any kind of legal or contractual responsibility may be derived from processing it that must be addressed and for which the data must be retrieved.

ALSA GRUPO, S.L.U. must comply with current legislation as regards its obligation to cancel the personal information that is no longer needed for the purpose or purposes for which it was collected, blocking the same so as to be able to respond to any possible liabilities arising from the processing of data, and solely for the duration of the limitation periods for any such liabilities. After the aforementioned limitation periods have elapsed the information in question shall be erased by secure methods.

8. Information we collect about visits to the website.

We collect and store limited personal information and anonymous statistics of all users that visit our website, either because the user actively provides said information or is simply browsing our website. The information we collect includes the Internet Protocol (IP) address of the device being used by the user, the browser and operating system being used, the time and date of access, the web address accessed by the user, as well as information on how our website is being used.

We use this information to know how long our website takes to load, how it is used, the number of visits, and the information that is most consulted by the user. This information helps us know whether the website is working correctly, so that if we detect errors or bugs we can fix them and improve our website's performance to be able to offer a better service for all our users.

In view of the above, we collect usage and browsing data for statistical and advertising purposes, to monitor the use of our website, and to improve our knowledge of our website users’ interests.

Likewise, our Apps may have a geolocation tool, the purpose of which is to know your location, if you have given it permission to do so. Activating this geolocation feature on your mobile phone allows you to benefit from all the features of the applications. If you do not have geolocation activated, we will let you know and will ask for your prior permission with a notification.

9. Processing of data collected on social media.

If you register as a user via social media, the company will process certain information associated with your person. If you do not accept the processing of the type of data we will collect, you should not register with your social media profile and instead opt to sign up the traditional way by filling out the form for that purpose.

The data from your social media profile that you choose to share with Alsa will also be processed for the purpose of enriching our database and compiling/refining commercial profiles to gain better and more detailed knowledge from a commercial perspective of individual users and users as a whole (needs, tastes, preferences, etc.), to be able to design, plan and personalise our products and services, as well as our commercial and marketing actions. Notwithstanding the foregoing, automated decisions will not be made based on that commercial profile.

If you expressly agree to it when registering, your data will be used to send you personalized commercial communications, as described in this Privacy Policy.

The data categories that Alsa will obtain and process when you register as a user via social media, are as follows:

  • Your “Public profile” data (this data category is mandatory): information that you have provided to the social network in question when you completed your profile, and specifically that section. It includes: your name and surname, gender, social network user identification (ID-account number), profile picture, cover photo and networks, age range, language and country.
  • Other social media profile data that you have decided to share with Alsa, for example, contact details, images, personal characteristics, social circumstances, academic and professional details, employment details, etc.
  • Data generated from using the social network that you chose to share with Alsa (for example, likes and comments).
  • Email (mandatory).

The personal data marked as required must be provided in order to be able to complete the registration with your social profile. If you do not agree, you should not register with your social media profile and instead opt to sign up to our website the traditional way by filling out the form for that purpose.

We inform you that we also use Facebook and Instagram marketing tools to advertise our products and services. We use the email addresses of customers who have agreed to receive commercial communications to find similar people on the user databases held by Facebook and Instagram and to target these users with advertising campaigns on Facebook and Instagram. We also use the parameters offered by Facebook and Instagram to create audiences for marketing campaigns based on the user databases held by these social networks. Facebook and Instagram offer you the option of controlling the advertisements you see on their platforms. You can configure your advertising preferences on Facebook and Instagram. Data compiled and processed by Facebook and Instagram are governed by their privacy policies, which you should consult prior to using these platforms.

10. Minors.

The processing of data belonging to people under 14 years of age requires consent from a parent or guardian. Minors under 14 must not send any personal information without consent from a parent or guardian. ALSA GRUPO, S.L.U. assumes no liability for information sent by under 14 minors without due authorisation.

11. Security measures.

ALSA GRUPO, S.L.U. has taken the personal data protection safety measures required by current legislation in accordance with the type of information processed and have implemented other media and additional technical measures within their reach to avoid the unauthorised alteration, loss, processing of or access to the data received. ALSA GRUPO, S.L.U. hereby guarantees that it has adopted the appropriate security measures to ensure the security of the information and the confidentiality of the data that you send us over the Internet. Secure Socket Layer (SSL) technology is used for this purpose, which is a system that allows the information you send us to be encrypted, thus avoiding its reading even if it has been unlawfully intercepted. Alsa server is certified in such a way that its browser can confirm the identity of Alsa before any information is transmitted. This certificate ensures the identity of the target computer to which your personal details are being sent. You can check that SSL security is operating if the padlock icon comes up in the bottom edge of most browsers. If you click on this icon a certificate associated with connection security will come up. Notwithstanding, users should be conscious of the fact that internet security measures are not fail-safe.

12. Cookies.

Access to the website can mean using cookies. Cookies are small files which are stored on a user’s browser. They allow the server to retrieve certain information for future use. This information makes it possible to identify you as a particular user and enables the saving of your personal preferences, as well as technical information, such as the number of visits or particular pages you visit.

Those users that do not want to receive cookies or want to be informed before they are stored on your computer can configure their browser accordingly. Consult our "Cookies Policy" for further information.