Data protection

In accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD), we inform you of how we process the data you provide on this portal.

This is a translation provided for your convenience. In the event of any discrepancy, the Spanish version prevails. Versión en español

Data controller

Empresa Municipal de Transportes Urbanos, S.A. (EMTUSA), registered address Avda. de las Veredas, 54, 21007 Huelva, Spain.

Data Protection Officer

You can contact the Data Protection Officer at proteccion.datos@emtusahuelva.es.

Purpose and legal basis

Travel card applications: to process and decide on your card application (Bono 30, child, student…), issue the card and keep you informed of the status of your application. The legal basis is the performance of the contractual or pre-contractual relationship and compliance with legal obligations. The data requested — including the documents you attach, the passport-style photo and the signature — is required to process the application.

How long we keep it

Applications: while they are being processed and, afterwards, for as long as needed to meet any responsibilities arising from the service.

Usage statistics

To understand how the portal is used and improve it, we record each visit with pseudonymised data: the pages viewed and when, where visitors come from, the type of device, operating system and browser, screen size, approximate geographic area (country, region and city) and the steps of the form (for example, that an application was submitted, for which type of card and in which portal language). For a sample of visits we also record where on the page people click and how far they scroll (heatmaps): only coordinates, never what you type or what is shown on screen. We do this with a tool installed on our own servers (Umami): it does not use cookies, does not store your IP address and groups visits under an identifier that changes every day. We use this data only to produce aggregate statistics; it is not shared with third parties or combined with your application or any other data, and we keep it for a maximum of 25 months. The legal basis is EMTUSA’s legitimate interest in understanding how the service is used in order to improve it. If your browser has the “Do Not Track” option enabled, your visit is not recorded.

Who it is shared with

Data is not disclosed to third parties except where required by law, or to public administrations and directly related bodies when necessary for the purpose stated.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to EMTUSA, Avda. de las Veredas, 54, 21007 Huelva, Spain, or by email to the Data Protection Officer. You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

For card applications, if you request erasure of your data or object to its processing, this will be taken as withdrawing your application or your status as cardholder, as the service cannot be managed without that data.