Basic information on data protection
The interested parties are provided with basic information on the processing of personal data by the Consellería de Política Territorial, Obras Públicas y Movilidad and Ferrocarrils de la Generalitat Valenciana entity, for the exercise of their authority; all in compliance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter GDPR).
The personal data collected by the Ministry of Territorial Policy, Public Works and Mobility and the Ferrocarrils de la Generalitat Valenciana Entity will be processed in accordance with the provisions of the GDPR and the Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights.
Scope of application
This information applies to fully or partially automated processing, as well as to non-automated processing of personal data contained on file or intended to be put on file.
Person or entity responsible for the processing
In accordance with the provisions of Article 4.7 of the GDPR, “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data” shall be considered the Data Controller; in this case, FERROCARRILS DE LA GENERALITAT VALENCIANA (hereinafter, FGV). In accordance with Decree 130/2012 of 24 August of the Ministry, which establishes the organisation of the information security of the Generalitat, this responsibility will be exercised in general by the management body that has attributed powers over the common services of FGV, notwithstanding that in cases of specific matters it will be exercised from the competent administrative body or unit. This circumstance shall be recorded in the FGV Processing Activities Register.
Recording of Processing Activities
In accordance with the provisions of Article 30 of the GDPR, the updated list of the processing activities that FGV carries out is available in the Register of Processing Activities (Registro de Actividades), hereinafter RAT, published on the website of www.fgv.es/Portal de transparencia
Collection of personal data
The personal data collected directly or indirectly from the interested party will be processed confidentially and will be incorporated into one of the processing activities owned by FGV that appear in its RAT.
When the personal data referring to the data subject is obtained from the data subject themselves, at the time of collection, the data subject shall be provided with the processing information, in a clear and intelligible form. If appropriate, the essential information about the processing will be provided on the collection form and a second layer of more detailed information will be indicated or linked from the collection form.
Uses and purposes
The processing of personal data will be in accordance with FGV’s own functions and its use will be limited to those purposes for which it has been expressly collected.
If the personal data is intended to be further processed for a purpose other than that for which it was collected, the data subject will be informed prior to the further processing about this other purpose and will be provided with any additional relevant information, provided that the data subject does not already have this information.
The purpose of the processing of personal data will be that necessary for the administrative management and processing of the administrative procedures for which your data are requested, which will correspond to each of the processing activities carried out by FGV and which are accessible in the RAT.
No automated decisions will be made based on the processing of your personal data.
Processing legitimacy
In general, the legal basis for the processing of personal data by FGV is the fulfilment of legal obligations or the performance of actions in the public interest or in the exercise of public powers vested in the Generalitat Valenciana, in accordance with the rules governing the actions of public administrations and, in particular, Law 39/2015 of 1 October on the Common Administrative Procedure of Public Administrations and Law 40/2015 of 1 October on the Legal Regime of the Public Sector, the Statute of Autonomy and the Law of Government.
However, some processing may require the consent of the persons affected by the processing. In the cases in which the legal basis for the processing is the consent of the person concerned, FGV will put in place mechanisms that allow the consent to be granted by a clear affirmative action from this person and in such a way that evidence of it can be preserved.
In any processing based on the consent of the data subject and at any time, there is the possibility of withdrawing such consent; for this purpose, the data subject has the established procedure at their disposal and can access it from this link to the rights procedure of the Spanish Data Protection Agency (Agencia Española de Protección de Datos).
The legal basis that enables each of the processing activities carried out by FGV can be consulted in the RAT.
According to the provision established in Article 14, paragraph 5.c) of the GDPR, the data from the processing that are the responsibility of the administration of the Consell or its instrumental public sector may be processed by bodies that have a supervisory, inspection or control function related to the exercise of public authority, provided that this access to data is expressly provided for in the regulations that regulate them (General Intervention, Inspection of Services, Delegation of Data Protection).
Data Retention
In general and without prejudice to the specific information published in the RAT, the personal data processed by FGV will be kept for the time necessary to fulfil the purpose for which they are collected.
Once the data has been removed or deleted from the processing, FGV may keep it in order to make it feasible to determine the possible liabilities that may arise from its processing or to allow its subsequent use, after the adoption of the appropriate protection measures, for historical, statistical or scientific purposes.
Data communication
The data controller will not communicate or publish personal data without the consent of the persons concerned, except in those circumstances provided for by the legislation in force. The intended recipients of data transfers for each of the processing activities can be consulted in the RAT.
In addition to the above, it may be necessary to communicate data or allow access to them. This includes, in certain circumstances, the Ombudsman, the Síndic de Greuges, Judges and Courts, the Court of Auditors, Sindicatura de Comptes, the State Security Forces and Corps, in short, recipients to whom it is compulsory to communicate data at the request of investigation, infringement, supervision or control procedures. The Data Protection Officer of the Generalitat FGV will not use the data for commercial, advertising or any other purposes unrelated to its public authority, under any circumstances.
The rights of interested parties
The data subject may at any time exercise the rights guaranteed to data subjects by the GDPR under Articles 15 to 23, which are as follows:
RIGHT OF ACCESS: The interested party has the right to obtain confirmation from FGV of whether personal data concerning them are being processed, and if so, has the right to access this data and information regarding the purposes, recipients, categories of data processed, their origin and conservation period, claims, existence of automated decisions and their consequences, and all additional rights of rectification, deletion, limitation, opposition and portability.
RIGHT TO RECTIFICATION AND ERASURE: The interested party has the right to obtain the rectification of inaccurate or incomplete personal data concerning them from FGV, without undue delay. Likewise, the interested party has the right to request the deletion of personal data concerning them. If there is no other legal basis for its conservation, FGV will proceed to the deletion of the data when they are no longer necessary or have been processed unlawfully, when the data subject withdraws their consent in processing that requires it, or when they oppose to the processing.
RIGHT OF LIMITATION: The data subject has the right to obtain the limitation of data processing from FGV, in cases of contestation of the accuracy of the data, when the processing is unlawful and the data subject opposes the deletion of the personal data and requests instead the limitation of its use, when the data subject needs to keep the data in order to formulate or exercise claims or while verifying whether the legitimate reasons of the administration prevail over those of the data subject in case the data subject opposes the processing.
RIGHT OF OPPOSITION: The data subject has the right to object to the processing of personal data concerning them. FGV will cease to process these personal data, unless it can demonstrate compelling legitimate grounds for the processing that override the interests, rights and freedoms of the data subject, or for the formulation, exercise or defence of claims.
RIGHT OF PORTABILITY: The data subject has the right to receive their personal data in a structured, commonly used, machine-readable and interoperable format and to transmit it to another data controller, provided that the processing is legitimised on the basis of consent or within the framework of the performance of a contract and the processing is carried out by mechanised means. They also have the right, where technically feasible, to have the data transmitted directly from data controller to data controller. It shall not apply where the processing is necessary for the performance of a task carried out in the public interest in the exercise of public authority vested in the controller.
RIGHT NOT TO BE SUBJECT TO AUTOMATED INDIVIDUAL DECISIONS: Every data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Refers to any form of processing of their personal data that evaluates personal aspects. The person in charge must guarantee the right to obtain human intervention, express their point of view and challenge the decision. A decision shall not apply if it is necessary for the conclusion or performance of a contract, is based on explicit consent or is authorised by a rule that applies to the data subject and that provides for appropriate measures to safeguard the rights and freedoms, and legitimate interests of the data subject.
All of the above rights, including the withdrawal of consent, are of a highly personal nature and can therefore only be exercised by the person concerned. However, they may act through a representative in the cases and under the conditions provided for by the legislation in force.
The exercise of all these rights may be carried out by accessing the established procedure for this purpose from this link to the ARCO rights procedure. Consult the general procedure for handling requests for the exercise of personal data protection rights of FGV.
Contacting the data protection officer
Interested parties may contact the data protection officer of the Generalitat Valenciana regarding all matters relating to the processing of their personal data and the exercise of their rights under the GDPR.
Contact information:
Data protection officer of the Generalitat
Conselleria de Transparència, Responsabilitat Social, Participació i Cooperació.
Pg. de l’Albereda, 16. 46010 València
Email address: dpd@gva.es
Complaint to the Spanish Data Protection Agency
The persons concerned also have the possibility to file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD), especially when they have not obtained a satisfactory response in the exercise of their rights.
