1. Data Controller.
The personal data you provide will be processed by the entity Alsa GRUPO, S.L.U., Tax ID (CIF) B-82059478, Calle Josefa Valcárcel, 20, 28027, Madrid, contact email address asesoria@alsa.es, Data Protection Officer contact details dpo@alsa.es, as well as by THE COMPANIES acting as Data Controllers, when necessary, depending on the services contracted through this website, App, or any digital and/or in-person channels and media you have used to interact with us.
For any questions regarding the processing of your personal data, you may contact Alsa's Data Protection Officer by sending an email to the contact address dpo@alsa.es
2. Types of personal data processed.
In general, the company processes the personal data that the user provides when booking our services, collecting the buyer's personal data and/or the passenger's personal data; whether in person at our physical points of sale or through online data collection forms, call centers, and/or any sales channels enabled by the company.
However, on many occasions, our customers' personal data is provided by third parties such as travel agencies or other individuals who request or contract, on your behalf, the products and/or services we offer through our various sales channels.
The categories of data processed are generally identifying data such as name, surname, ID/passport number (DNI), date of birth, gender, email address, contact telephone number, payment details, purchase history, login credentials as a registered user, payment or card details or a PayPal account to complete subsequent purchases quickly, connection data, geolocation, and browsing data (if you interact with us from your mobile device). In very specific cases, and depending on the purpose and intended use of your data, data on personal characteristics may be collected, such as when requesting special assistance (PRM) or a special menu in our premium services; sensitive personal data, such as when applying for the discount for persons with intellectual or developmental disabilities; and data relating to large family status, all for the purpose of verifying eligibility.
The personal data requested across our sales channels is necessary to provide you with the contracted service and properly assist you. If the required data is not provided, the company will not be able to fulfill your request, as the requested personal data is mandatory to comply with our legal and/or contractual obligations.
If you interact with us via mobile devices, we will process connection, geolocation, and browsing data in accordance with the terms established in this privacy policy. Likewise, if you use our online chat or social media channels, we will log your communication with us.
3. Purposes of personal data processing.
In general, the collection and processing of personal data serves the following purposes:
A) On the basis of the contractual relationship:
i. Being able to contact the user to send status updates and service communications regarding the contracted transport service.
ii. Properly attending to and managing inquiries, comments, incidents, claims, or suggestions submitted.
iii. Managing basic administrative tasks.
iv. Properly attending to and managing quotation requests submitted to us through this medium.
v. Successfully managing the purchase of tickets, travel passes, and/or other contracted services, including verifying eligibility for any type of discount.
vi. Properly attending to and managing received invoice issuance requests.
vii. Facilitating the use of other available features or services, such as on-board entertainment and access to and use of our buses' Wi-Fi network.
viii. Managing registration, modification, or cancellation of loyalty card(s) offered by the company.
ix. Managing payment via the Website or App, if you choose the feature to save your card details for future purchases.
B) On the basis of a legal obligation:
i. Complying with all legal obligations applicable to us and communicating your personal data to State Security Forces and Bodies and other competent authorities when required.
ii. Properly managing emergencies, disasters, or force majeure events, which may require communicating your personal data to competent bodies or entities.
iii. Contacting the user to provide information, where appropriate, regarding contact tracing in situations of epidemic control and spread. Personal data will be retained for 90 days from the travel date, remaining during that period at the disposal of health authorities upon request.
C) On the basis of the data subject's consent:
i. Comprehensive management of the registration process, administration, and management of your user account (including when you choose to interact with us by registering with your social media profile, such as Facebook or Twitter).
ii. Keeping you informed, either by electronic means or mobile devices (push notifications), or by any other means provided and made available, of personalized offers and discounts from Alsa or our partners that may be of interest to you.
iii. Properly managing your participation in contests, giveaways, and promotions offered by Alsa.
Please note that the consent granted for each described processing activity may be revoked at any time without affecting the lawfulness of the processing carried out prior to its withdrawal. You may revoke your consent by sending an email to asesoria@alsa.es and/or by clicking the "unsubscribe" link included in the commercial communication itself.
D) On the basis of Alsa's legitimate interest:
i. Properly attending to and managing inquiries, comments, incidents, claims, or suggestions submitted.
ii. Providing value-added services, improvements to our services, and enhancing the customer experience when using the Website or App.
iii. Statistical analysis of visits to the Website and user behavior on it. This data processing is carried out in an aggregated format (that is, in a manner that does not identify you) or, where appropriate, pseudonymized.
iv. Properly managing browsing throughout this website.
v. Conducting analytical work and market research regarding the contracted services.
This data processing is carried out in an aggregated format (that is, in a manner that does not identify you) or, where appropriate, pseudonymized.
vi. If you have granted us your consent for Alsa to process your data for marketing, promotional, and/or advertising purposes, we will retain your purchase history and use details of services you previously purchased to suggest other services we believe may also interest you.
vi. To ensure order and security on board our buses, your image may be captured by the onboard video surveillance systems in our buses.
vii. Monitoring, analyzing, and managing risks, fraud, or incidents in order to prevent potential fraud. If we consider that a transaction may be fraudulent, this processing may result in the blocking of the transaction.
viii. Conducting quality surveys and initiatives aimed at understanding the satisfaction level of our customers and users and identifying areas for improvement.
We consider that we have a legitimate interest since processing this data also benefits you by enabling us to assist you properly, provide a superior service tailored to your needs, expectations, and customer satisfaction levels, as well as guaranteeing security across operations.
Regarding the processing of your data for marketing, promotional, and/or advertising purposes, the data subject will be provided, alongside the corresponding data collection form, with a convenient, straightforward, and free procedure to freely grant consent. The consent granted may be revoked at any time without affecting the lawfulness of the processing carried out prior to withdrawal. You may revoke consent by emailing asesoria@alsa.es and/or clicking the "unsubscribe" link included in the commercial communication itself.
Data processing for marketing, promotional, and/or advertising purposes entails analyzing your customer profile to determine your preferences and, consequently, which Alsa products and services best match your profile. To this end, we will use information you provide based on your purchase and browsing history. We consider that we have a legitimate interest in conducting customer profile analyses using the information we hold about you (purchase history, browsing, preferences, etc.) and the personal data provided during the purchase or website registration process. We understand that processing this data also benefits the user or customer by improving your user experience and enabling you to receive information about Alsa products and services that best match your preferences.
Regarding advertising mailings, we expressly inform you that we do not make automated decisions that produce legal or significant effects concerning you.
We have performed a balancing of interests test, concluding that the company has a legitimate interest in tailoring Alsa's strategy and commercial offer based on information obtained from transactions across various sales channels, as well as obtaining insight into the market in which Alsa operates and its development, all to organize resources in the most efficient way possible in the service sales process.
Images captured by our video surveillance systems are processed on the basis of our legitimate interest in safeguarding the security of facilities and persons. We have performed a balancing test and determined that we have a legitimate interest in using CCTV cameras to ensure transport services and business operations are conducted under safe conditions for both customers and employees.
4. Legal Basis.
The legal bases legitimizing the indicated processing activities are the performance of the transport contract previously entered into, user consent, compliance with a legal obligation, and Alsa's legitimate interest in accordance with section 5.3. The balancing of interests assessment is likewise set out in section 5.3.
5. Recipients of personal data.
Recipients of the provided information will be ALSA GRUPO, S.L.U. and THE COMPANIES.
Users' personal data will be communicated to the company providing the transport service booked by the user. Likewise, your personal data may be communicated to Alsa partner transport companies when the booked service is operated by a partner third party. This disclosure is essential to deliver the contracted transport service based on our legal and contractual obligations.
Furthermore, users' personal data may be communicated to the insurance entity with which the transport company has contracted the Compulsory Passenger Insurance ("SOV"). This communication of personal data is a mandatory requirement for the performance of the contract to which the user is a party, as well as for compliance with legal obligations applicable to the transport company.
In the event that the user contracts optional travel insurance, the company will disclose the personal data necessary to process the aforementioned supplementary travel insurance. This data transfer is necessary for the performance of the contract to which you are a party.
Recipients of the provided information commit, when using the supplied data, to respecting its confidentiality and using it strictly in accordance with previously authorized purposes.
We do not sell or transfer your data to third parties for commercial purposes; Alsa will only send you commercial information offering discounts and advantages from Alsa as well as from companies with which Alsa maintains business partnerships, provided you have accepted the receipt of commercial communications.
No international data transfers are carried out. We work with external suppliers such as technology service providers or marketing and advertising partners, who are consistently required to operate with servers located within the European Economic Area, guaranteeing an adequate level of data protection. Where we engage external providers that do not offer an equivalent level of protection due to being located outside the European Economic Area, they are required to provide appropriate safeguards by executing, in accordance with applicable data protection regulations, Binding Corporate Rules (BCRs) to guarantee the proper management of your personal data, as well as standard contractual clauses adopted by the European Commission.
6. Data subjects' rights.
Data subjects may exercise their rights of access, rectification, erasure, and portability of their data, restriction of and objection to processing, as well as the right not to be subject to decisions based solely on automated processing, where applicable, by addressing ALSA GRUPO, S.L.U. via request sent to our designated email address: asesoria@alsa.es, or to the postal address: ALSA GRUPO, S.L.U., Legal Department, Calle Josefa Valcárcel, 20, 28027, Madrid, enclosing in all cases a copy of their National ID card (DNI) or legally valid equivalent identity document proving their identity, and specifying the right they wish to exercise. Likewise, any data subject has the right to obtain confirmation as to whether their data is being processed by the company.
Any data subject may subsequently, under the terms established in the data protection regulations in force at any given time, revoke their consent without affecting the lawfulness of the processing carried out prior to withdrawal.
Data subjects have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es) as well as with Alsa's Data Protection Officer (dpo@alsa.es).
Users shall be responsible, in all cases, for the accuracy of the data provided, and ALSA GRUPO, S.L.U. reserves the right to exclude from services any user who has provided false information, without prejudice to any other legal actions that may apply. Users are responsible for communicating any modifications to the personal data provided.
7. Data retention period.
We only store users' personal data to the extent necessary to use it according to the purpose for which it was collected, and according to the legal basis of its processing. We will retain personal data as long as a contractual and/or commercial relationship with the user exists and as long as the user does not exercise their right to erasure, cancellation, and/or restriction of personal data processing.
In such cases, we will keep the data blocked, without making any use of it, as long as it may be necessary for the exercise or defense of legal claims, or where any judicial, legal, or contractual liability might arise from its processing requiring its retrieval.
ALSA GRUPO, S.L.U. will comply with current regulations regarding the duty to delete personal information that is no longer necessary for the purpose(s) for which it was collected, by blocking it, in order to address possible liabilities arising from data processing, and solely during the statutory limitation periods for such liabilities. Once these periods expire, the information will be securely and permanently deleted.
8. Information we collect from website visits.
We collect and store limited personal information and anonymous aggregate statistics from all users visiting our website, whether actively provided by the user or gathered while simply browsing our web page. The information we collect includes the Internet Protocol (IP) address of the user's device, the browser used, the operating system, the date and time of access, the web address from which the user accessed our site, and information on how you interact with our website.
We use this information to determine page load times, how the site is used, visitor counts, and the types of content most frequently consulted. This information helps us verify whether the website operates correctly and, if bugs or errors are identified, resolve them and improve performance to deliver a better user experience.
In view of the above, we collect usage and navigation data for statistical, advertising, website traffic monitoring purposes, and to gain insight into User interests.
Likewise, our Apps may feature a geolocation tool whose primary purpose is to identify your location if you have granted permission. Enabling the geolocation function on your mobile device allows you to benefit from all application features. If geolocation is not enabled, we will inform you and request prior permission via a prompt.
9. Processing of data collected when purchasing multi-trip passes.
In compliance with current regulations on the protection of personal data, we inform you that the personal data provided will be processed by ALSA GRUPO, S.L.U., CIF B-82059478, with registered address at Calle Josefa Valcárcel, 20, 28027, Madrid, as well as by the corresponding transport company, depending on the contracted services, for the purpose of managing the sale and use of multi-trip passes by regular road passenger transport concessionaires under the jurisdiction of the General State Administration. The legal basis legitimizing this processing is the execution of the transport contract, as well as compliance with a legal obligation that requires collecting the DNI, NIE, or passport number, alongside a mobile phone number and/or email address for the issuance of the pass. Personal data will be retained for the duration of the contractual relationship with the customer and kept available to competent authorities during the period in which any liability may be demanded from the company. No data will be transferred to third parties, except under legal obligation. No international data transfers will be carried out. The company guarantees the exercise of your rights of access, rectification, erasure, restriction, objection, and data portability in accordance with statutory procedures, by sending a request to our email address asesoria@alsa.es or by post to: ALSA GRUPO, S.L.U., Calle Josefa Valcárcel, 20, 28027, Madrid. If you consider that your data has been handled improperly, you may contact Alsa's Data Protection Officer (dpo@alsa.es) or file a complaint with the Spanish Data Protection Agency, Calle Jorge Juan, 6, 28001, Madrid.
10. Processing of data collected on Social Media.
If you register as a user through social profiles, the company will process certain information associated with your person. If you disagree with the processing of the data types collected, you should not proceed with registration via your social profile; you may instead register through the traditional method by completing the standard web form provided.
The social profile data you choose to share with Alsa will also be processed to enrich our databases and build/refine commercial profiles to gain a deeper, more detailed understanding of users individually and as a group (needs, tastes, preferences, etc.) in order to design, plan, and personalize our products, services, and marketing initiatives. Notwithstanding the foregoing, we inform you that no automated decisions are taken based on this commercial profile.
If you give your express consent during registration, your data will be used to send you personalized commercial communications, as detailed in this Privacy Policy.
The categories of data that Alsa will obtain and process upon registering via a social profile include:
- "Public profile" data (mandatory category): information you provided to the social network used for website registration when completing your social profile, specifically that section. This includes: first and last name, gender, user identifier on the network (ID/account number), profile picture, cover photo, networks, age range, language, and country.
- Other social profile data you decided to share with Alsa, such as other contact details, images, personal characteristics, social circumstances, academic and professional background, employment details, etc.
- Data generated by social media activity you chose to share with Alsa (such as likes and comments).
- Email address (mandatory)
Personal data marked as mandatory must necessarily be provided to complete registration via your social profile. If you do not agree, you should not continue registration through your social profile and may register via our website using the traditional sign-up form.
We also inform you that we use Facebook and Instagram marketing tools when promoting our products and services. We use email addresses of customers who have opted in to receive commercial communications to identify lookalike audiences on Facebook and Instagram and target campaigns to these new users. We also use targeting criteria offered by Facebook and Instagram to create marketing campaign audiences based on user data from those networks. Facebook and Instagram provide options to control the ads you see on their platforms. You can configure your ad preferences on Facebook and Instagram. Data collected and processed by Facebook and Instagram is governed by their respective privacy policies, which you should consult.
11. Minors.
Processing data of children under 14 years of age requires the consent of parents or legal guardians. Children under 14 must not submit personal information without parental or guardian consent. ALSA GRUPO, S.L.U. is not liable for any personal data submitted by children under 14 without proper authorization.
12. Security measures.
ALSA GRUPO, S.L.U. has implemented personal data security levels required by current regulations according to the nature of the information processed, adopting additional technical measures within its reach to prevent alteration, loss, unauthorized processing, or access to the provided data. ALSA GRUPO, S.L.U. guarantees the implementation of suitable measures to ensure data security and confidentiality for information transmitted to us online. To this end, Secure Socket Layer (SSL) security technology is used to encrypt information sent to us, preventing unauthorized reading even if intercepted. Alsa's server is certified so your browser can verify Alsa's identity prior to transmission. This certificate confirms the identity of the target computer receiving your data. You can verify that SSL security is active by looking for the padlock icon in the bottom border or address bar of most browsers. Clicking on this icon will display the security certificate. However, users should be aware that internet security measures are not invulnerable.
13. Cookies.
Accessing this website may involve the use of Cookies. Cookies are small pieces of information stored in each user's browser, enabling the server to remember certain information for later use. This information identifies you as a specific user, saving your personal preferences as well as technical data such as visits or specific pages viewed.
Users who do not wish to receive Cookies or prefer to be alerted before they are stored on their computers may configure their browser settings accordingly. For more information, please consult our Cookies Policy .
