Personal data protection

Information on personal data protection

The right to the protection of personal data is a fundamental right of citizens protected by Article 18.4 of the Spanish Constitution.

Adif will process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and the free circulation of that data (GDPR) and Organic Law 3/2018 of December 5, on Data Protection and Guarantee of Digital Rights (LOPDGDD).

Adif will be responsible for processing your personal data. Full identification and contact information is available in the Legal Notice on the corporate website.

Principles applied

Adif applies the following principles to the processing of your personal data:
Legality, equity and transparency
  • Have legal justification and identify the appropriate legal grounds for the processing.
  • Provide clear information about treatment activities and their rationale.
Limitation of purpose
  • Collect data for specific, explicit and legitimate purposes and not subsequently process it in a manner incompatible with those purposes.
Data minimization
  • Ensure that the data processed is adequate, accurate and necessary for the purpose pursued.
Precision and limitation of conservation
  • Ensure the accuracy of the data and, if necessary, keep it up to date.
  • Keep the data only for the time necessary for the purposes for which it was collected.
Security
  • Implement appropriate technical and organizational measures to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.
Active responsibility
  • Act diligently, implementing the necessary technical and organizational measures to protect and guarantee the rights and freedoms of the people whose data we process.

Limitations

Adif does not allow minors under 14 years of age to incorporate their personal data into any of the forms or spaces, of any type, that make up the website for the provision of services. For this reason, Adif is exempt from any liability that may arise from non-compliance with this prohibition.

When any service could be intended for users under 14 years of age, the necessary legal means will be enabled to obtain the corresponding authorizations from parents or legal guardians.

Log of personal data processing activities

Adif, in accordance with Article 30 of the GDPR and Article 31.2 of the LOPDGDD, as data controller, has a record of the personal data processing activities it performs, identifying, among other information, who processes the data, for what purpose and what legal grounds legitimize it.

They can be consulted below:

Informative clauses

Adif, within the framework of the principle of transparency, communication and disclosure of information to data subjects that governs its actions, makes available to them the informative clauses corresponding to each of the personal data processing operations it carries out.

They can be consulted below:

 

Rights of data subjects

The interested person may exercise the following rights:

  • Right of access: this is the right of the interested party to obtain from Adif confirmation of whether or not their personal data is being processed and, if so, the right to access this data.
  • Right to rectification: this is the right of the interested person to request the rectification of any personal data that appears inaccurately. The interested person, also, taking into account the purposes of the processing, will have the right to have any incomplete personal data duly completed.
  • Right to deletion: this is the right of the interested party to have their personal data deleted whenever any of the circumstances provided for in Article 17 of the GDPR occur.
  • Right to limitation of treatment: this is the right of the interested party to have the processing of their personal data limited whenever any of the conditions established in Article 18 of the GDPR are met. In this case, the data may only be processed, with the exception of its conservation, with the consent of the interested person or for the formulation, exercise or defense of claims.
  • Right to object: this is the right of the interested person, in certain circumstances and for reasons related to their particular situation, to oppose the processing of their personal data, in accordance with the provisions of Article 21 of the GDPR.
  • Right to data portability: This is the right of the interested party to receive in a structured, commonly used and machine-readable format that personal data which has been provided to Adif, and to transmit this to another person responsible for the treatment without being prevented by Adif, as long as the conditions established in Article 20 of the GDPR are met.
  • Right not to be subject to automated individual decisions: this right aims to guarantee that the person is not subject to a decision based solely on the processing of their data, including profiling, that produces legal effects on them or significantly affects them in a similar way.
You can exercise your data protection rights by submitting a request in the following ways:
You must provide, if required, a copy of your official national identity document to prove your identity.

If you are not satisfied with the response from Adif regarding the exercise of your rights, you may file a complaint with the Spanish Data Protection Agency (www.agpd.es) or with any other supervisory authority for data protection in the European Union.

If you wish to clarify any aspect related to the processing of your data, you may contact our Data Protection Officer (DPO) at the following email address: dpd.adif@adif.es .

Right to information

Basic information on data protection

Users must provide certain personal data in order to access some of the services offered through the website. In accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and the Council of 27 April 2016 (GDPR), we inform that the personal data provided will be processed by Adif in order to enable access to services offered through this website. The grounds for legitimizing the processing of personal data is the public interest or the exercise of public powers. No data will be disclosed to third parties, except under legal obligation.

Adif shall adopt all the technical and organizational means required to ensure the safety of all personal data provided, avoiding any altering, loss and unauthorized processing of, or access to said data. Adif shall process the data in accordance with the conditions specified in this section and pursuant to that which is set forth in the specific conditions of the service in question.