1.- Introduction.

Through this Legal Notice and Privacy Policy, ALSA GRUPO, S.L.U., domiciled in Madrid at Calle Miguel Fleta 4, informs the users of its website (hereinafter the “Website”) and of its mobile application (hereinafter the “App”) regarding the terms of use of the Website and the App as well as of its privacy and personal data protection policy to enable users to freely and voluntarily determine whether or not they want to provide the personal details that may be asked of them in order to benefit from the offers made by the transport and logistics companies within its scope, hereinafter THE COMPANIES, through these channels.

2.- Website owner.

Pursuant to Article 10 of Act 34/2002 of 11 July on Information Society Services and Electronic Commerce, the users of this Website are hereby informed of the following:

Owner of the Website www.alsa.es: ALSA GRUPO, S.L.U.

Registered Office: Calle Miguel Fleta, 4, 28037, Madrid.

CIF: B-82059478.

Entered in the Mercantile Register of Madrid in Volume 13281, Folio 119, Page M-215156.

E-mail address: asesoria@alsa.es.

3.- Terms of use.

Any person that accesses the Website or the App thereby takes on the role of user and as such undertakes to observe and strictly comply with the provisions set forth herein, as well as with any other applicable legal provision.

Users undertake not to use this Website or its App for fraudulent purposes and to refrain from behaving in any way that might damage the image, interests and rights of ALSA GRUPO, S.L.U. or THE COMPANIES. In the event of a breach of these terms and conditions by the user of this website, or any reasonable suspicion of the company to this effect, ALSA GRUPO, S.L.U. reserves the right to restrict, suspend or terminate that user's access to the website and to adopt any technical measures required to that end.

4.- Liability.

ALSA GRUPO, S.L.U. does not accept any liability arising from the information published on its website, whenever this information has been manipulated or posted by a third party unrelated to it.

ALSA GRUPO, S.L.U. assumes no liability under any circumstance for content, commercial activities, products and services that might be displayed through links on the website, either directly or indirectly. The presence of links on the website, except where otherwise expressly stated, have been included for merely information purposes and in no way constitute any suggestion, invitation or recommendation as regards the same. These links do not represent any relationship between ALSA GRUPO, S.L.U. and individuals or companies that may access websites unrelated to ALSA GRUPO, S.L.U. through these links. ALSA GRUPO, S.L.U. reserves the right to unilaterally withdraw the links on the website at any given moment in time.

ALSA GRUPO, S.L.U. provides its services and content continuously, using all the technical resources within its reach to do so satisfactorily. ALSA GRUPO, S.L.U. accepts no liability for damages of any kind that may be caused by any lack of availability and/or technical continuity of website functioning. Whatever the case, ALSA GRUPO, S.L.U. shall take all the actions required to restore their services in the event of technical failure.

5. - Data protection.

5.1. Data Controller.

The personal data collected will be processed by ALSA GRUPO, S.L.U. (Tax No. B-82059478, Calle Miguel Fleta, 4, 28037, Madrid) and by THE COMPANIES when required, depending on the services contracted through the website and the app, who will act as Data Controllers in both cases.

Users can provide personal information voluntarily either through specific forms found on different sections of the website or app, or by means of the e-mail addresses made available for this purpose. By providing your personal information through any of the forms and e-mail addresses on this website, you accept and consent to the processing of said information under the terms indicated in this privacy policy.

5.2. Purpose of personal data processing.

In general, your personal details are collected and processed for the purposes set forth below:

i. To contact users;

ii. To properly attend to and manage the queries, comments, incidents, and suggestions that are received;

iii. To manage basic administrative tasks;

iv. To properly attend to and manage the requests for quotation we receive through this channel;

v. To effectively manage the purchasing of tickets, travel passes, and other contracted services;

vi. To manage the registration, modification, or deregistration of a loyalty card offered by the company;

vii. To keep users informed, by electronic means, through a mobile device (push notifications), or by any other means provided, of personalised offers and discounts from ALSA or third parties that may be of interest to them;

viii. To provide additional services, improvements to our services and to the customer experience by using the website or app;

ix. To perform statistical analyses of website visits and how its users behave;

x. To manage their participation in the training courses offered by the company through this channel;

xi. To take the necessary measures to tailor their participation in recruitment processes announced by the company;

xii. To properly manage their participation in competitions, draws, and promotions offered by ALSA through this channel;

xiii. To properly manage browsing of this website.

With regard to the processing of their data for promotional or advertising purposes, in addition to the data collection form, data subjects will be provided with a suitable procedure that is simple and free of charge, in order to freely give their consent to said processing. This consent may be withdrawn at any time and at no cost for the data subject.

5.3. Lawful basis.

The lawful basis for processing this information is the execution of the previously contracted transport contract, the user’s consent, and ALSA’s legitimate interest.

5.4. Recipients of personal data.

The recipients of the information provided will be ALSA GRUPO, S.L.U. and THE COMPANIES. Users’ personal data will be communicated to the company that provides the transport service contracted by said users. The recipients of the information provided agree to respect the privacy of the data subjects and use the data only for the authorised purposes.

Furthermore, users that send information relating to their CVs are informed that their data may be shared with THE COMPANIES in order to properly manage the corresponding recruitment process. By sending their data, users accept and consent to the processing of their personal data in accordance with the indicated purpose.

Specifically, when payment is made through a mobile carrier via the platform operated by Cashlog, S.L. (“pay by mobile”), users consent to the mobile carrier providing their phone numbers to ALSA GRUPO, S.L.U. in order to process a payment in exchange for a ticket.

5.5. Rights of data subjects.

Data subjects can exercise their rights to access, rectification, erasure, objection, portability, and restriction by contacting ALSA GRUPO, S.L.U., either by sending an e-mail to asesoria@alsa.es or by writing to ALSA GRUPO, S.L.U., Dpto. Asesoría Jurídica, Calle Miguel Fleta, 4, 28037, Madrid, Spain. Any such requests must be accompanied by a photocopy of a valid National ID card or equivalent document accrediting the data subject’s identity and must specify the right being exercised.

Data subjects may, at any time and under the terms set out in the applicable data protection regulations, withdraw the authorisation granted to process their personal information.

The data subject has the right to file a complaint with the Spanish Data Protection Agency (www.agpd.es) and with the ALSA Data Protection Office (dpo@alsa.es).

Whatever the case, users must answer for the truth of the data provided. ALSA GRUPO S.L.U. reserves the right to ban any user providing false information from using the services, without prejudice to any other legal actions which may be taken. Users are responsible for notifying of any changes to their personal information.

5.6. Data retention period.

We only store users’ personal data to use it for the purpose it was originally collected and in accordance with the legal basis for processing it. We will retain personal data as long as there is a contractual and/or commercial relationship with the user, and as long as the user does not exercise the right to erasure, cancellation, and/or restriction with regard to the processing of such data.

Should this occur, said data will be blocked and not used as long as it may be needed to lodge or defend complaints or when any kind of legal or contractual responsibility may be derived from processing it that must be addressed and for which the data must be retrieved.

ALSA GRUPO, S.L.U. must comply with current legislation as regards its obligation to cancel the personal information that is no longer needed for the purpose or purposes for which it was collected, blocking the same so as to be able to respond to any possible liabilities arising from the processing of data, and solely for the duration of the limitation periods for any such liabilities. After the aforementioned limitation periods have elapsed the information in question shall be erased by secure methods.

5.7. Information we collect about visits to the website.

We collect and store limited personal information and anonymous statistics of all users that visit our website, either because the user actively provides said information or is simply browsing our website. The information we collect includes the Internet Protocol (IP) address of the device being used by the user, the browser and operating system being used, the time and date of access, the web address accessed by the user, as well as information on how our website is being used.

We use this information to know how long our website takes to load, how it is used, the number of visits, and the information that is most consulted by the user. This information helps us know whether the website is working correctly, so that if we detect errors or bugs we can fix them and improve our website's performance to be able to offer a better service for all our users.

In view of the above, we collect usage and browsing data for statistical and advertising purposes, to monitor the use of our website, and to improve our knowledge of our website users’ interests.

5.8. Minor.

Minors under 16 must not send any personal information without consent from a parent or guardian. ALSA GRUPO, S.L.U. assumes no liability for information sent by under 16 minors without due authorisation.

5.9. Security measures.

ALSA GRUPO, S.L.U. has taken the personal data protection safety measures required by current legislation in accordance with the type of information processed and have implemented other media and additional technical measures within their reach to avoid the unauthorised alteration, loss, processing of or access to the data received. ALSA GRUPO, S.L.U. hereby guarantees that it has adopted the appropriate security measures to ensure the security of the information and the confidentiality of the data that you send us over the Internet. Secure Socket Layer (SSL) technology is used for this purpose, which is a system that allows the information you send us to be encrypted, thus avoiding its reading even if it has been unlawfully intercepted. ALSA server is certified in such a way that its browser can confirm the identity of ALSA before any information is transmitted. This certificate ensures the identity of the target computer to which your personal details are being sent. You can check that SSL security is operating if the padlock icon comes up in the bottom edge of most browsers. If you click on this icon a certificate associated with connection security will come up. Notwithstanding, users should be conscious of the fact that internet security measures are not fail-safe.

5.10. Cookies.

Access to the website can mean using cookies. Cookies are small quantities of information that are stored on the browser used by each user so that the server can remember certain information that can be used later. This information makes it possible to identify you as a particular user and enables the saving of your personal preferences, as well as technical information, such as the number of visits or particular pages you visit.

Those users that do not want to receive cookies or want to be informed before they are stored on your computer can configure their browser accordingly. Consult our Cookies Policy for further information.

6.- Security in transactions.

ALSA guarantees that it will process all data corresponding to the payment method used with complete security and privacy. The details of the card used during payment are encrypted and transferred using a secure SSL protocol that ensures the privacy of the communication through an exchange of encryption keys.

In order to guarantee the security of transactions made on this Website, ALSA’s control processes include the prior verification and management of the information provided by the customer regarding the payment card ALSA reserves the authority to reject requests to contract and purchase tickets by customers paying with cards that are not their own, that have been obtained fraudulently, or with which they intend on carrying out a fraudulent transaction to the detriment of the legitimate card holder, ALSA, or any third party.

Any requests by state law enforcement agencies should be sent to the following e-mail address: asesoria@alsa.es

Bear in mind also that the issuers of the payment methods used may also have other anti-fraud measures that could result in the rejection of certain transactions. ALSA does not control nor is it responsible for any damages that could arise due to the application of policies approved by any payment method issuer.

The use of a payment method owned by a third party is not permitted, unless said third party has provided express authorisation. The person using said payment method is responsible for providing proof of such authorisation and for any damages that ALSA may sustain as a result.

7.- Intellectual and Industrial Property Rights.

All contents, elements, designs, and applications housed on this Website, regardless of their format or characteristics, and all Industrial and Intellectual Property Rights inherent to the Website are owned by ALSA GRUPO, S.L.U. and are protected by Industrial and Intellectual Property regulations and by any other legislation that may apply. The aforementioned content cannot be used, reproduced, distributed, modified, publicly communicated, assigned, transformed or subject to any other disseminating procedure that has not been expressly authorised beforehand in writing. ALSA GRUPO, S.L.U. reserves the right to take any legal proceedings open to it against those who infringe upon its aforementioned owner rights.

8.- Modifications.

ALSA GRUPO, S.L.U. reserves the right to amend this Legal Notice and Privacy Policy to adapt to legislative and case law developments or to changes in the corporate strategy or activity of ALSA and its associated companies, and we thus recommend that you read it each time prior to accessing and browsing the Website. Notwithstanding the foregoing, any relationships established with users prior to the amending of this Legal Notice and Privacy Policy shall be governed by the terms in place at the time of accessing the Website to establish the aforementioned relationships.

ALSA GRUPO, S.L.U. provides users with the appropriate technical resources to be able to first access this Legal Notice and Privacy and Data Protection Policy.

9.- Applicable legislation and Jurisdiction.

Any disputes or issues relating to this Website or the activities taking place on this Website will be resolved under Spanish law, to which the parties expressly submit. All conflicts deriving from or relating to the use of the Website will be resolved by the competent courts and tribunals in accordance with applicable legislation.

In the event that any of the terms of this document be declared null, they will be removed or replaced. Should this occur, the validity of the rest of the terms included in this document will not be affected.