Privacy policy

Privacy Policy

Last updated: May 2018

ARRIVA SPAIN HOLDING, S.L. is committed to protecting and respecting your privacy.

This policy (together with our Terms of Use for the website and any other documents referred to on it) sets out the basis on which any personal data collected from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting or disclosing your information in the circumstances described below, you are accepting and consenting to the practices described in this policy.

For the purposes of data protection regulations, the data controller is ARRIVA SPAIN HOLDING, S.L. con dirección C/ José Abascal 45, 28003 Madrid, NIF B28468924 and with the following details in the Companies Register of Madrid, Tomo 122679, Folio 122, Sección 8, Hoja M-61216 e Inscripción 14.

1. ¿What personal data do we collect?
Information provided by you. Information provided by you. You may give us information about you by filling in forms on our website (our site) or by contacting us by telephone, email or other means. This includes information you provide when you register to use our sites, download our app, subscribe to our services, purchase tickets, register to use our transport wifi service, enter a competition, promotion or survey and when you report a problem with our sites or make a complaint.
The information you provide to us may include:

  • Your name
  • Address
  • Your email address
  • Your telephone number
  • Finance and credit card information

Information we collect about you. In relation to each of your visits to our websites or when you register to use our transport wifi services we may automatically collect the following information:

  • Geographic location, IP or MAC address or details relating to your use of your mobile device or PC (specifically when you register to use our in-transit wifi service).
  • Technical information, including the IP address used to connect your computer to the internet, your login information, browser type and version, time zone settings, browser extension types and versions, operating system and platform;
  • Information about your visit, including the full URL, the clickstream to, through and from our websites (including date and time); products you visited or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to navigate from the page and any phone numbers used to call our customer service number.

Information we receive from other sources. We may receive information from other sources if you have granted your permission or if there is a legal reason for this to occur. We will receive details of your National Insurance contributions.
Sensitive personal data. We will not knowingly or systematically seek to collect, store, or otherwise use information about you that is classified as "special category data" or "sensitive data" (for example, information relating to trade union membership, ethnic origin or health).
2. Cookies
Our websites use cookies to distinguish you from other users of the site. This helps us to provide you with a good experience when you browse our website, and also allows us to improve our websites. For detailed information about the cookies we use and the purpose for which we use them, see our Cookie Policy at

3. How do we use your personal data and what is the legal basis for its processing?
The collection of personal data described above is normally mandatory and, if such personal data is not provided, we will not be able to provide you with information, products, and services. Where the collection of personal data is not mandatory, we will inform you of this prior to collection, as well as of the consequences of not providing the relevant personal data.
Our entitlement to collect and use the personal information described above will depend on the personal information concerned and the specific context in which the information is collected.
However, we will normally process your personal information only where we have your consent to do

  • where we have your consent to do so
  • where the processing is necessary to carry out our contract with you; or
  • where the processing is in our legitimate interests or those of a third party and such interests are not overridden by your data protection interest or fundamental rights and freedoms; and
  • where we have a legal obligation to process your personal information

Information provided by you. We will use your personal information in the following ways:


Purpose of processing

Legitimation of the processing

Application and website

Processing your transaction and providing you with a ticket

Execution of a contract


Send a notification connected to your transaction

Execution of a contract

Aplicación y sitio web

Report service disruption affecting your journey

Legitimate interest

Application and website

To provide you with information about other products or services we offer that are similar to those you have already purchased or have become interested in

Consent provided by you

Application and website

Notify you about changes to our service

Necessary for the conclusion of a contract with you or to take the steps to become a party to a contract

Information we collect about you. We use your personal information as follows:


Purpose of processing

Legitimation of the processing


Administer our sites and for internal operations, including troubleshooting, data analysis, testing, research, polling and statistical purposes.

To monitor our sites to make sure they are working properly and to improve the customer experience to help you buy the best value tickets for your journey.
Necessary for the purpose of the legitimate interest pursued by the controller or processor, except where such interest is overridden by the interests, rights or freedoms of data subjects


Improving our sites to ensure that content is presented in the most effective manner possible for you and for your computer.

To enable our customers to purchase tickets and find the right tickets for their journey.
Necessary for the purpose of the legitimate interest pursued by the controller or processor, except where such interest is overridden by the interests, rights or freedoms of data subjects.


As part of our effort to keep our sites safe and secure

To protect your personal data when purchasing transport tickets.
The processing is necessary to protect the vital interest of the data subject or another person.

Application and website

To measure or understand the effectiveness of the advertising we serve to you and others, and to display advertising that is relevant to you

Consent provided by you.

Information we receive from other sources:  We may combine this information with information you provide to us and information we collect from you. We may use this information and the combined information for the purposes set out above (depending on the type of information we receive).

If you have any questions or need additional information concerning the purposes for which we collect and use your personal information, please contact us using the contact details available in the "Questions about this Privacy Policy" section below.
4. Sharing your information
We may provide your personal data to the following categories of recipients for the purpose described in this Privacy Notice

  • Business partners, suppliers and subcontractors for the performance of any contract we are involved in with them or with you, including rail ticket retailing, rail trouble ticket information services, rail timetable services, email marketing services, retail bus ticketing, and European rail ticketing.
  • Companies within the Arriva group for the execution of any contract in which we are involved with them.
  • Search engine and analytics providers who assist us in improving and optimising our sites. Third-party service providers who process personal data on our behalf (such as information technology service providers, communications service providers and analytics providers)

We may also disclose your personal data to any law enforcement body, regulator, government agency or other third party where we believe disclosure is necessary (i) as an enforceable measure by law or regulation; (ii) to exercise, establish or defend legal rights; or (iii) to protect your vital interests or those of any other person.
We may also transfer your personal data to a purchaser or prospective purchaser (and its agents and advisers) in connection with any reorganisation, restructuring, merger or sale, or other transfer of assets provided that we inform any receiving party that it must use your personal data only for the purposes disclosed in this Privacy Notice.
Finally, we may disclose your data to any other person to whom you ask us to make the disclosure or if you consent to such disclosure.
5. Data Retention
We will not retain your personal data for longer than is necessary to fulfil the purposes for which it was collected, unless the law permits or requires us to keep it for longer.
The following table explains in more detail how long ARRIVA SPAIN HOLDING, S.L. will store different types of information:

Customer information


Passenger details (e.g. name, passenger address, etc.)
(i)Possible passengers
(ii)Current passengers
(iii)Expired passengers

6-12 months
For the duration of the passenger registration with the client and then for the period specified for expired passengers.
For a period of 6 years from the end of the year in which the customer's services were last purchased by the passenger.

Passenger datas

For the duration of the passenger record with the customer and then for a period of 6 years from the end of the year in which the passenger last purchased the customer's services.

Passengers consent to the terms and conditions of the Client.

Duration of the processing of personal data and up to 6 years thereafter

Passenger services questions

3 years

6. Information Security
We implement appropriate administrative, technical and organisational security measures to protect your personal data under our control from unauthorised access, collection, use, disclosure, copying, modification or disposal. All information you provide to us is stored on secure servers. We are part of the Arriva Group, which trains its employees in our data privacy policies and procedures and allows authorised employees to access personal data on a need-to-know basis, as required for their role. We also take steps to ensure that any service provider we engage at our site to process personal data takes appropriate technical and organisational measures to safeguard such personal data.

7. Updates to this Privacy Policy

We may update this Privacy Policy from time to time in response to legal changes, technical or business developments. When we update our Privacy Policy, we will take appropriate steps to inform you, consistent with the relevance of the changes made.
You can see when this Privacy Policy was last updated by checking the "last updated" date provided in the heading of this Privacy Policy.
8. Your Data Protection Rights
You have the following data protection rights:

  • If you wish to access, correct, update or request deletion of your personal information, you may do so at any time by contacting us at any time at
  • In addition, you may object to the processing of your personal information, ask us to restrict the processing of your personal information or request the portability of your personal information. Again, you can exercise these rights by contacting us at
  • If we have collected and processed your personal information with your consent, then you may withdraw your consent at any time. Withdrawal of your consent will not affect the lawfulness of any processing carried out prior to your withdrawal, nor will it affect the processing of your personal information carried out in relation to matters of legal process other than consent.

We respond to all requests we receive from individuals who wish to exercise their data protection rights in accordance with applicable data protection regulations.
9. Questions about this Privacy Policy
If you have any questions, concerns or complaints about this Privacy Policy or our treatment of your personal data, you can contact us by email at or by post at the following address: C/ José Abascal 45, 28003 Madrid.
If you are not satisfied with the response, you can contact the Data Protection Officer:
You have the right to complain to a data protection authority about our collection and use of your personal information. If you are not located in the European Economic Area, please contact your local data protection authority (contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries are available on the European Commission's website at the following link: 29/structure/data-protection-authorities/index_en.htm).
ARRIVA SPAIN HOLDING, S.L. is responsible for the processing of your personal data.


C/ Fraguas, 27
Pol. Ind. Urtinsa.
28923 Alcorcón (Madrid)
Phone: +34 91 226 04 18

Follow us