OUIGO ESPAÑA, S.A.U. (hereinafter, "OUIGO") makes this Privacy Policy available to users of the website www.ouigo.com/es (hereinafter, also "the Website") and the mobile application "OUIGO ES" (hereinafter, also "the App"), in order to provide information on how we treat your personal data and protect your privacy and information.
OUIGO asks you to take a few minutes to read this Privacy Policy carefully
Introduction
This Privacy Policy applies to the Website and the App, and in particular to user interactions through the Website and the App, as well as to personal data processed in order to manage the sale of food and beverage products online.
OUIGO may modify this Privacy Policy when necessary. In the event of modifications, you will be notified via the website and the App or by other means, so that you can be informed of the new conditions for processing your data. By continuing to use the functionalities made available by OUIGO after you have been notified of the aforementioned modifications, you agree to these modifications except for those cases in which your consent is required.
Who is the Controller of the processing of your personal data?
Company name: OUIGO ESPAÑA, S.A.U.
Registered office: c/Alfonso XII, 62, 4th floor – 28014 Madrid.
Tax ID No.: A-88269972.
Contact email address: datos@ouigo.es
If you require interaction with the DPO, please indicate this in your email.
For what purposes do we process your personal data and on what legitimacy basis?
The personal data provided by users of this website and App will be processed by OUIGO for the following purposes, depending on the type of data provided by the user, as well as the interactions that the user carried out with OUIGO and/or other users through the website and the App:
1. Management of registered users on the website and in the App: the personal data of users who, where appropriate, proceed to register and create a user account on the website and in the App, will be processed for the purpose of managing a user profile (username and password, as well as the user's identification data) that allows access to the website and the App. We also inform you that, if the user accesses the website and registers voluntarily through an account on the enabled social media, we will receive the identification and contact details provided by the corresponding social media, in order to verify your account, manage the registration and allow access to the website. basis of legitimacy that supports such processing is the execution of the relationship signed with the user and the provision of the service requested by the user (registration and use of the website and the App).
2. Management and execution of reservations and ticket purchases: your data will be processed for the purpose of executing the legal relationship arising as a result of the reservation, payment and issuance of tickets, as well as to enable different options to the user in relation to the billing of the same and a follow-up of the transactions carried out. The basis of legitimacy for such processing is the execution of the legal relationship initiated as a result of the purchase/booking of tickets. If you provide us with data of third parties, you guarantee that you have their consent and that you have provided them with the information relating to the processing of their data in the terms established in this Privacy Policy.
In the event that assistance is required during the journey and trip booked as a result of mobility restrictions that the user may have (due to their physical and medical condition), and always based on your explicit consent to this effect, we may process the user's health data in order to provide said assistance during the trip.
3. Compliance with legal obligations applicable to OUIGO: we will process your data in order to comply with various legal obligations applicable to our business, such as tax and accounting obligations. The legal basis for this processing is the law that imposes this obligation on us in each case.
4. Ensuring security levels on board: we may process your personal data in order to ensure the safety of our staff and other passengers, as well as the integrity of our trains. The legitimate interest of OUIGO is to protect the integrity of goods and persons under its responsibility. You can request further information on the weighting test carried out in respect of this legitimate interest by writing to the contact email address indicated in this Privacy Policy.
5. Fraud prevention: we will process your personal data in order to combat credit card fraud, which may give rise to the automatic blocking of any booking that appears fraudulent or does not present all the necessary guarantees in terms of online payment security. The legitimate basis for such processing is OUIGO's legitimate interest in preventing fraud in relation to the activity carried out by OUIGO. You can request more information about the legitimate interest test by writing to the contact email address indicated in this Privacy Policy.
6. Carrying out advertising and commercial prospecting activities: if you give us your consent, we will process your data to send you commercial information, offers, discounts and promotions relating to OUIGO's own products and services through any channel, including electronic means (such as notifications via the Ouigo Application, push notifications, email and SMS, MMS to mobile phones) and by non-electronic means (including, but not limited to, telephone and letter). For these purposes, your contact details will be processed. You may withdraw your consent at any time under the terms set out in this Privacy Policy.
7. Sending you the OUIGO newsletter: Similarly, if you give us your consent, we may send you the OUIGO newsletter. Your contact details will be processed for this purpose. You may withdraw your consent at any time under the terms set out in this Privacy Policy.
8. Development of statistics or satisfaction and market studies; obtaining profiles and personalisation of commercial actions; data segmentation and filtering: OUIGO informs that profiles will be drawn up based on the following criteria: personal characteristics, cultural leisure, recreational leisure, hobbies, travel (means of transport used, cities visited, types of accommodation used), browsing data and postcode. Both the activities carried out and the frequency with which they are carried out will be analysed. The consequence of profiling will be the personalisation of the commercial actions addressed to the customer. The basis of legitimacy is OUIGO's legitimate interest in combining, classifying and grouping the above data in order to have the necessary information with which to develop statistics or satisfaction and market studies; to personalise commercial actions; and to segment and purify the database.
9. Management of functionalities made available by the website and the App: the personal data of users who proceed to make use of any of the functionalities made available by the website and the App will be processed for the purpose of managing and processing the development of the functionality in question in each case. The basis of legitimacy that supports such treatment is the execution of the relationship signed with the user.
10. Call recording: In case you contact us through our customer service, we Inform you that we will proceed to record the call, based on our prevailing legitimate interest in order to properly provide our services, resolve and manage returns, incidents and complaints, as well as ensure the accuracy and integrity of the information collected in this way, which requires us to keep these recordings, linked to a date, providing evidence of conversation. You may request further information on the test of the weighting carried out with respect to such legitimate interest by writing to the contact email address indicated in this Privacy Policy.
11. Participation in promotions: in the event that you participate in promotions organised by OUIGO, we will process your personal data for the purpose of enabling such participation on the basis of the legitimisation of the contractual performance between the user and the organiser.
12. Analysis of web and App browsing and personalised advertising service: if you have given us your consent to install cookies on your browsing device, we will be able to process your data in order to analyse your browsing, infer your interests and serve you personalised advertising, all on the basis of the aforementioned consent. In this sense, your browsing data will be processed. Further information on the use of cookies can be found in our Cookie Policy and on profiling in purpose no. 8.
13. Complaint management: the personal data of users will be processed by OUIGO for the processing of complaints from travellers through the form available on the website. The legal basis for this processing is a legal obligation. We inform you that this data will be communicated to the Ministry of Transport, Mobility and Urban Agenda.
14. Quality surveys: the personal data provided in the complaints form may be used to carry out global surveys on the quality of customer service. The basis of legitimacy is consent. You may withdraw your consent at any time under the terms set out in this Privacy Policy.
15. Management of the Smart Bar service: the personal data provided in the form completed to request the products made available online will be processed solely to handle sales of food and beverage products through this channel. The legal basis will be the performance of the legal relationship entered into as a result of the purchase of the products made available online through this channel.
This service will be provided through a website managed by a third party, meaning that OUIGO will process only the minimum data necessary to manage the sale of these products online.
16. Send notifications in the OUIGO App as long as you have voluntarily granted the corresponding permissions on your devices. Activating these permissions allows us to communicate with you about our trips and send you informational alerts regarding new OUIGO initiatives. These processes will be carried out in accordance with the preferences you have set on your devices, meaning that if you do not configure your device to accept these notifications, you will not receive them.
What data is processed by OUIGO and from which sources does it originate?
The data processed by OUIGO as a result of the interactions carried out by the user through the website and the App come from the following sources:
- Data provided by the user by filling in the forms made available by OUIGO when registering and creating a user account (or OUIGO Customer Account) and/or purchasing a ticket.
- Data required for the registration of an OUIGO Customer Account via social networks (social login) being name, surname and email address.
- Data generated as a result of browsing and use by the user of the website and the App.
- Data provided in the form that is completed to manage the sales of food and beverage products made available online.
- In the case of telephone contact with our customer service, the user's voice may be processed as a result of the recording of the call.
In addition, OUIGO may receive personal data from users through external sources such as multimodal travel search and booking platforms through which the user provides his or her data.
OUIGO may process personal data of the following types, depending on the relationship established with the user and the purposes specified in the previous section:
- Identifying and contact details - purposes 1 to 15
- Data relating to personal characteristics - purposes 3, 6, 8, 12
- Data of an economic and financial nature - purposes 2, 3, 5, 15
- Browsing data and device used - purposes 5, 8, 9, 12
- Health data (only in case of need for assistance during the journey and travel as a result of mobility restrictions that the user may have) - purposes 2, 3
- Other types of data (e.g. the user's voice in the case of contacting the call centre). - purposes 10, 13 and 14
With whom will my data be shared and will it be transferred to other countries?
In principle, there are no plans to transfer the personal data you provide to us to any third party, and OUIGO will be the only entity that processes them in accordance with the provisions of this Policy. Notwithstanding the foregoing, your data may be communicated to various Public Bodies in compliance with the legal obligations applicable to OUIGO (for example, in tax and accounting matters), Notaries, ADIF and, where appropriate, insurance companies. Likewise, in order to manage reservations and ticket purchases, your bank details will be processed by the payment gateway providers contracted by OUIGO, which may carry out international data transfers, for which we recommend that you read their respective privacy policies.
OUIGO uses service providers who act as data processors for purposes related to the maintenance of its technological infrastructure and development of promotional activity. You can request more information about data processors at datos@ouigo.es. In addition, in connection with the purchase of your ticket, you can request to receive notifications regarding your trip via WhatsApp if you choose this option on the ticket purchase form. To provide the option to contact you via WhatsApp, we use WhatsApp BusinessServices of WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, www.whatsapp.com). WhatsApp may send your data to servers in the USA. Please note in this regard that the United States does not have an adequate level of protection for personal data. This means that your personal data may be processed under lower standards than those set by European data protection regulations. Notwithstanding the above, WhatsApp offers alternative safeguards recognised under applicable European data protection laws such as the conclusion of standard contractual clauses which may cover the international transfer of data.
In this regard, should it be necessary to make an international transfer of data outside the European Economic Area, OUIGO informs you that it will do so by prioritising the choice of a country that offers an adequate level of security for personal data or, failing that, by adopting additional guarantees for the security of the personal data transferred, in accordance with the possibilities recognised by the regulations in force. You can request more information on international data transfers at datos@ouigo.es.
How long do we keep your data?
OUIGO will retain your personal data for the time necessary to provide the requested service and/or to achieve the intended purpose of the processing, provided that, insofar as applicable, you have not revoked your consent. Subsequently, your data will be kept for the legal periods applicable in each case, taking into account the type of data, as well as the purpose of the processing.
You can request more information on OUIGO's personal data retention periods at datos@ouigo.es
What are your rights regarding your personal data?
OUIGO informs you that you have the following rights regarding your personal data:
- Access your data: you have the right to access your data to find out what personal data we are processing concerning you.
- Request rectification or deletion of your data: in certain circumstances, you have the right to rectify personal data which you consider inaccurate and which concern you, and which are processed by OUIGO, as well as the right to request deletion of your data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
- Request the limitation of the processing of your data: in certain circumstances, you will have the right to ask us to limit the processing of your data, in which case we inform you that we will only keep the data for which you have requested limitation of the processing for the exercise or defence of claims.
To the portability of your data: in certain circumstances, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and to have it transferred by OUIGO to another data controller.
Object to the processing of your data: in certain circumstances you have the right to object to the processing of your data, in which case we will stop processing your data unless we have to continue to do so for compelling legitimate reasons or for the exercise or defence of any claims.
You may also withdraw any consent you have given for the processing of your data, without this affecting the lawfulness of the processing based on the consent prior to its withdrawal.
You may exercise these rights by writing to the data controller at its registered office or at the address datos@ouigo.es.
In both cases, proof of identity of the person exercising his or her rights may be required.
OUIGO informs you that you may file a complaint with the competent data protection supervisory authority, which in the case of Spain is the Spanish Data Protection Agency (www.aepd.es).
Revised 28/03/2025.