Privacy policy

Data Protection

Committed to protecting your personal data

The Madrid City Council is committed to ensuring the privacy and security of the services it provides and the information it processes within the scope of its responsibilities.

In accordance with Law 40/2015, of 2 October, the Madrid City Council must comply with the basic principles and minimum requirements that guarantee the security of the information processed within its remit. Therefore, in order to ensure traceability of access to the web services provided through institutional portals, we record the Internet address (IP address) from which you browse and access such services. Additionally, to improve future versions of the website in terms of browsing experience and ease of search and access to the information provided, we use analytical cookies—subject to your consent—which allow us to perform statistical analysis of browsing activity on the institutional portals.

The IP address collected as a result of browsing the Madrid City Council’s website will be incorporated into the processing activity “Access to portals and applications managed by IAM,” under the responsibility of the Management of the Autonomous Body Informática del Ayuntamiento de Madrid.

Furthermore, when you need to access any web service that requires a specific procedure or management, you must provide the personal data strictly necessary to deliver the requested service. In such cases, the data collected will be incorporated into the corresponding processing activity, and you will be provided with detailed information in the section associated with that procedure or service.

Personal Data and Their Processing. Legal Bases

Personal data refers to any information relating to an identified or identifiable living natural person. Different pieces of information which, when combined, can lead to the identification of a specific individual, also constitute personal data.

These data may be numerical, alphabetical, graphic, photographic, or acoustic—for example, a name, an identification number (DNI, passport, health card number, etc.), voice, postal address and other location data (including geolocation), a photograph, electronic signature, IP address, or one or more elements specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of a person (race, sex, fingerprint, medical history, banking information, etc.).

In all cases, the data collected will be strictly necessary to provide the requested service and will be processed with the appropriate security measures.

The Madrid City Council may only process your data when it is legally entitled to do so, depending on the activity carried out, based on the legal grounds established by applicable regulations.

The legal basis for processing may be the fulfilment of a legal obligation, the performance of a task carried out in the public interest, the consent of the data subjects, the protection of vital interests, or the execution of a contract.

Regardless of the legal basis, providing your data is mandatory and essential to address your requests or provide the services and procedures you require.

What Information Must the Madrid City Council Provide You?

You have the right to receive free, clear, concise, and transparent information from the Madrid City Council regarding at least the following aspects:

The processing activity in which your personal data are included.

The identity and contact details of the data controller and the Data Protection Officer (DPO).

The purposes for which your data are processed and the legal basis that authorizes such processing.

The recipients to whom your data may be disclosed, whether due to legal obligations or to third parties for purposes directly related to legitimate functions.

Whether international data transfers will be carried out.

The period for which your data will be retained.

The rights available to you and how to exercise them.

The right to withdraw consent when processing is based on your explicit consent.

Information on your right to lodge a complaint with a supervisory authority. In our case, the competent national authority is the Spanish Data Protection Agency (AEPD).

Information on whether automated decision-making or profiling is carried out. As a general rule, the Madrid City Council does not engage in such activities.

This information must be provided:

At the time you provide your data (e.g., when completing an application form), or

When the data are obtained from a third party (through disclosure, public access, etc.), within a maximum period of one month and, in any case, the first time you are contacted or when the data are first disclosed to another recipient.

Record of Processing Activities

Your data will be incorporated into the corresponding processing activities of the Madrid City Council and will be processed for the specific purpose of each activity.

The record of processing activities, along with the corresponding controllers, is published in the Personal Data Protection section of the Electronic Headquarters.

What Are Your Rights?

Once your personal data are being processed by the Madrid City Council, you may exercise the rights of access, rectification, erasure, objection, restriction of processing, and data portability, as well as the right not to be subject to automated individual decision-making, including profiling, in accordance with applicable legislation, before the body responsible for the file.

These rights may be exercised in person or online through the Madrid City Council’s Electronic Headquarters.

You also have the right to lodge a complaint with the Spanish Data Protection Agency.

How to File a Complaint

You may file a complaint directly with the Spanish Data Protection Agency (AEPD) in the following cases:

When you have submitted a request to exercise your rights and it has not been addressed by the controller, or you have not received any response within one month.

When your request has been addressed but you disagree with the outcome.

When you believe that the data controller has committed an infringement of data protection regulations in relation to any of the Madrid City Council’s processing activities.

Before using this option, you may submit a prior complaint to the Data Protection Officer. To do so, you may use the Standard General Application Form.

The maximum period for the Data Protection Officer to respond to your complaint and notify you of the decision is two months from the date of receipt.

The Data Protection Officer (DPO)

The Data Protection Officer (DPO) is responsible for safeguarding your rights in matters of data protection. This role is established by law and is mandatory for all Public Administrations.

The DPO’s functions include advising controllers and processors on all matters related to personal data protection, including the exercise of data subjects’ rights, supervising compliance with data protection regulations, and raising awareness and training Madrid City Council employees in this field.

You may also contact the DPO for any information or questions you may have regarding the processing of personal data by the Madrid City Council. The DPO also participates in handling complaints submitted in this area.

DPO contact details: Coordinación General de Vicealcaldía, Calle Montalbán 1, 28014 Madrid Email: oficprotecciondatos@madrid.es

Applicable Data Protection Regulations

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation, GDPR).

Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights (LOPDGDD).

Organic Law 7/2021, of 26 May, on the processing of personal data for the purposes of preventing, detecting, investigating, and prosecuting criminal offences and enforcing criminal penalties.