Privacy Notice - Demand Responsive Transport (DRT)

This privacy notice sets out how West Berkshire District Council (the "Council") will use your personal data, and your rights in relation to that personal data. This document describes how and why we collect, store, protect, process and share the data you give to us. It is written in accordance with the UK data protection legislation.

This notice relates to personal data collected under the Demand Responsive Transport ('DRT') service. We will use this information in the booking and provision of the service.

This notice applies to potential, current and former customers of the service and those we have contacted but have opted not to partake in the service. It is important that you read this notice so that you know how and why we use information about you. It is also important that you inform us of any changes to your personal information so that the information which we hold is accurate and current.

Date of Issue: 11/12/2023.
 

Update History:

• 11/12/2023 - First issue of a new Privacy Notice

Directorate: Place
Service: Environment
Team: Transport Services

About the Organisation

The Council is the Data Controller. This means it is ultimately responsible for the data it holds about you.

Contact Address:

West Berkshire District Council
Market Street
Newbury
Berkshire
RG14 5LD

ICO Registration Number: Z6825178
https://ico.org.uk/ESDWebPages/Entry/Z6825178
 

The Data Protection Officer

Contact details for the Data Protection Officer at the Council can be found at: Contact the Data Protection Team.

The personal data we hold about you

We will process the following personal data about you:

• Identity Data and Contact Data:
  • Names (First/Last Name)
  • Mobile Phone Number - for automated notifications related to booked journeys.
  • Email Address - For account validation and communications.
  • Profile picture - upload an optional picture or photo, which would be visible to drivers and Council staff who have access to the system.
• Device Data: Mobile device type used - to enable user technical support.
• Location Data: Includes your current location disclosed by GPS technology, for example, to provide walking directions to your pick up point or to suggest your trip origin based on your location. You will be asked to consent to your location data being used for this purpose. You can withdraw your consent at any time by disabling location data in your settings.
• Usage Data: includes details of your use of any of our apps or websites.
• Marketing and Communications Data: includes your preferences in receiving marketing from us and our third parties and your communication preferences. 
• Transaction Data: includes details about payments to and from you.
• Financial Data: payment card details if required for payment of fare

We may also process the following special category data about you:

• Any relevant medical/disability information, so that we can make adjustments for you on transport e.g., ensuring space for a wheelchair

These details are collected and held on our third-party supplier Liftango's DRT software, "West Berkshire Community Connect" app (further details can be found here), and will be protected using up-to-date technical and organisational security measures.
 

Source of your personal data

We collect the above information about you from the data you enter when you apply for the service and when you make bookings to use the service.
 

Purpose and legal basis for processing your personal data

In accordance with the data protection laws, we need a "legal basis" for collecting and using information about you. There are a variety of different legal bases for using personal data which are set out in the data protection laws.

We have set out below the different purposes for which we collect and use your personal data, along with the legal basis we rely on to do so.

Sharing your personal data

You will be able to see and update your data through the app or website.

Your data will be seen by employees of the Council relevant to the service or information request you have made. Only suitably trained and authorised Council employees have access to full personal data collected as part of the process operating the Demand Responsive Transport (DRT).

We may share your personal data with third parties where it is necessary for the delivery of the service and for no other reason. The third parties we share your data with are:

• Authorised bus drivers and transport providers (operators) will only see the data that is essential for them to provide safe and efficient transport. This will include your name, contact details and any relevant medical or disability information you have chosen to provide, for example if you require wheelchair access.
• Liftango, the Council's software supplier, for the sole purpose of providing the Council with DRT (Demand Responsive Transport) software.
• Stripe, who will process payments on behalf of Liftango and the Council where customers have paid in advance either by telephone or online. Stripe will only have access to minimal data required to process transactions, and will not have access to journey history or locations.
• Ticketer, Rapyd and LittlePay, if you pay for your journey on the bus and/or present a concessionary bus pass or other smart card or multi-journey ticket for travel.

Where a service or information request requires us to share your data with other parties, a separate privacy notice will describe who that is.

We may also share your data if we are required to do so by law, for example by court order or to prevent fraud or other crime.
 

Retaining your personal data

Your personal data will not be kept longer than necessary. 

You can check how long the Council will keep each type of data against our retention schedule.
 

Your rights

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Withdraw consent to the processing of your personal data at any time, where processing is based on your consent. To withdraw your consent, please contact our Data Protection Officer using the contact details below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
   

How to make a request

If you wish to make a request associated with any of the rights listed above, contact the Council using the contact details at the top of this notice.
 

International transfers

West Berkshire Council will not transfer or store your personal data outside of the UK save for as outlined below:

The payment provider, Stripe, may transfer transactional data internationally in some circumstances, for example for fraud prevention purposes. Any such transfers will be regulated under the PCI DSS (Payment Card Industry Data Security Standards).
 

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. Further information can be found on the Information Commissioners Office website.

The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
 

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.