Demand Responsive Bus Privacy Notice

This Privacy Notice is designed to help you understand how and why the County Council processes your personal data in relation to Demand Responsive Bus Services.

This notice should be read in conjunction with the Council’s Corporate Privacy Notice.

Who are we?

North Yorkshire County Council is a ‘Data Controller’ as defined by Article 4(7) of the General Data Protection Regulation (GDPR).

The Integrated Passenger Transport team provides local bus services, including Demand Responsive bus services, and may do so using both internal and external transport providers, as part of its responsibilities under S63 of the Transport Act 1985. 

The Council has appointed Veritau Ltd to be its Data Protection Officer. Their contact details are:

Data Protection Officer, Veritau Ltd, County Hall, Racecourse Lane, Northallerton, DL7BAL.

Their email address is and their phone number is 01609 53 2526.

What personal information do we collect?

To register you as a potential user of a Demand Responsive bus service, we will ask you to provide the following information that will be collected, stored and processed:

  • Basic identifiers: Title, Name and Address.
  • Contact Details: Telephone Number and Email Address.
  • Journey Details: Dates, Times, Origin and Destination of both requested and actual journeys
  • Whether you are a wheelchair user
  • Payment card details.

We will also record if you have an English National Concessionary Travel Scheme Bus Pass.

We may also use your information to ask you if you wish to participate in customer surveys about a Demand Responsive bus service.

Why do we collect your personal information?

  • To understand your needs in order to offer and / or provide a Demand Responsive journey to you.
  • To inform you of any updates should there be any unforeseen circumstances that we feel you should be made aware of.
  • To charge you and / or ensure you are correctly charged for any journey.
  • To ensure a wheelchair space is reserved if applicable

We may also use your Journey Details to help inform future decisions about a Demand Responsive bus service or other local bus services.

Who do we share this information with?

The information obtained may be shared with third parties who are acting on our behalf. If we do use a third party organisation we will always have an agreement in place to ensure that the other organisations keeps your data secure.   We do not share the information with other organisations for commercial purposes. 

We may share your information within the County Council e.g Safeguarding teams in CYPS and HAS and between the public and private sector e.g The Police and other Councils if we suspect that a bus pass is being used fraudulently and /or a vulnerable person may be at risk.

How long do we keep your information for?

Data held Retention Period
Basic Identifiers, Contact Details and Personal Details, including supporting documentation sent with your application

For as long as the customer chooses to remain a user or potential user of the service.

Where this is no longer applicable, data will be removed from the system within 12 months.

Journey Details 12 months

What is our lawful basis for processing your information?

The Council processes your personal data on a Public Task basis – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. The Council processes your special category data on a substantial Public Interest basis – processing is necessary to support individuals with a particular disability or medical condition.

For More information about how the County Council uses your data, including your privacy rights and the complaints process, please see our Corporate Privacy Notice.