This privacy notice is designed to help you understand how and why North Yorkshire Council processes your personal data in relation to demand responsive Bus Services. This notice should be read in conjunction with the council’s corporate privacy notice.
Who are we?
North Yorkshire Council is a ‘Data Controller’ as defined by Article 4(7) of the UK General Data Protection Regulation (UK GDPR).
The Integrated Passenger Transport team provides local bus services, including demand responsive bus services and the YorBus on-demand bus service, and may do so using both internal and external transport providers, as part of its responsibilities under S63 of the Transport Act 1985.
The council has appointed Veritau to be its Data Protection Officer. Their contact details are:
Information Governance Office
Veritau
West Offices
Station Rise
York
North Yorkshire
YO1 6GA
Email: infogov@northyorks.gov.uk
Tel: 01904 552848
What personal information do we collect?
In order to register you as a potential user of a demand responsive bus service, the council will process the following personal information:
- title, name, and address
- contact details such as telephone number and email address
- journey details: dates, times, origin, and destination of both requested and actual journeys
- payment card details
We will also record if you have an English National Concessionary Travel Scheme bus pass.
The council may also collect the following special category data:
- whether you are a wheelchair user
Why do we collect your personal information?
- to understand your needs in order to offer and/or provide a demand responsive journey to you
- to inform you of any updates should there be any unforeseen circumstances that we feel you should be made aware of
- to charge you and / or ensure you are correctly charged for any journey
- to ensure a wheelchair space is reserved if applicable
We may also use your information to ask you if you wish to participate in customer surveys about a demand responsive bus service.
We may also use your journey details to help inform future decisions about a demand responsive bus service or other local bus services.
Who do we share this information with?
The information obtained may be shared with third parties who are acting on our behalf such as external transport providers. If we do use a third-party organisation we will always have an agreement in place to ensure that the other organisations keep your data secure. We do not share the information with other organisations for commercial purposes.
We may share your information internally within the council, for example with safeguarding teams in the Children and Adult Services team.
We may share information externally with other organisations such as the Police and other local authorities if we suspect that a bus pass is being used fraudulently and /or a vulnerable person may be at risk.
How long do we keep your information?
| Data held | Retention Period |
|---|---|
| Basic identifiers, contact details and personal details, including supporting documentation sent with your application |
For as long as the customer chooses to remain a user or potential user of the service. Where this is no longer applicable, data will be removed from the system within 12 months. |
| Journey details | 12 months |
|
For customers booking via the Customer Service Centre, we hold basic identifiers, contact details and personal details, including supporting documentation sent with your application and journey details: |
In line with existing Customer Service Centre retention periods. |
What is our lawful basis for processing your information?
North Yorkshire Council relies on the following lawful basis to process your personal data:
UK GDPR Article 6 (1) (e )- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
When processing personal data for marketing purposes, the council will rely on the following lawful basis:
UK GDPR Article 6 (1) (a)- the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
When processing special category data, the council will rely on the following lawful basis:
UK GDPR Article 9 (2) (g) – processing is necessary for reasons of substantial public interest with processing meeting Schedule 1, Part 2 of the Data Protection Act 2018 as below:
- (16) Support for individuals with a particular disability or medical condition
For more information about how we use your data, including your privacy rights and the complaints process, please see our corporate privacy notice.