This notice explains how and why Westway Community Transport uses personal information from service users, organisations and other members of the public.
It is regularly reviewed and updated in line with the services we deliver and the suppliers that we use. The date that it was last modified is at the end of this notice. We recommend that you check our website periodically for any changes made to this privacy notice. If we make any significant changes that could affect you, we will send you a notification.
When we refer to “we” or “us” in this notice we are referring to Westway Community Transport (a Registered Society with FCA number 27317R). We are listed on the Information Commissioner’s register of data controllers under Registration Number Z494945X.
In this notice, we use the term personal information to mean any information from which you can be identified. This might include your name, your home address, your email contact details, or your telephone number. Personal information does not include information where your identity has been removed (i.e. anonymous data).
We use the term special categories of personal information to mean information about your ethnic origin, your religious beliefs and your health.
Personal information we collect and use
- Individual Transport Services
We provide a range of transport services to individuals. This section of our privacy notice explains how we collect and use personal information from people who use our volunteer cars service, shopper service, minibus service, and our mobility scooter and wheelchair hire services.
When you contact us about these services, we will collect some personal information from you (for example your name, address, email contact details, telephone number).
When providing these services to you, we may also need to collect additional information about you and any other individuals you tell us about (for example emergency contact details, payment information and proof of ID).
We will only collect and use your personal information in this way if:
- it is necessary to enter into, or perform, a contract with you; or
- if we are satisfied that we have a legitimate interest to record and retain this information to deliver our services to you.
Depending on the nature of the services we provide to you, we may also ask you to give us special categories of personal information about you (for example, information about your health or ethnicity). We will collect and use this kind of information:
- if we have your explicit consent; or
- for equalities monitoring purposes.
We use a third-party, Shaunsoft Community Transport Software, to supply and support our community transport booking system. For more information, please see Shaunsoft’s privacy notice.
When we provide My Care My Way community transport services on behalf of the Kensington & Chelsea Social Council, we will access your personal details via the CharityLog systems.
2. Home to School Transport Services
When schools or local authorities contract with us to provide home to school transport services, the school/local authorities may provide us with personal information about the children who will be using our services each day. This will include personal information (names, addresses, dates of birth, and emergency contact details). Where relevant and necessary, we may also receive information about ethnic origin, medical needs, health conditions, mobility issues, language or communication requirements and disabilities. In this regard, we will be acting as a data processor on behalf of the school or local authority, and it is the responsibility of the contracting body to ensure that it has appropriate consents or authorisations to transfer this information to us.
We will share this information with our drivers to deliver the home to school transport services, and we will keep this information on record to comply with safeguarding best practice (see ‘Data Retention’ below). We are satisfied that we have a legitimate interest to collect, use and retain this information to deliver our home to school transport services.
3. My Care, My Way
When we provide My Care My Way community transport services on behalf of Kensington & Chelsea Social Council, we will access your personal information via the CharityLog system. We act as a data processor when we provide these transport services. If you have questions about how My Care, My Way share your personal information, you should contact them directly or visit the frequently asked questions page on their website.
4. Group Transport Services Members
If you register with us as a charity, community group or voluntary organisation in order to benefit from subsidised minibus services (with or without a driver), we will collect and record personal contact information for individual(s) at the organisation (such as name, address, email contact details and telephone number).
We will only collect and use personal information in this way if:
- it is necessary to enter into, or perform, a contract with you; or
- if we are satisfied that we have a legitimate interest to record and retain this information to deliver our services to you.
If we provide minibus services with a driver, we may also obtain personal information about your passengers such as their name, address and telephone numbers for pick-up and drop-off purposes. In this regard, we will be acting as a data processor on behalf of the organisation, and it is the responsibility of the organisation to ensure that it has appropriate consents or authorisations for individuals to transfer this information to us. We will not retain this passenger list information any longer than is necessary to fulfil the transport booking (s).
5. Training
When you register to take part in our training services we will collect your name, address, email contact details and telephone number. For specific training courses, you will also need to provide us with your date of birth, national insurance number, driving licence information. This information is necessary for us to enter into or perform our contract with you to provide the training. We will ask for your consent to collect information about any medical conditions that may affect your ability to drive.
We will share your details with the following third-parties when you undertake specific training courses with us:
- Minibus Driver Awareness Scheme (MiDAS), Car & MPV Training & Passenger Assistance Training (PATS) – the Community Transport Association (CTA)
- First Aid Training – Pro-Trainings
We may also ask for information about your ethnicity where there is a substantial public interest to do so, to monitor equality of opportunity and treatment. We will always store this information in an anonymised format.
6. Marketing
Emails
We would like to keep in touch with you about the work that we do and the services we provide.
We will only send you marketing communications by email with your consent. We use a third party, Mailchimp, to deliver our e-communications. This company is a data processor for us and only processes personal information in line with our instructions. If you want more information, you can view Mailchimps’s privacy notice.
If you consent to receive email marketing communications from us, we will add your name and email contact details to our marketing database, and we will share this information with Mailchimp to send the emails to you.
You can opt out of email marketing by clicking the ‘unsubscribe’ link in any of our emails, or you can contact us at data@westway.org.uk or on 020 8964 4928 at any time to opt out, change or update your contact details or to update your communication preferences.
We keep information about our contacts on the cloud system, HubSpot. You can find more information in HubSpot’s privacy policy.
Post
We may send marketing information by post if we are satisfied that we have a legitimate interest, for example, sending our newsletter to service users or sending special offers to members. You can contact us by email at data@westway.org.uk by post at 240 Acklam Road, London, W10 5YG, or by telephone on 020 8964 4928, at any time to tell us that you no longer wish to receive marketing by post or to update your contact details.
Telephone
From time to time, we may make marketing telephone calls to you, but we never use automated calling systems. We will only contact you in this way if we are satisfied that we have a legitimate interest to do so and we will always check the telephone preference service and our marketing preference records before we make any telephone marketing calls to you. You can contact us on 020 8964 4928 or by email to data@westway.org.uk at any time to tell us that you no longer wish to be contacted by telephone for marketing purposes.
7. Monitoring and Development
We use anonymised information to research the use of our services and our effectiveness. In some circumstances, we may share the results of this research with third parties such as organisations that fund our work, but this information will always be anonymised so that it can no longer be associated with you
8. Visitors to our website and online bookings
We collect personal information that you provide when you fill in a form on our website or make a booking.
We will only collect and use your personal information in this way if:
- it is necessary to enter into, or perform, a contract with you (or to take steps, at your request, to enter into a contract with you); or
- if we are satisfied that we have a legitimate interest to record and retain this information to respond to queries or complaints, or for internal quality monitoring
We may also collect information about how you use our website, and our Cookies Policy has information about how we use cookies on our website.
When you make a payment to us via our website, we use a third-party Global Payments to process the payment. You can find information on their privacy notice at Global Payments.
We use a third-party website support provider, Codekbyte, to help maintain the security and performance of our website. To deliver this service Codekbyte may process the IP addresses of visitors to our website.
9. People who contact us via social media
If you send us a private or direct message via social media, we may share this information with other personnel within our organisation if we are satisfied that we have a legitimate interest to do so, for example, to respond to a specific query or to pass on information. We will not share any personal information that you provide in a message with any other organisations without your consent.
10. Queries and complaints
If you send a question or complaint to us, we will use the personal information you provide to us (for example, your name and the name(s) of any other individuals involved) to process your query or complaint and respond to you. Where we consider it necessary or appropriate, we will share this information with third parties such as our insurers, the Information Commissioner’s Office, the Financial Conduct Authority, a relevant Local Authority, the Department of Transport and the Transport Commissioner.
Sharing personal information
We only ever use your personal data if we are satisfied that it is lawful and fair to do so. We will never sell your personal data or share it with third parties who might use it for their commercial purposes.
We will only disclose your personal information to third parties if:
- where you have given us consent to share the information with the specific third party;
- where information such as your email address is passed to Computer Network Consultants Ltd who provide technical support to us;
- where we use cloud software providers Sage 50 for our accounting records and Shaunsoft Community Transport Software to store information about our service users;
- where we use Dropbox Business to share information;
- if we are under a legal duty to disclose or share your personal information, for example, if required to do so by a court order or for prevention of fraud or other crime;
- to enforce any terms and conditions or agreements between us;
- as part of a sale of some or all of our business and assets to any third party or as part of any business restructuring or reorganisation (we will always notify you in advance, and we will aim to ensure that your privacy rights will continue to be protected); or
- To protect our rights, property and safety, or the rights, property and safety of others (this includes exchanging information with other companies, organisations, legal advisers and regulators for fraud protection and credit risk reduction).
- Where we are running an event and need to provide the venue with a list of those attending (we may also provide additional attendees with your contact details).
Data Security
We have appropriate security measures in place to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
- We hold data electronically in our secure Shaunsoft Community Transport Software booking system and on our on-site file servers, which are protected by both hardware and software firewalls.
- We have off-site backup servers in secure locations.
- We regularly back up all of the data we hold.
- We store papers in lockable cabinets in our offices when not being actively used, and we have a secure off-site storage facility for archived documents.
- When necessary, we dispose of or delete your data securely.
- We ensure that our employees, agents and contractors are aware of their privacy and data security obligations and we take reasonable steps to ensure that employees of third parties working on our behalf are aware of their privacy and data security obligations.
- We limit access to your personal information to those employees, agents, contractors and other third parties who need to know.
The transmission of information via the internet is never completely secure. Although we will do our best to protect your personal information, we cannot guarantee the security of your electronic information transmitted to us and any transmission is at your own risk.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
Transferring your personal information outside the EEA
We may transfer the personal information you give us to countries outside the European Economic Area (EEA), specifically when we use Mailchimp, Global Payments and HubSpot services.
If we transfer your information outside of the EEA in this way, and the country in question has not been deemed by the EU Commission to have adequate data protection laws, we will provide appropriate safeguards, and we will be responsible for ensuring your privacy rights continue to be protected as outlined in this notice. If you would like more information about the safeguards we put in place, please contact data@westway.org.uk
Data retention
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
Our default retention period for personal data is seven years from the date we receive the information unless otherwise specified by law. We keep children’s personal data for seven years from the date of their 18th birthday, and we hold personal data that may be required for safeguarding purposes for 35 years from the date of collection (as considered reasonable by High Court ruling 2015).
These retention periods may be extended or reduced if we deem it necessary, for example, to defend legal proceedings or if there is an on-going investigation relating to the information.
We review the personal data (and the categories of personal data) we regularly hold to ensure the data we are holding is still required and is accurate. If we discover that certain information we are holding is no longer necessary or accurate, we will take steps to correct or delete the data.
11. Your rights
Under certain circumstances, by law, you have the right to:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Ask us to correct any information that we hold about you, which is incorrect, incomplete or inaccurate.
- Ask us to erase your personal information from our files and systems where there is no good reason for us continuing to hold it.
- Object to us using your personal information to further our legitimate interests (or those of a third party) or where we are using your personal information for direct marketing purposes.
- Ask us to restrict or suspend the use of your personal information, for example, if you want us to establish its accuracy or our reasons for using it.
- Ask us to transfer your personal information to another person or organisation.
If you want to access, correct or request restriction or erasure of your personal information, or to object to us using your personal data, or request that we transfer a copy of your personal information to another party, please contact data@westway.org.uk or 020 8964 4928. We may ask you to put your request in writing to us.
If you have given your consent to us processing your personal information, you have the right to withdraw your consent at any time. To withdraw your consent, please contact data@westway.org.uk or 020 8964 4928. Once we have received notification that you have withdrawn your consent, we will no longer process your personal information and, subject to our retention policy, we will dispose of your data securely.
Queries and Complaints
Kathleen Lyons, the CEO, oversees compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact Kathleen:
- by email to Kathleen Lyons
- by post at 240 Acklam Road, London, W10 5YG
- by telephone on 020 8964 4928.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
Published: 02/04/2019 By Westway Community Transport.