Skip to main content

Transportation Privacy Notice

Privacy notice relating to the processing of personal data by Rhondda Cynon Taf County Borough Council for the purpose of Transportation purposes

Introduction

This privacy notice is intended to provide information about how Rhondda Cynon Taf County Borough Council (referred to as ‘RCTCBC’, ‘Council’, ‘Local Authority’, ‘we’) will use (or ‘process’) personal data about individuals for the purpose of Home to School Transport.

This notice should be read in conjunction with;

The Data Controller

The Council is the data controller for the personal data processed for the purposes of transportation.

The Council is registered with the Information Commissioner’s Office (ICO) as a controller under reference Z4870100.

Queries relating to this privacy notice

If you have any questions or queries relating to this privacy notice please contact the Home to School Transport department;

By email : hometoschooltransport@rctcbc.gov.uk or transportationservices@rctcbc.gov.uk

By telephone : 01443 425001

In writing : Tŷ Glantaf, Unit B23, Taffs Fall Road, Treforest Industrial Estate, Pontypridd, CF37 5TT

 

Who we are what we do

The Integrated Transport Unit provides transport services in the following ways:

  • Community Transport – A door to door service, specifically designed for people who find it difficult to get on/or off ordinary public transport.
  • Provide free home to school/college transport for learners of compulsory age if they reside beyond safe walking distance to their school/college, including additional learning needs (ALN) transport.
  • Provide a discretionary transport service to 16 – 19-year-old learners attending school. College or training.
  • Concessionary bus travel for elderly and disabled residents (see Concessionary Bus Travel Privacy Notice here.)
  • Road safety education and training.

Whose personal data we process

  • We may process personal data relating to the following individuals to provide transport services;

    • School children and their parents/carers or guardians
    • College students and their parents/carers or guardians
    • Service users
    • Employees of transport providers

The categories of personal data we process

We may process the following categories of personal data to provide transport services

    • Contact details such as name, address, telephone number and email address.
    • Identfying information such as D.O.B and National Insurance Number
    • Information in relation to any special needs or our service users to enable us to provide safe and suitable transport.
    • School, college or community establishment to which transport is provided.
    • For drivers and passenger assistants, DBS check information such as driving licence, passport, proof of address and DBS certificate number.
    • CCTV Footage
    • Financial Information

Why we process the personal data

We process the personal data to provide transport services, This may include but is not limited to the following activities;

  • Arrange door to door community care transport.
  • Assess school, college, or training bus applications against eligibility criteria.
  • Issue Bus Passes / season tickets
  • Arrange appropriate transport contractors to ensure service users and young people are collected and taken to the correct establishments.
  • Complete DBS checks on contractors.
  • Arrange appropriate travel arrangements for learners with ALN.
  • Create ID badges for authorised drivers and passenger assistants.
  • Capture CCTV images on all buses.  Images will only be accessed where necessary for example if there was an incident on the bus
  • Provide travel training to suitable students, particularly those with ALN.

Our lawful basis for processing the personal data

Under the General Data Protection Regulation (GDPR), our lawful basis for processing the personal data for transport services are:

  • Legal Obligation - Article 6 (c) – processing is necessary for compliance with a legal obligation to which the controller is subject. 
  • Public Task - Article 6 (e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
  • Contract  – Article 6(b) – Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Substantial public interest - Article 9 (2) (g) - processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
  • Article 10 authorised by Data Protection Act 2018 Schedule 1, Part 1 , Part 2(6) – Statutory and Government purposes.

The primary legislation, regulations and guidance that supports this includes, but is not limited to;

Learner Travel (Wales) Measure 2008

http://www.legislation.gov.uk/mwa/2008/2/pdfs/mwa_20080002_en.pdf

Transport Act 2000

http://www.legislation.gov.uk/ukpga/2000/38/pdfs/ukpga_20000038_en.pdf

Mandatory Travel Concessions (Reimbursement Arrangements) (Wales) Regulations 2001

http://www.legislation.gov.uk/wsi/2001/3764/pdfs/wsi_20013764_mi.pdf

Who or where we get the personal data from

We may receive the personal data from the following categories of individuals or organisations;

  • Directly from you when completing transport applications.
  • From transport providers to undertake DBS Checks
  • From schools, colleges and community care establishments

Some buses also have CCTV installed as part of their contract requirements. (Where CCTV is installed, there is appropriate signage on the bus to notify passengers).

  • The Disclosure and Barring Service, who complete the necessary background checks on our contractors.

Who we share personal data with

We may share the personal data with the following key organisations for transport purposes:

When sharing the personal data, we only share the minimum amount necessary in relation to the purpose.

Who

Purpose

Business Support Unit

To create Bus passes for secondary pupils and  to create ID badges for our drivers and passenger assistants.

Finance Department

To issue payments

Safeguarding

For any safeguarding issues

RCT Schools, Colleges and Community Care Establishments

To arrange transport provisions

Bus Contractors

To Print Relevant Bus Passes and provide to students.

To ensure the correct transport is required.

Data Barring Service

To complete DBS checks on contractors

Data Processors

A data processor is a company or organisation that processes personal data on our behalf. Our data processors act only upon our instruction. They cannot do anything with the personal data unless we instruct them to do so. They will not share the personal data with any organisation apart from us or use it for their own purposes. They will hold it securely and retain it for the period we instruct.

The categories of data processors we use for the purpose of transport services is/are;

  • IT Systems

How long we retain the personal data

We retain the personal data contained within transport records for:

Length of time

Reason

transport applications - 1 year

Business Decision

 

Transport Application Financial Information – 7 years

In line with financial requirements.

Contractor DBS Checks – 6 months

To comply with DBS code of practice

CCTV Images - 30 days – non evidential footage

If footage is subject to an investigation, it may be retained longer for this purpose.

Statutory Requirement

 

In keeping with the General Data Protection Regulation storage limitation principle, records are periodically reviewed. Not all personal data is retained. Only personal data that is relevant to the record is retained for the entire retention period. Information that has no long term or evidential value is routinely destroyed in the normal course of business. 

Your data protection rights

The General Data Protection Regulation (GDPR) gives individuals important rights, including the right of access to the personal data that the Council holds about you.

Click here or further information on your information rights and how to exercise them. 

Your right to make a data protection complaint to the Council

You have the right to complain to the Council if you believe we have not handled your personal data responsibly and in line with good practice.

You can do this by contacting the Transport Unit directly via one of the following communication methods. Most concerns can be resolved relatively quickly through a simple phone call or email;

By email : hometoschooltransport@rctcbc.gov.uk or transportationservices@rctcbc.gov.uk

By telephone : 01443 425001

In writing : Tŷ Glantaf, Unit B23, Taffs Fall Road, Treforest Industrial Estate, Pontypridd, CF37 5TT

Alternatively, you can raise a formal complaint via the Council’s Customer Feedback Scheme using the following link (Make a comment, compliment or complaint online) or you can contact the Council’s Data Protection Officer at Information.management@rctcbc.gov.uk.

Your right to make a data protection complaint to the ICO

You also have the right to complain to the ICO if you are unhappy with how we have used your data. However, we encourage you to contact us first and provide us with an opportunity to look into your concern and put things right.

The ICO can be contacted:            

  • Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  • Helpline number: 0303 123 1113
  • Website: https://www.ico.org.uk