Linkup bus privacy notice
Welcome to Lichfield District Council’s privacy notice in respect of LinkUp bus (on demand transport project) processed by Lichfield District Council.
This privacy notice supplements the information the council currently makes available about how the organisation meets core data protection obligations.
Our commitments and are set out in our main privacy notice.
We respect your privacy and are committed to protecting your personal data.
This privacy notice explains what types of personal information we collect about you, what we do with that personal information and the legal basis for our processing of your personal information. It also explains how we keep your personal information safe and secure. We take our data protection obligations very seriously and this notice gives you information about our approach to data protection legislation (UK General Data Protection Regulation, Data Protection Act 2018 and any subsequent updated legislation).
Lichfield District Council is also the data controller for your information.
The type of personal information we collect
We currently collect and process the following information:
- Personal identifiers, includes first name, last name, title, age, profile picture
- Contact information, includes email address, telephone number, postcode
- Financial data, includes payment card details.
- Transaction data, includes details about payments from you and details of other services you have purchased from us.
- Device data, we may collect data about the devices and browser type, browser language, screen resolution, the URL you entered and any relevant referring page as well as information about the mobile devices you use to access the App (including hardware model, version, unique device identifiers, operating system, battery level and charging status and screen size).
- Profile data, includes your rider ID and password, bookings made by you, your interests, preferences, feedback and survey responses.
- Usage data, includes information about how you use the service, including your user account transactions and automatically collected data log. Usage data may include, but is not limited to, information about when and how you downloaded the App or created your user account, your access and user activity, your preferences, details about any transportation or delivery services you request or participate in through the service, your transactions, the specific components of the App or Website, or any other aspect of the solution you visit or use, along with details about your views or use of these components, any alerts or communications we send you in connection with your use of the services, and any errors that may have occurred during you use of the services.
- Marketing and communications data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
- Location data includes your current location data (including GPs and Wi-Fi data) from your mobile device (when the application is open and on screen). We may also collect location data in the background (when the application is open but not on screen) if you authorise us to do so through your mobile phone.
We may also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific App feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.
We will collect health data including information related to your mobility and disability status to enable us to provide assisted travel and ensure you receive the correct pricing and any information detailed within any accident reports that relates to personal injury or medical attention.
We do not knowingly collect any other special category of personal data (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic and biometric data). Nor do we knowingly collect any data about criminal convictions or offences.
Where we need to collect personal data by law, or under the terms of a contract to provide this service, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a booking you have but we will notify you if this is the case at the time.
How we get the personal information and why we have it
Most of the personal information we process is provided to us by you through our partners Spare and WeMove so that we can monitor use of the service.
We use the information that you have given us in order to carry out the service you have requested
Under the UK General Data Protection Regulation (UK GDPR), the lawful bases we rely on for processing this information are:
- Your consent. You are able to remove your consent at any time. You can do this by contacting dpo@lichfielddc.gov.uk
- We have a contractual obligation.
How we store your personal information
We keep the information you provide for 12 months. We will then dispose of your information by deleting it from our systems.
Data may also be held in the cloud by UiPath during automated processing and auto deleted from there after 24 hrs.
Third parties
Our website contains links to and from the websites of our partner networks and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies or content. Please check their policies before you submit any personal data to their websites.
Some of our external third party service providers are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK. When transferring your personal information across borders, we ensure compliance with all applicable legal requirements. Where appropriate, we rely on adequacy decisions or standard contractual clauses and appropriate additional safeguards.
Your data protection rights
The lawful basis for processing can affect which rights are available to individuals as outlined in the table within the overarching privacy statement. Under data protection law, you have the following rights
- Your right of access - You have the right to ask us for copies of your personal information.
- Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability - You have the right to ask that we transfer the personal information you give us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at dpo@lichfielddc.gov.uk if you wish to make a request.
How to complain
Information on how to raise concerns about our use of your personal information is available in the overarching privacy notice.