Last updated 30th May 2018
This policy explains how Nottingham Community Transport Ltd and CT4N Ltd collect, manage, use and protect your personal data. Put simply, we will not store any of your personal data unless you explicitly give it to us and understand that we are storing it.
1. Who we are
In this policy ‘we’ or ‘us’ refers to Nottingham Community Transport Limited and CT4N Limited.
Nottingham Community Transport Ltd was registered in 1979 and has been providing transport solutions to groups and individuals in Nottinghamshire ever since. It is a not for profit and registered charity (700463).
CT4N was registered in January 2018 as our operating arm. CT4N currently runs the link bus network under contract to Nottingham City Council and Nottinghamshire County Council.
2. What we collect
We collect basic personal data about you like your name, postal address, telephone number and email address. This might be to register you as a member with us or keep in touch about your bookings. If we want to use this information to send you marketing or communications, we’ll ask you first.
Sometimes we will collect other information about you such as your date of birth, travel needs or mobility issues; this is to help us with processing your booking, improving our service or collating information for anonymous reporting to funders or partners. We’ll be really clear when we’re asking for this information. You don’t have to disclose any of this information to visit our website or use the link bus network, but we may not be able to provide you with certain services without it.
Marketing and communications
We want to keep in touch with people interested in our services. With your consent, we will store your personal data to provide you with information, updates and promotions about us.
If you’ve provided your details to us for another reason, and have asked not to be contacted with marketing and communications, we’ll store your details with an explicit reference not to contact you in this way.
3. How we collect your information
We collect your personal information in a number of ways:
- When you provide it to us directly, e.g. through an online form, via email or over the phone
- When you provide permission to other organisations to share it with us (including Facebook or Twitter)
- When we collect it as you use our websites or apps
- When you have given it to a third party and you have provided permission to pass your information on to us
- From publicly available sources
Occasionally, we may pay for contact details. Before we purchase contact information, we’ll check the wording used when your information was originally collected, to make sure that we only contact people who have actively expressed an interest in receiving information from third parties.
When you give permission for organisations to share your data, you should check their privacy policies to understand how they will process your data.
4. Online forms
We use online forms to process bookings, enquiries and e-communication subscribers. When you submit your information to us through a form on our website you are consenting to us storing your information for these purposes. The details you provide are sent to us securely. They are not stored on the website.
5. Sharing your information with third parties
We will never sell or rent your personal information to other organisations.
We might share relevant parts of your information with agents and contractors approved by us in the following circumstances:
- When we use other companies to provide services on our behalf, e.g. processing, web design, graphic design, mailing or delivering orders, answering customers’ questions about products or services, sending mail and emails, customer analysis, assessment and profiling, when using auditors/advisors or processing credit/debit card payments.
- If we receive a complaint about any content you have posted or transmitted to or from one of our sites
- If we run an event in partnership with other named organisations. We will be very clear what will happen to your data when you register
- If we merge with another organisation to form a new entity
- We may share statistics about our site visitors, supporters, customers and sales to describe our services and operations to prospective partners, advertisers and other reputable organisations but these statistics won’t include any personally identifying information
- We disclose information to third parties or individuals when obliged to by law, for purposes of national security, taxation and criminal investigations and for other lawful purposes.
- We disclose information to safeguarding boards in cases where a safeguarding concern or alert is required, in line with safeguarding legislation
A lot of the personal data we obtain is processed by our staff in the UK. However, for the purposes of IT hosting and maintenance, some file exchange and storage, and email marketing, your information may be situated outside of the European Economic Area (EEA). This will be done in accordance with guidance issued by the Information Commissioner’s Office. For third parties which we currently use and who store your data outside of the EEA, details are provided below.
The Rocket Science group
As well as standard internal email procedures, we use a third party provider, The Rocket Science group (using MailChimp), to deliver e-communications. MailChimp is a marketing automation platform and email marketing service. For more information, please see the mailchimp privacy notice.
We may use Mailmunch to store the data of subscribers to our e-communications. For more information, please see the mailmunch privacy notice.
We carry out some of our work on Google drive. Information inputted on Google drive is stored in secure data centres.
Cookies and Google Analytics information is covered in point 8.
We will keep you informed of any other services, systems or data management providers like the above that we might use in the future.
6. Legitimate interests
There are a number of lawful reasons that mean we can use (or ‘process’) your personal information. One lawful reason is something called ‘legitimate interests’. Broadly speaking Legitimate Interests means we can process your personal information if:
We have a genuine and legitimate reason.
We are not harming any of your rights and interests.
7. Retaining your information
If you decide to unsubscribe from communications with us, or you stop using our services, we will keep some basic information to avoid duplication and so that we stop sending you unwanted communications.
8. Cookies and Google Analytics
You can choose to disable cookies through your browser and you can opt out of being tracked by Google Analytics across all websites at http://tools.google.com/dlpage/gaoptout.
9. Emails sent to us
Any email sent to us, including any attachments, may be monitored and used by us.
Email monitoring or blocking software may also be used. Of course, you have a responsibility to ensure that any email you send to us is within the bounds of the law.
10. How to contact us
You can find out if we hold any of your personal information, make changes to information we hold, or ask for your data to be deleted. This must be done in writing and addressed to:
Data Protection Officer
Nottingham Community Transport
Sherwood Bus Garage
Once this has been done, we have one calendar month to deliver this information to you.
Last updated 30th May 2018