Solent Transport Privacy Notice for Dynamic Demand Responsive Transit (DDRT) services App
Solent Transport represents a partnership between the councils of the Isle of Wight, Portsmouth and Southampton. On behalf of the partnership and Hampshire County Council, Solent Transport is delivering the Book a Journey app and website, built and delivered by Padam Mobility.
This Privacy Notice tells you about how Solent Transport collects and uses personal information.
Hampshire County Council, Portsmouth City Council, Southampton City Council and Isle of Wight Council (the Partners) are joint data controllers for the data processed by Solent Transport.
This Privacy Notice should also be read in conjunction with the Partners’ privacy policies, which can be found via the links below:
Why do we collect and use your personal data?
Personal data is collected to enable you to access the transport services provided through the Book a Journey app and website.
When you access, connect to, download, create an account for, or otherwise use the Book a Journey app or website, we will collect personal data about you. The personal data we collect will depend on the circumstances and the services you are using or requesting.
In this notice
- How we get your information
- What personal data we process and why
- Lawful basis for processing your personal data
- How long we keep your personal data
- Data sharing
- Do we use any data processors
- Your rights in relation to this processing
How we get your information
We get information about you from the following sources:
- Directly from you, through information you provide during the account creation process via the Book a Journey app, website, or telephone and through enquiries you make via the website
- From cookies, which provide us with information about your visit to the website and use of the app.
What personal data we process and why
The information we process about you will fall within the following categories and is required to enable the transport services to be provided to you via the Book a Journey app and website:
1. Management of your passenger account
Purposes
- Creation and management of your account
Personal Data Processed
- Name,
- First name,
- Email address,
- Telephone number,
- Date of birth,
- Favourite addresses (home, work…),
- Sessions,
- Activity on the Passenger Application
2. Management of your passenger account
Purposes
- Manage and validate your trip bookings
Personal Data Processed
- Departure address,
- Destination address,
- Trip Schedule,
- Mobility constraints (handicap, equipment…)
3. Driver Management
Purposes
- Manage Routes
Personal Data Processed
- Driver Name,
- Driver First name,
- Driver Email address,
- Geolocation of the tablet on board the driver’s vehicle
4. Support Management
Purposes
- Incident management and resolution
Personal Data Processed
- Name, first name and email address of the person submitting a ticket,
- Name, first name and email address of the driver concerned, if necessary
- Data relating to the route or routes concerned, if necessary
- Data relating to the passenger or passengers concerned, if necessary
5. Statistical Analysis
Purposes
- Produce statistical reports
Personal Data Processed
- History of completed trips
- Customers comments and ratings
6. From Cookies
Cookies and similar technologies are small text files that are stored on web browsers or devices by web pages, apps, online media or companies.
- Padam Mobility uses technologies for the purposes of exchanging information with service providers, authentication and remembering preferences and settings. Details of cookies used by Padam Mobility can be found here.
Lawful basis for processing your personal data
Depending on the service, we rely on the following lawful basis for processing your personal data under the UK GDPR:
- For the management of your passenger account
Article 6(1)(a) Consent – you have given us your consent to process.
2. For the management of trip bookings
Article 6(1)(f) Legitimate interests – the processing is necessary to enable you to access the app and to enable the delivery of a service in accordance with the app terms & conditions. It is also necessary to provide a functioning app and security as (e.g. adapting the app to the requirements of the user device). Information is also processed to allow the app to pursue the legitimate interest in optimising the app and ensuring the security of both the app and our IT systems.
3. For driver management
Article 6(1)(f) Legitimate interests – the processing is necessary to enable drivers to access the app and to enable the delivery of a service in accordance with the app terms & conditions.
4. For driver management
Article 6(1)(a) Consent – you have given us your consent to process your personal data in respect of any complaints or queries you have in relation to the administration of the app.
Article 6(1)(b) Contract – if you have any queries or concerns in relation to the trip or service received by the Community Transport Operator, it will be necessary for the CTO to process your personal data in order to resolve these as part of the contract you have in place with them.
5. For statistical analysis
Article 6(1)(f) Legitimate interests – the processing is necessary to enable Solent Transport to analyse trip and app usage data, in order to develop and app and service.
6. For cookies
Article 6(1)(a) Consent – you have given us your consent. For non-essential cookies you have control over whether these store your data when using the site.
Some cookies are necessary to enable core functionality, and these will be notified to you when you use the app.
How long we keep your personal data
We will not keep your personal data for longer than necessary. How long your personal data is retained for will depend on the lawful basis for which it was collected. Depending on that lawful basis we are not always able to comply with a ‘right to erasure’ request.
If you choose to delete your Book a Journey app account through the app or website, your account will be scheduled for deletion from the operational database, which may take a few days.
You should note that much of the data from the operational back-office data base will be transferred to an archived backup system and will be held for 3 years. Archived personal data will be kept especially secure, access is limited to specific members of staff and only accessed when there is a genuine need to access the information. This could be where we are required to; investigate a complaint or establish, exercise or defend legal claims, such as in the pursuit of unpaid bills.
Information processed for statistical analysis purposes will be held for the duration of the analysis project. At the end of the project all data will be anonymised.
If you choose to participate in any surveys, you will be redirected to the Privacy Policy of the organisation undertaking the survey which will detail how they manage personal data and how long it will be held for.
Retention Information of data used to deliver transport services via the FYT and SCiA Booking app
| Data Type | Data Processed | Purpose(s) | Retention Period | Disposal Method |
| Management of Passenger Accounts, Data Subjects: Passengers |
|
Creation and management of
Passenger’s accounts. |
3 years | Data is anonymised |
| Management of Trip Bookings, Data Subjects: Passenger |
|
Manage and validate Trip bookings by
Passengers. |
3 years | Data is anonymised |
| Driver Management, Data Subjects: Drivers |
|
Manage Routes | 3 years | Data is anonymised |
| Support Management, Data Subjects: Passengers (Drivers and Passengers), Employees of the client |
|
Incident Management and Resolution | 3 years | Data is anonymised |
| Statistical Analysis, Data Subjects, Users (Drivers and Passengers) |
|
Product statistical reports | 3 years |
Enquiries
Once an enquiry has been received by Solent Transport, it is forwarded to the relevant Partner to respond to and action. Customer Services are provided via Southampton City Council which is also the lead Partner for Information Governance.
The personal data will be held in line with the relevant Partner’s retention schedule, further details of which can be obtained from them directly.
Data Sharing
In order to respond to enquiries, it may be necessary for Solent Transport to share your personal data with the Partners.
To deliver the service requested by you through the app or website, it will be necessary for us to share your personal data with:
- Padam Mobility, the host provider of the app and website. The Privacy Policy of Padam Mobility can be found here.
- The Community Transport Operators who provide the transport services booked by you through the app and you should refer to the Privacy Policy of the individual Community Transport Operators for further information.
For the purposes of monitoring and evaluation, it may also be necessary to share your personal data and anonymised data with the Universities of Southampton and Portsmouth, Consultants and the Department for Transport.
In some circumstances, we may be legally obliged to share information with other organisations or agencies in order comply with applicable laws and regulations, for example sharing information with the police for crime prevention purposes.
Do we use any data processors?
Data processors are third parties who provide certain parts of our services for us.
The Partners have contracts in place with them and they process data in accordance with this Privacy Notice and they cannot use the data for any other purpose.
- Processors – Our current data processors for this service are listed below.
| Data Processor | Purpose | Privacy Notice |
| Padam Mobility | Padam Mobility is the developer and host provider of the app.
|
https://www.padam-mobility.com/en/mentions-legales |
| Community First | Community Transport operator providing the Pompey Link, Transport Connect on Demand Northern Test Valley, Connect Fareham and Gosport, and Connect Havant services. | Privacy and Cookies Policy – Community First |
A list of the sub-processors used by Padam Mobility can be found below, and these are bound by contractual obligations to ensure compliance with the Data Protection Act 2018 and GDPR obligations.
| Subcontractor | Related
Processing |
data | Data Transfer | Framework | |
| Amazon AWS | All (storing of data) | European Union | Contractual clause compliant with
GDPR, no further data processing. |
||
| Synalabs | All
management) |
(hosting | France | Contractual clause compliant with
GDPR, no further data processing. |
|
| Microsoft | Statistical Analysis | European Union | Contractual clause compliant with
GDPR, no storing of personal data. |
||
| Support Management (data attached to emails) | US | Use of the EU Standard Contractual Clauses, no mass processing of
personal data |
|||
| Freshworks | Support Management | European Area | Economic | Use of the EU Standard Contractual Clauses, no mass processing of
personal data |
|
| Wrike | Management of
Passengers’ and Drivers’ Accounts (during setup) |
European Area | Economic | Use of the EU Standard Contractual Clauses, no further data
processing. |
|
| Sentry (Functional Software) | Management of Passengers’ and Drivers’ Accounts and Trips’bookings | UE & US | Use of the EU Standard Contractual Clauses, no further data processing. | ||
Your rights in relation to this processing
As an individual you have certain rights regarding our processing of your personal data, including a right to lodge a complaint with the Information Commissioner’s Office as the relevant supervisory authority.
These rights include:
- The right of access – You have the right to obtain confirmation that your data is being processed, as well as access your personal information.
- The right to rectification – You have the right to have inaccurate personal data rectified, or completed if it is incomplete
- The right to erasure – You have the right to have all your data erased, also known as the ‘right to be forgotten.
- The right to restrict processing – You have the right to request the restriction or suppression of your personal data. This is not an absolute right and only applies in certain circumstances
- The right to object – You have the right to object to processing in some circumstances. The processing must stop unless there is legitimate grounds that override your rights, interests or freedoms, or the processing has been done in regards to a legal claim.
To exercise any of these other rights, please contact Solent Transport.
You will be able to amend information and rights of access in the App. You can also delete your account data from the App at any time.