DDRT Privacy Policy

Solent Transport Privacy Notice for Dynamic Demand Responsive Transit (DDRT) services App

Solent Transport represents a partnership between the councils of the Isle of Wight, Hampshire County, Portsmouth and Southampton. Solent Transport is delivering the DDRT services app, FYT and SCiA Booking, built and delivered by Padam Mobility.

This Privacy Notice tells you about how Solent Transport collects and uses personal information.

Hampshire County Council, Portsmouth City Council, Southampton City Council and Isle of Wight Council (the Partners) are joint data controllers for the data processed by Solent Transport.

This Privacy Notice should also be read in conjunction with the Partners’ privacy policies, which can be found via the links below:

Why do we collect and use your personal data?

Personal data is collected to enable you to access the transport services provided through the FYT and SCiA Booking app and website.

When you access, connect to, download, create an account for, make purchases within or otherwise use the FYT and SCiA Booking app or website, we will collect personal data about you.  The personal data we collect will depend on the circumstances and the services you are using or requesting.

In this notice

How we get your information

We get information about you from the following sources:

  • Directly from you, through information you provide during the account creation process via the FYT and SCiA Booking app, website, or telephone and through enquiries you make via the website
  • From cookies, which provide us with information about your visit to the website and use of the app.

What personal data we process and why

The information we process about you will fall within the following categories and is required to enable the transport services to be provided to you via the FYT and SCiA Booking app and website:

  1. Management of your passenger account

Purposes

  • Creation and management of your account

Personal Data Processed

  • Name,
  • First name,
  • Email address,
  • Telephone number,
  • Date of birth,
  • Favourite addresses (home, work…),
  • Sessions,
  • Activity on the Passenger Application
  1. Management of Trip bookings

Purposes

  • Manage and validate your trip bookings

Personal Data Processed

  • Departure address,
  • Destination address,
  • Trip Schedule,
  • Mobility constraints (handicap, equipment…)
  1. Driver Management

Purposes

  • Manage Routes

Personal Data Processed

  • Driver Name,
  • Driver First name,
  • Driver Email address,
  • Geolocation of the tablet on board the driver’s vehicle
  1. Support Management

Purposes

  • Incident management and resolution

Personal Data Processed

  • Name, first name and email address of the person submitting a ticket,
  • Name, first name and email address of the driver concerned, if necessary
  • Data relating to the route or routes concerned, if necessary
  • Data relating to the passenger or passengers concerned, if necessary
  1. Statistical analysis

Purposes

  • Produce statistical reports

Personal Data Processed

  • History of completed trips
  • Customers comments and ratings
  1. From cookies

Cookies and similar technologies are small text files that are stored on web browsers or devices by web pages, apps, online media or companies.

  • Padam Mobility use technologies for the purposes of exchanging information with service providers, authentication and remembering preferences and settings. Details of cookies used by Padam Mobility can be found here.

Lawful basis for processing your personal data

Depending on the service, we rely on the following lawful basis for processing your personal data under the UK GDPR:

  1. For the management of your passenger account

Article 6(1)(a) Consent – you have given us your consent to process.

  1. For the management of trip bookings

Article 6(1)(f) Legitimate interests – the processing is necessary to enable you to access the app and to enable the delivery of a service in accordance with the app terms & conditions. It is also necessary to provide a functioning app and security as (e.g. adapting the app to the requirements of the user device). Information is also processed to allow the app to pursue the legitimate interest in optimising the app and ensuring the security of both the app and our IT systems.

  1. For driver management

Article 6(1)(f) Legitimate interests – the processing is necessary to enable drivers to access the app and to enable the delivery of a service in accordance with the app terms & conditions.

  1. For support management

Article 6(1)(a) Consent – you have given us your consent to process your personal data in respect of any complaints or queries you have in relation to the administration of the app.

Article 6(1)(b) Contract – if you have any queries or concerns in relation to the trip or service received by the Community Transport Operator, it will be necessary for the CTO to process your personal data in order to resolve these as part of the contract you have in place with them.

  1. For statistical analysis

Article 6(1)(f) Legitimate interests – the processing is necessary to enable Solent Transport to analysis trip and app usage data, in order to develop and app and service.

  1. For cookies

Article 6(1)(a) Consent – you have given us your consent. For non-essential cookies you have control over whether these store your data when using the site.

Some cookies are necessary to enable core functionality, and these will be notified to you when you use the app.

How long we keep your personal data

We will not keep your personal data for longer than necessary. How long your personal data is retained for will depend on the lawful basis for which it was collected. Depending on that lawful basis we are not always able to comply with a ‘right to erasure’ request.

If you choose to delete your FYT and SCiA Booking app account through the app or website, your account will be scheduled for deletion from the operational data base, which may take a few days.  Once the data has been deleted you will receive an email confirming the deletion.

You should note that much of the data from the operational back-office data base will be transferred to an archived backup system and will be held for 3 years. Archived personal data will be kept especially secure, access is limited to specific members of staff and only accessed when there is a genuine need to access the information. This could be where we are required to; investigate a complaint or establish, exercise or defend legal claims, such as in the pursuit of unpaid bills.

Information processed for statistical analysis purposes will be held for the duration of the analysis project.  At the end of the project all data will be anonymised.

If you choose to participate in any surveys, you will be redirected to the Privacy Policy of the organisation undertaking the survey which will detail how they manage personal data and how long it will be held for.

Retention Information of data used to deliver transport services via the FYT and SCiA Booking app

Data Type Data Processed Purpose(s) Retention Period Disposal Method
Management of Passenger Accounts, Data Subjects: Passengers
  • Name,
  • First name,
  • Email address,
  • Telephone number,
  • Date of birth,
  • Favorite addresses (home, work…),
  • Sessions,
  • Activity on the Passenger
Creation and management of

Passenger’s accounts.

3 years Data is anonymised
Management of Trip Bookings, Data Subjects: Passenger
  • Departure address,
  • Destination address,
  • Trip Schedule,
  • Mobility constraints (handicap,equipment…)
Manage and validate Trip bookings by

Passengers.

3 years Data is anonymised
Driver Management, Data Subjects: Drivers
  • Name
  • First name
  • Email address
  • Geolocation of the tablet on board the Driver’s vehicle
Manage Routes 3 years Data is anonymised
Support Management, Data Subjects: Passengers (Drivers and Passengers), Employees of the client
  • Name, first name and email address of
  • the person submitting a ticket,
  • Name, first name and email address of the Chauffeur concerned if necessary,
  • Data relating to the Route or Route concerned if necessary,
  • Data relating to the Passenger or
  • Passengers concerned if necessary,
Incident Management and Resolution 3 years Data is anonymised
Statistical Analysis, Data Subjects, Users (Drivers and Passengers)
  • History of completed trips
  • Customer comments and ratings
Product statistical reports 3 years Data is anonymised

Enquiries

Once an enquiry has been received by Solent Transport, it is forwarded to the relevant Partner to respond to and action. Customer Services are provided via Southampton City Council who is also the lead Partner for Information Governance.

The personal data will be held in line with the relevant Partner’s retention schedule, further details of which can be obtained from them directly.

Data Sharing

In order to respond to enquiries, it may be necessary for Solent Transport to share your personal data with the Partners.

To deliver the service requested by you through the app or website, it will be necessary for us to share your personal data with:

  • Padam Mobility, the host provider of the app and website. The Privacy Policy of Padam Mobility can be found here.
  • The Community Transport Operators who provide the transport services purchased by you through the app and you should refer to the Privacy Policy of the individual Mobility Service Providers for further information (see “Do we use any data processors”, below).

For the purposes of monitoring and evaluation, it may also be necessary to share your personal data and anonymised data with the Universities of Southampton and Portsmouth, Solent Transport Consultants  and the Department for Transport.

In some circumstances, we may be legally obliged to share information with other organisations or agencies in order comply with applicable laws and regulations, for example sharing information with the police for crime prevention purposes.

Do we use any data processors?

Data processors are third parties who provide certain parts of our services for us.

The Partners have contracts in place with them and they process data in accordance with this Privacy Notice and they cannot use the data for any other purpose.

  • Processors – Our current data processors for this service are listed below.
Data Processor Purpose Privacy Notice
Padam Mobility Padam Mobility is the developer and host provider of the app.

 

https://www.padam-mobility.com/en/mentions-legales

 

SCiA Dial-a-Ride SCiA Dial-a-Ride is a Community Transport who provide transport services purchased by you through the app https://sciagroup.co.uk/privacy-policy/

 

FYT Bus – Route E FYT Bus  is a Community Transport who provide transport services purchased by you through the app https://www.fytbus.org.uk/privacy-and-cookie-policy/

 

A list of the sub-processors used by Padam Mobility can be found below, and these are bound by contractual obligations to ensure compliance with the Data Protection Act 2018 and GDPR obligations.

Subcontractor Related data processing Data Transfer Framework
Amazon AWS All (storing of data) European Union Contractual clause compliant with GDPR, no further data processing.
Synalabs All (hosting management ) France Contractual clause compliant with GDPR, no further data processing.
Microsoft Statistical Analysis European Union Contractual clause compliant with GDPR, no storing of personal data.
Google Support Management (data attached to emails) US Use of the EU Standard Contractual Clauses, no mass processing of personal data
Freshworks Support Management European Economic area Use of the EU Standard Contractual Clauses, no mass processing of personal data
Wrike Management of Passengers’ and Drivers’ Accounts (during setup) European Economic area Use of the EU Standard Contractual Clauses, no further data processing
Sentry (Functional Software) Management of  Passengers’ and Drivers’ Accounts and  Trips’ bookings EU & US Use of the EU Standard Contractual Clauses, no further data processing.

 

Your rights in relation to this processing

As an individual you have certain rights regarding our processing of your personal data, including a right to lodge a complaint with the Information Commissioner’s Office as the relevant supervisory authority.

These rights include:

  • The right of access – You have the right to obtain confirmation that your data is being processed, as well as access your personal information.
  • The right to rectification – You have the right to have inaccurate personal data rectified, or completed if it is incomplete
  • The right to erasure – You have the right to have all your data erased, also known as the ‘right to be forgotten.
  • The right to restrict processing – You have the right to request the restriction or suppression of your personal data. This is not an absolute right and only applies in certain circumstances
  • The right to object – You have the right to object to processing in some circumstances. The processing must stop unless there is legitimate grounds that override your rights, interests or freedoms, or the processing has been done in regards to a legal claim

To exercise any of these other rights, please contact Solent Transport.

You will be able to amend information and rights of access in the App.  You can also delete your account data from the App at any time.