FlexiLink: privacy notice

Demand Responsive Transport Service (DRT) - go-too/FlexiLink

What personal information is being processed and what for

Cheshire East Council processes the following personal data to provide the DRT service: 

• Your name, telephone number and email address are associated with your rider account.
• Your telephone number is used to provide journey updates, both through text and push messaging.  This number may also be used if the customer service team need to contact you.  
• Your email address is used to send booking receipts.
• We use your telephone number and/or email address to prove your identity when making a telephone booking or handling any enquiry on your account.
• We may use your telephone / email to contact you with information relevant to the DRT Bus Service, such as service updates, events information, etc.
• Your credit or debit card are used to pay for journeys made on the bus service.  The details are held securely and are not available to Cheshire East Council.
• Journey data is collected, detailing dates, times, pick-up and drop-off locations.  These provide an audit and payment trail and assist with future bookings.  Frequent origins and destinations are pre-populated in the booking app to assist with future bookings.
• Data is retained in our system (provided by Via Technologies) but is automatically anonymised after 3-years.
• Age is required to confirm eligibility where a rider requests an under -16 fare.

In addition to above, we may also process the following special category data, but only where this is necessary to provide the service:

• Details of relevant disabilities to enable criteria matching to prove eligibility for door-to-door service (where requested).

Why are we allowed to use your information

We process your information so the Council can carry out its statutory transport functions as a local authority. Our duties to provide, manage, and improve local transport services are set out in law, including the Transport Act 2000 and the Bus Services Act 2017.

The lawful basis we rely on to process your personal data is Article 6(1)(e) of the UK GDPR, which allows us to process personal data where this is necessary to perform our official duties and tasks in the public interest.

Where we process special category data, such as health or disability information, we rely on Article 9(2)(g) of the UK GDPR. This allows processing where it is necessary for reasons of substantial public interest. We also rely on Schedule 1, Part 2, Paragraph 6 of the Data Protection Act 2018, which relates to statutory and government purposes.

Who we will share your information with

Your information will be accessible by staff of Cheshire East Council involved in administering the DRT bus service.  

Via Technologies provide and support the software used to operate the service. Via Technologies act as our data processor and will only process your information on the Council’s instructions, for specific purposes related to operating the service, and must keep your information secure and confidential in line with data protection law.

Where we get your information from

We collect information provided by you when making an application for a Rider Account either on the App, telephone booking line or application form.

We may cross reference some information held by Cheshire East Council simply to confirm eligibility for specific fare types such as the ‘Bus Saver’, or the Concessionary Travel records for eligibility for the ENCTS (English National Concessionary Travel Scheme).

How long we will keep your personal information

We will keep your information for as long as you hold an active account with the DRT bus service. If your account is inactive and you do not use the service, your personal data will be retained for up to three years, after which it will be anonymised.

How your information is stored

Your information will be securely stored in a third-party web application called ‘Via Operations Centre’ (VOC), provided by Via Technologies.  Personal data is principally hosted within the European Economic Area (EEA). Where personal data is processed outside the UK or EEA, Via Technologies ensures that appropriate legal safeguards are in place.

Access to the system is strictly controlled. Each user has their own login and password to access the system, and access is limited to staff who need it to carry out their role.

What happens if you don't provide us with your information

You won’t be able to apply for a DRT bus service account unless you provide this information and therefore will not be able to use the service.

You can choose to have your account deleted and all information anonymised at any time, as confirmed below.

Will your information be used to make automated decisions

No.

Your rights

You have a number of rights regarding your personal data, including withdrawing your consent where we have asked for it. You can also ask for a copy of the information we hold about you and ask us to correct anything that is wrong. For detailed information about your rights please see our Privacy notice (cheshireeast.gov.uk) Privacy Notice (cheshireast.gov.uk)