Privacy Notice

Last updated: 12 January 2022 

ICO Registration Number: ZB272644 

On this page you will find our current privacy policy. This notice is available as audio or in British Sign Language (BSL). We also have produced an EasyRead guide explaining what our Privacy Notice is.

If you would like to request a hard copy be sent to you in the post, please email office@transportforall.org.uk or call 020 7737 2339.

In this privacy notice

Introduction

Transport for All is a charity (1063733) and non-for-profit company limited by guarantee (03337948) based in the UK with registered offices at 336 Brixton Rd, London, SW9 7AA. We operate as a membership organisation, guided by our shared belief that all disabled and older people have the right to travel with freedom and independence. 

For the purposes of data protection legislation, where Transport for All is processing your information, including in relation to our campaigns and policy work or your membership, it is a controller of your personal data.  

Providing us with personal data is purely consensual. You are not obligated under any laws to provide us with any personal data, but without providing such personal data, we cannot provide you with our services.  

What do we mean by personal data? Also known as personal information or personally identifiable information, personal data is any information related to an identifiable person. For example, email address, name, date of birth etc. 

What do we mean by consent? It means that you don’t have to share data, but without sharing it, we cannot provide you with our services. 

This notice applies to personal information we collect about you when you interact with us, for example when you use our websites such as www.transportforall.org.uk, or that we collect from third parties, as described in this privacy notice. It sets out: 

  • what information we collect, and from whom;
  • how we use that information; 
  • how long we keep your information; 
  • who we share your information with; 
  • how your information is protected; 
  • your rights in relation to the information we hold about you. 

 

We keep our privacy notice under regular review, and we encourage you to periodically review this page for the latest information on our privacy practices. Any material changes will be notified to you by updating them on our websites, together with any such other methods as may be appropriate. 

1. How and when does Transport for All collect data from me?

Information you provide to us voluntarily 

You may give us your personal information when you: 

  • opt-in to receive email, postal or telephone communications from us; 
  • use, or provide a comment on our websites; 
  • correspond with or contact us; 
  • interact with us on social media platforms; 
  • sign up to one of our newsletters or other communications; 
  • become a member; 
  • use our helpline and casework services; 
  • participate in our workshops, research, or focus groups; 
  • make a donation to us; or  
  • otherwise interact with us or provide information to a third party to be referred to us.   

 

Where we request information from you, we will collect the information set out in the relevant forms or pages, or as explained to you over the telephone. You may choose to provide additional information to us when you contact us or otherwise interact with us or provide information to a third party to be referred to us.  

 

Information we collect automatically 

We also receive personal information indirectly, for example if you contact us by phone or email we may add a note to your file to explain the reason you contacted us.  

We, or the companies which work on our behalf, collect data related to visitors to our websites automatically, including what pages you have viewed, what devices you used to view pages, for how long and your website journey.   

Information is also collected about how you arrived at our websites in the first place, including what links or adverts of ours you have viewed or clicked on to reach us, or any search terms you have used. Information collected automatically using cookies or other tracking technologies includes your IP address. 

 

Information which is available publicly 

Your personal information may be available to us from external publicly available sources: for example, geo-demographic information and information from public registers such as listed directorships, information from the electoral roll and press reports. In addition, depending on your privacy settings for social media services, we may access information from those accounts or services. 

2. What types of personal information does Transport for All process?

We collect, store and use the following types of information: 

  • your name, email address, postal address, phone number, location, age range, impairment category, social media identity; 
  • details relating to your helpline enquiry including medical, health and benefits related information if you provide this to us; 
  • financial information, such as bank account number, where required to process expenses; 
  • details about your membership; 
  • correspondence you have had with us; 
  • audio, images, videos and photographs of you, with your consent; 
  • your contribution to any research you take part in; 
  • information about your computer/mobile device and your visits to and use of our websites, including for example your IP address; 
  • details about you that are stored in documents in different formats, or copies of them; and 
  • any other information shared with us as described in section 1 above. 

 

Special category data 

Some of the information we collect about you is classified under GDPR as ‘special category data’ which requires an extra level of protection. This includes impairment and health data. Your impairment category and details on the mobility aids you use are stored securely in our CRM system (Nutshell).  

We collect health and benefits information, for example PIP assessment letters or GP letters about your diagnosis, where we have explicit permission from you to do so when you need us to process this as part of your case. In these circumstances, we password-protect these documents, store them on our secure shared drive under a unique ID number, and only the person handling your case will have access to them. We store these letters for 7 years, after which they will be destroyed. 

3. What does Transport for All use my personal information for, and on what legal basis?

The following sections describe in more detail how Transport for All may use your information, and in particular the legal grounds on which we rely in doing so.   

What we use your personal information for 

We use the information collected for a number of purposes, including: 

  • to verify your membership; 
  • to make and manage payments; 
  • to manage our relationship and communicate with you; 
  • to respond to complaints and seek to resolve them; 
  • to enhance your online experience; 
  • to conduct research and surveys; 
  • to better understand our members and supporters in general; 
  • to inform our policy influencing work; 
  • to research members’ and supporters’ views and experiences for research and editorial purposes, including through requests for help and surveys; 
  • to respond to individual experiences shared with us and for editorial content; 
  • to understand your website journey, including what pages you have viewed and for how long;  
  • to improve the effectiveness our campaigns; 
  • to administer and keep safe and secure our websites and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes; 
  • to respond to helpline enquiries you contact us with; 
  • If you use our casework services, to contact you about information relating to your case; 
  • to train our staff and measure the quality of the service we give you; and 
  • to obey laws and regulations that apply to us. 

 

The legal grounds we rely on to process your information 

The legal grounds on which we rely are: 

  • to fulfil our contractual obligations (for example in order to provide services requested by members and to contact you if a problem arises with them); 
  • to pursue our legitimate interests (for example to facilitate your use of our websites, or for marketing); 
  • your consent; and / or 
  • to fulfil a legal duty.  

 

Legitimate interests 

When we rely on our legitimate interests, these are as follows: 

  • keeping our records up to date; 
  • administering membership; 
  • developing our membership offer; 
  • marketing our products and services; 
  • administering our websites and keeping them safe and secure; 
  • ensuring that content is presented in the most effective manner for you and your devices; 
  • facilitating your use of our websites; 
  • measuring the use of our websites and improving their content and accessibility; 
  • measuring and understanding the effectiveness of advertising, and delivering relevant advertising to you; 
  • tailoring content and our communications so that they are most relevant to you; 
  • carrying out campaigns work and developing Transport for All’s policy and campaigns; 
  • complying with legal and/or regulatory requirements; 
  • identifying trends in member and supporter behaviour; 
  • informing and generating content. 

4. Who does Transport for All share my personal information with?

Data processors 

To help us fulfil contracts and to pursue our legitimate interests, we share your personal information with third parties who provide services to Transport for All or who act on our behalf, for instance vendors, IT and other suppliers, research agencies, payment processors, financial institutions, or postal authorities that are involved in fulfilling your request.  We do not authorise these companies to use or disclose your personal information except for the purpose of providing the service we request of them. Transport for All is based in the UK, but some third-party data processors will be based outside of the European Economic Area (EEA). 

 

Nutshell 

We use the CRM (Customer Relationship Management) software Nutshell to process and manage our contacts. Their Privacy Policy can be found here: https://www.nutshell.com/support/privacy if you want to know more about how they adhere to GDPR rules please read these pages: https://support.nutshell.com/hc/en-us/articles/360004489793-GDPR-and-Nutshell 

Ring Central 

We use Ring Central for our phone and messaging services. You can find their privacy policy here: https://www.ringcentral.co.uk/legal/last-update-March-3-2021/privacy-notice.html 

Jotform 

We use Jotform for various forms and services, including research, they store data in third party platforms such as Google Drive and AWS systems. You can find their privacy policy here: https://www.jotform.com/privacy/ 

Zapier 

We use Zapier to manage our administration processes and applications, for more information on their use of personal data please read their privacy policy here:  https://zapier.com/privacy 

Stripe 

We use Stripe to process one-off donations and recurring payments. More information on how Stripe processes your personal data and your data protection rights, including your right to object, is available here: https://stripe.com/gb/privacy 

Xero 

We use Xero to manage financial administration. More information on how Xero processes your personal data and your data protection rights, including your right to object, is available here: https://www.xero.com/uk/about/legal/privacy/  

Zoom 

We use Zoom to run events and meetings. More information on how Zoom processes your personal data and your data protection rights, including your right to object, is available here: https://explore.zoom.us/en/privacy/  

WordPress 

We use WordPress as our main platform for our website, WordPress is managed by Automattic as are many of their plugins and systems. Their Privacy Policy can be found here: https://automattic.com/privacy/   

Website host 

We host our website and backups with Heart Internet Limited. Backups are retained for 30 days. You can access their privacy centre webpage at https://www.heartinternet.uk/privacy-centre  

Otter 

We use otter to record transcripts of interviews.  The privacy policy is here: https://blog.otter.ai/privacy-policy/  

Google Forms and Google Drive 

We use Google Forms to conduct research, submissions are processed via Google Drive. The privacy policy is here: https://policies.google.com/  

Office 

We use Microsoft 365 for our administration and digital storage. Microsoft’s Privacy policy can be found at https://privacy.microsoft.com/en-gb/privacystatement. This data is stored on UK based secured Servers. 

Google Analytics 

Google Analytics is a web analysis service provided by Google Inc. (“Google”). Google utilises the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the Data collected to contextualise and personalise the ads of its own advertising network.

Personal Data collected: Cookies and Usage Data. 

Place of Processing: United States 

We use Google Analytics to measure traffic on our website. Google has their own Privacy Policy which you can review here (https://policies.google.com/privacy?hl=en).  If you’d like to opt out of tracking by Google Analytics, visit the Google Analytics opt-out page (https://tools.google.com/dlpage/gaoptout).  

 

Other circumstances in which we will disclose your information 

We will disclose your information to local and foreign regulators, governments, law enforcement authorities, advisors, courts, tribunals and arbitrators when we have a legal obligation to do so or when we believe our compliance with the request to be fair, reasonable and lawful, eg to detect, prevent or investigate security breaches, fraud or other crimes. 

We will also disclose your information to establish, exercise or defend legal claims, for example: (i) to ensure the safety and security of our users, consumers and third parties; and (ii) to protect our rights and property and the rights and property of our websites’ visitors, consumers and third parties. 

 

Location of third parties 

Some potential recipients of your information might be located outside the United Kingdom (UK) and European Economic Area (“EEA”), in jurisdictions which do not have the same data protection laws as those in the EEA. If we do transfer your information outside the EEA we will take appropriate steps to protect that information, which include: 

  • transferring to third parties in jurisdictions that the European Commission has determined offers adequate protection for your information (and information relating to adequacy decisions made by the European Commission are available here); and 
  • entering into an agreement with the recipient, which includes clauses that the European Commission has determined offers adequate protection for your information (a template copy of which is available here). 

5. How long is my personal information stored?

Whenever we collect or process your personal data, we will only keep information about you for as long as we need to fulfil the purposes for which we are processing your information or for an appropriate retention period thereafter. At the end of that retention period, your data will either be deleted or anonymised. Examples of our retention periods are: 

  • Membership: Where you are a member, we would normally keep your information for the duration of your membership and then a period of up to seven years after you cease being a member. 
  • Helpline: We collect health and benefits information, for example PIP assessment letters or GP letters about your diagnosis, where we have explicit permission from you to do so when you need us to process this as part of your case. In these circumstances, we password-protect these documents, store them on our secure shared drive under a unique ID number, and only the person handling your case will have access to them. We store these letters for seven years, after which they will be destroyed. 
  • Finance: Where we need to keep your information for financial reporting obligations, we would normally keep it for seven years from the date of payment. 
  • Complaints: Where we need to keep your information relating to complaints you have made, we would normally keep it for seven years from the end of that matter. 

 

We keep backups of data and renew these regularly to ensure preservation of your data. 

6. What are my data protection rights?

Under data protection law, you have rights including:  

Your right of access – You have the right to ask us for copies of your personal information.   

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.   

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.   

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.   

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.  

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.  

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.  

Please contact us at office@transportforall.org.uk if you wish to make a request. 

7. Marketing and advertising

We may use the information you provide to send you communications about Transport for All’s membership or wider work. This might be by telephone or postal marketing in furtherance of our legitimate interests, or for marketing by email, with your consent.   

You can change your marketing preferences at any time by clicking on the “unsubscribe” link in the footer of our emails, or by writing to us, telephoning or emailing us.  All details can be found in section 10 (How can I contact Transport for All about its privacy notice?) below. You can also unsubscribe from receiving any further marketing communications. 

We may analyse the information we collect about you to improve the targeting of communications. If you do not wish your data to be used in this way, please contact us at office@transportforall.org.uk or using the details in section 10  below. 

We use tracking technology within our emails to improve our future interactions with you. This means we are able to capture information including (but not limited to) the time and date you open our emails and the type of device used to open the email. 

We use this information primarily to understand, at an aggregate level, whether our emails are opened and what links are clicked on by our audiences. We then use this information to improve the emails and other communications (including post and digital advertising) that we send or display to you, and the services that we provide, and to evaluate the effectiveness of our campaigns. We may also use this data to clean our list to ensure that only people who are engaged with us continue to receive communications. 

8. Social media

Where we provide links to other websites, we do so for information purposes unless otherwise indicated. The other websites are outside our control and are not covered by this privacy notice. If you access other websites using the links provided, the operators of these websites may collect information from you which will be used by them in accordance with their privacy notice, which may differ from ours.  

On some pages of our websites, third parties that provide content, applications or plug-ins through our websites may track your use of content, applications, and plug-ins, or customise content, applications and plug-ins for you. For example, when you share an article using a social media sharing button on our websites (e.g., Facebook or Twitter), the social network that has created the button will record that you have done this.  

Facebook  

Transport for All has a Facebook page, managed by us at: http://www.facebook.com/transportforall. Facebook stores all its information and data on a remote secure server, it is a membership page where anyone can find it, but only we will have access to data of individuals. This is a link to Facebook’s Privacy Policy. 

Twitter 

Transport for All has a Twitter page, managed by us at: https://twitter.com/transportforallTwitter stores all its information and data on a remote secure server. This is a link to Twitter’s Privacy Policy. 

Instagram 

Transport for All has an Instagram page, managed by us at: https://www.instagram.com/transport.for.all/  

Instagram stores all its information and data on a remote secure server. This is a link to Instagram’s Privacy Policy. 

LinkedIn 

Transport for All has an LinkedIn page, managed by us at: https://www.linkedin.com/company/transport-for-all. LinkedIn stores all its information and data on a remote secure server. This is a link to LinkedIn’s Privacy Policy. 

TikTok 

Transport for all has a TikTok account, managed by us at: https://www.tiktok.com/@transport.for.all?lang=en 

TikTok stores all its information and data on a remote secure server. This is a link to TikTok’s privacy policy: https://www.tiktok.com/legal/privacy-policy-eea?lang=en  

YouTube 

Transport for all has a YouTube channel, managed by us at: https://www.youtube.com/channel/UCr5GZ8xC9Lo4QR21NhSEjZg  

YouTube stores all its information and data on a remote secure server. This is a link to YouTube privacy policy: https://policies.google.com/privacy?hl=en-GB  

9. Use of the Transport for All website and services by minors

Members of Transport for All are expected to be legal adults and at least the age of 18 years old. For helpline and casework enquiries, we will need to speak with a parent, carer or other representative of under-18s. 

This site is not for the use of people aged under 18 years old. Users under this age are not allowed to provide us with information and, in the event this is reported to us, we will cease to process their information immediately.  

10. How can I contact Transport for All about their Privacy Notice?

Please contact the Data Controller: 

  • by post: Transport for All, 336 Brixton Road, London, SW9 7AA 
  • by email office@transportforall.org.uk  
  • by telephone 020 7737 2339 

11. Changes to this Privacy Notice

Transport for All may need to update this Privacy Notice from time to time. You can see when the Privacy Notice was last updated by checking the date at the top of the page. A summary of changes can be found in this section, along with the date they were made. 

If we make any updates, such as materially changing how we use your personal data, we will alert you as required by applicable privacy laws. 

The privacy policy is reviewed annually in line with our risk assessment and Data Protection Impact Assessments. 

 

20.01.22 New privacy policy adopted.   

20.01.23 Privacy policy to be reviewed. 

12. What can I do if I am unhappy with the way Transport for All has processed my personal data?

You also have a right to lodge a complaint with the supervisory authority for data protection. In the UK this is: 

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

0303 123 1113 (local rate) 

https://ico.org.uk/  

13. Cookies

About cookies 

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. 

Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed. 

Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies. 

 

How we use cookies 

We use cookies for the following purposes: 

  • Authentication – we use cookies to identify you when you visit our website and as you navigate our website 
  • Status – we use cookies to help us to determine if you are logged into our website 
  • Security – we use cookies as an element of the security measures used to protect user accounts, including preventing fraudulent use of login credentials, and to protect our website and services generally 
  • Analysis – we use cookies to help us to analyse the use and performance of our website and services 
  • Cookie consent – we use cookies to store your preferences in relation to the use of cookies more generally. 
  • Accessibility – if you use our accessibility toolbar, we will use cookies to remember your preferences for 12 hours of use throughout the website. 

 

Cookies used by our service providers: Our service providers use cookies and those cookies may be stored on your computer when you visit our website. 

 

Managing cookies 

Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links: 

 

Blocking all cookies can have a negative impact upon the usability of many websites. 

 

If you block cookies, you will not be able to use all the features on our website.