Skip To Navigation Skip To Content
Colour mode:
Home > Privacy policy

Privacy policy

This privacy policy is also available in British Sign Language (BSL) and EasyRead.

Privacy policy

Introduction 

Transport for All is a charity (1063733) and non-for-profit company limited by guarantee (03337948) based in the UK with registered offices at Cooper House, Lower Charlton Estate, Shepton Mallet, Somerset, BA4 5QE.  

For the purposes of data protection legislation, where Transport for All is processing your information, including in relation to our campaigns and policy work or your membership, it is a controller of your personal data. 

Providing us with personal data is purely consensual. You are not obligated under any laws to provide us with any personal data, but without providing such personal data, we cannot provide you with our services. By using our services, you hereby consent to allow us to process information in accordance with this Privacy Policy. 

 

What do we mean by personal data? Also known as personal information or personally identifiable information, personal data is any information related to an identifiable person. For example, email address, name, date of birth etc. 

What do we mean by consent? It means that you don’t have to share data, but without sharing it, we cannot provide you with our services. 

 

This notice applies to personal information we collect about you when you interact with us, for example when you use our websites such as www.transportforall.org.uk, or that we collect from third parties, as described in this privacy notice.  It sets out: 

  • what information we collect, and from whom; 
  • how we use that information; 
  • how long we keep your information; 
  • who we share your information with; 
  • how your information is protected; 
  • your rights in relation to the information we hold about you. 

 

We keep our privacy notice under regular review, and we encourage you to periodically review this page for the latest information on our privacy practices. Any material changes will be notified to you by updating them on our websites, together with any such other methods as may be appropriate.

1: How and when does Transport for All collect data from me?

 

Information you provide to us voluntarily 

You may give us your personal information when you: 

  • opt-in to receive email, postal or telephone communications from us; 
  • use, or provide a comment on our websites; 
  • correspond with or contact us; 
  • interact with us on social media platforms; 
  • sign up to one of our newsletters or other communications; 
  • become a member; 
  • use our helpline and casework services; 
  • participate in our workshops, research, or focus groups; 
  • make a donation to us; or 
  • otherwise interact with us or provide information to a third party to be referred to us. 

Where we request information from you, we will collect the information set out in the relevant forms or pages, or as explained to you over the telephone. You may choose to provide additional information to us when you contact us or otherwise interact with us or provide information to a third party to be referred to us. 

 

Information we collect automatically 

We also receive personal information indirectly, for example if you contact us by phone or email we may add a note to your file to explain the reason you contacted us. 

We, or the companies which work on our behalf, collect data related to visitors to our websites automatically, including what pages you have viewed, what devices you used to view pages, for how long and your website journey. 

Information is also collected about how you arrived at our websites in the first place, including what links or adverts of ours you have viewed or clicked on to reach us, or any search terms you have used. Information collected automatically using cookies or other tracking technologies includes your IP address. 

 

Information which is available publicly 

Your personal information may be available to us from external publicly available sources: for example, geo-demographic information and information from public registers such as listed directorships, information from the electoral roll and press reports. In addition, depending on your privacy settings for social media services, we may access information from those accounts or services. 

 

2: What types of personal information does Transport for All process?

 

We collect, store and use the following types of information: 

  • your name, email address, postal address, phone number, location, age range, impairment category, social media identity; 
  • details relating to your helpline enquiry including medical, health and benefits related information if you provide this to us; 
  • financial information, such as bank account number, where required to process expenses; 
  • details about your membership; 
  • correspondence you have had with us; 
  • audio, images, videos and photographs of you, with your consent; 
  • your contribution to any research you take part in; 
  • information about your computer/mobile device and your visits to and use of our websites, including for example your IP address; 
  • details about you that are stored in documents in different formats, or copies of them; and 
  • any other information shared with us as described in section 1 above. 

 

Special category data 

Some of the information we collect about you is classified under GDPR as ‘special category data’ which requires an extra level of protection. This includes impairment and health data. Your impairment category and details on the mobility aids you use are stored securely in our CRM system (Nutshell). 

We collect health and benefits information, for example PIP assessment letters or GP letters about your diagnosis, where we have explicit permission from you to do so when you need us to process this as part of your case. In these circumstances, we password-protect these documents, store them on our secure shared drive under a unique ID number, and only the person handling your case will have access to them. We store these letters for 7 years, after which they will be destroyed. 

4: Who does Transport for All share my personal information with?

 

Data processors 

To help us fulfil contracts and to pursue our legitimate interests, we share your personal information with third parties who provide services to Transport for All or who act on our behalf, for instance vendors, IT and other suppliers, research agencies, payment processors, financial institutions, or postal authorities that are involved in fulfilling your request.  We do not authorise these companies to use or disclose your personal information except for the purpose of providing the service we request of them. Transport for All is based in the UK, but some third-party data processors will be based outside of the European Economic Area (EEA). 

 

Nutshell 

We use the CRM (Customer Relationship Management) software Nutshell to process and manage our contacts. Their Privacy Policy can be found here: https://www.nutshell.com/support/privacy if you want to know more about how they adhere to GDPR rules please read these pages: https://support.nutshell.com/hc/en-us/articles/360004489793-GDPR-and-Nutshell 

 

Ring Central 

We use Ring Central for our phone and messaging services. You can find their privacy policy here: https://www.ringcentral.com/legal/last-update-january-1-2023/privacy-notice.html 

 

Jotform 

We use Jotform for various forms and services, including research, they store data in third party platforms such as Google Drive and AWS systems. You can find their privacy policy here: https://www.jotform.com/privacy/ 

 

Zapier 

We use Zapier to manage our administration processes and applications, for more information on their use of personal data please read their privacy policy here: https://zapier.com/privacy 

 

Stripe 

We use Stripe to process one-off donations and recurring payments. More information on how Stripe processes your personal data and your data protection rights, including your right to object, is available here: https://stripe.com/gb/privacy 

 

FundraiseUP 

We use FundraiseUp to process donations and recurring donations, primarily this is so we can report and thank donors better. They also use Stripe as a payment gateway. More information on how FundraiseUp processes your personal data is available here: https://fundraiseup.com/privacy/ 

 

Xero 

We use Xero to manage financial administration. More information on how Xero processes your personal data and your data protection rights, including your right to object, is available here: https://www.xero.com/uk/about/legal/privacy/  

 

Zoom 

We use Zoom to run events and meetings. More information on how Zoom processes your personal data is available here: https://explore.zoom.us/en/privacy/  

 

Zcal 

We use Zcal for booking events, meetings and events. More information on how Zcal processes your personal data and your data protection rights, including your right to object, are available here: https://zcal.co/privacy 

 

WordPress 

We use WordPress as our main platform for our website, WordPress is managed by Automattic as are many of their plugins and systems. Their Privacy Policy can be found here: https://automattic.com/privacy/ 

 

Website host 

We host our website and backups with Positive Internet Company. Backups are retained for 30 days. You can access their privacy centre webpage at https://www.heartinternet.uk/privacy-centre  

 

Otter 

We use otter to record transcripts. The privacy policy is here: https://blog.otter.ai/privacy-policy/ 

 

Google Forms and Google Drive 

We use Google Forms to conduct research and collect data, submissions are processed via Google Drive. The privacy policy is here: https://policies.google.com/  

 

Office 

We use Microsoft 365 for our administration and digital storage. Microsoft’s Privacy policy can be found at https://privacy.microsoft.com/en-gb/privacystatement. This data is stored on UK based secured Servers. 

 

Google Analytics 

Google Analytics is a web analysis service provided by Google Inc. (“Google”). Google utilises the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the Data collected to contextualise and personalise the ads of its own advertising network. 

Personal Data collected: Cookies and Usage Data. 

Place of Processing: United States 

We use Google Analytics to measure traffic on our website. Google has their own Privacy Policy which you can review here (https://policies.google.com/privacy?hl=en).  If you’d like to opt out of tracking by Google Analytics, visit the Google Analytics opt-out page (https://tools.google.com/dlpage/gaoptout).  

 

Other circumstances in which we will disclose your information 

We will disclose your information to local and foreign regulators, governments, law enforcement authorities, advisors, courts, tribunals and arbitrators when we have a legal obligation to do so or when we believe our compliance with the request to be fair, reasonable and lawful, eg to detect, prevent or investigate security breaches, fraud or other crimes. 

We will also disclose your information to establish, exercise or defend legal claims, for example: (i) to ensure the safety and security of our users, consumers and third parties; and (ii) to protect our rights and property and the rights and property of our websites’ visitors, consumers and third parties. 

 

Location of third parties 

Some potential recipients of your information might be located outside the United Kingdom (UK) and European Economic Area (“EEA”), in jurisdictions which do not have the same data protection laws as those in the EEA. If we do transfer your information outside the EEA we will take appropriate steps to protect that information, which include: 

  • transferring to third parties in jurisdictions that the European Commission has determined offers adequate protection for your information (and information relating to adequacy decisions made by the European Commission are available here); and 
  • entering into an agreement with the recipient, which includes clauses that the European Commission has determined offers adequate protection for your information (a template copy of which is available here). 

5: How long is my personal information stored?

 

Whenever we collect or process your personal data, we will only keep information about you for as long as we need to fulfil the purposes for which we are processing your information or for an appropriate retention period thereafter. At the end of that retention period, your data will either be deleted or anonymised. Examples of our retention periods are: 

  • Membership: Where you are a member, we would normally keep your information for the duration of your membership and then a period of up to seven years after you cease being a member. 
  • Advice service: We collect health and benefits information, for example PIP assessment letters or GP letters about your diagnosis, where we have explicit permission from you to do so when you need us to process this as part of your case. In these circumstances, we password-protect these documents, store them on our secure shared drive under a unique ID number, and only the person handling your case will have access to them. We store these letters for seven years, after which they will be destroyed. 
  • Finance: Where we need to keep your information for financial reporting obligations, we would normally keep it for seven years from the date of payment. 
  • Complaints: Where we need to keep your information relating to complaints you have made, we would normally keep it for seven years from the end of that matter.Events: if you are attending one of our events as a non-member we will remove your data after 6 months from our systems. 

We keep backups of data and renew these regularly to ensure preservation of your data. 

6: What are my data protection rights?

 

Under data protection law, you have rights including: 

Your right of access – You have the right to ask us for copies of your personal information. 

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.  

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. 

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances. 

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. 

 

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. 

Please contact us at office@transportforall.org.uk if you wish to make a request. 

7: Marketing and advertising

 

We may use the information you provide to send you communications about Transport for All’s membership or wider work. This might be by telephone or postal marketing in furtherance of our legitimate interests, or for marketing by email, with your consent. 

You can change your marketing preferences at any time by clicking on the “unsubscribe” link in the footer of our emails, or by writing to us, telephoning or emailing us.  All details can be found in section 10 (How can I contact Transport for All about its privacy notice?) below. You can also unsubscribe from receiving any further marketing communications.  

We may analyse the information we collect about you to improve the targeting of communications. If you do not wish your data to be used in this way, please contact us at office@transportforall.org.uk or using the details in section 10  below. 

We use tracking technology within our emails to improve our future interactions with you. This means we are able to capture information including (but not limited to) the time and date you open our emails and the type of device used to open the email. 

We use this information primarily to understand, at an aggregate level, whether our emails are opened and what links are clicked on by our audiences. We then use this information to improve the emails and other communications (including post and digital advertising) that we send or display to you, and the services that we provide, and to evaluate the effectiveness of our campaigns. We may also use this data to clean our list to ensure that only people who are engaged with us continue to receive communications. 

8: Social media

 

Where we provide links to other websites, we do so for information purposes unless otherwise indicated. The other websites are outside our control and are not covered by this privacy notice. If you access other websites using the links provided, the operators of these websites may collect information from you which will be used by them in accordance with their privacy notice, which may differ from ours 

On some pages of our websites, third parties that provide content, applications or plug-ins through our websites may track your use of content, applications, and plug-ins, or customise content, applications and plug-ins for you. For example, when you share an article using a social media sharing button on our websites (e.g., Facebook or Twitter), the social network that has created the button will record that you have done this.  

 

Facebook 

Transport for All has a Facebook page, managed by us at: http://www.facebook.com/transportforall. Facebook stores all its information and data on a remote secure server, it is a membership page where anyone can find it, but only we will have access to data of individuals. This is a link to Facebook’s Privacy Policy. 

 

Twitter/X 

Transport for All has a Twitter/X page, managed by us at: https://twitter.com/transportforallTwitter/X stores all its information and data on a remote secure server. This is a link to Twitter/X’s Privacy Policy. 

 

Instagram 

Transport for All has an Instagram page, managed by us at: https://www.instagram.com/transport.for.all/ 

Instagram stores all its information and data on a remote secure server. This is a link to Instagram’s Privacy Policy. 

 

LinkedIn 

Transport for All has an LinkedIn page, managed by us at: https://www.linkedin.com/company/transport-for-all. LinkedIn stores all its information and data on a remote secure server. This is a link to LinkedIn’s Privacy Policy. 

 

TikTok 

Transport for all has a TikTok account, managed by us at: https://www.tiktok.com/@transport.for.all?lang=en 

TikTok stores all its information and data on a remote secure server. This is a link to TikTok’s privacy policy: https://www.tiktok.com/legal/privacy-policy-eea?lang=en  

 

YouTube 

Transport for all has a YouTube channel, managed by us at: https://www.youtube.com/channel/UCr5GZ8xC9Lo4QR21NhSEjZg  

YouTube stores all its information and data on a remote secure server. This is a link to YouTube privacy policy: https://policies.google.com/privacy?hl=en-GB  

9: Use of Transport for All’s website and services by minors

 

Members of Transport for All are expected to be legal adults and at least the age of 18 years old. For advice and casework enquiries, we will need to speak with a parent, carer or other representative of under-18s. 

This site is not for the use of people aged under 18 years old. Users under this age are not allowed to provide us with information and, in the event this is reported to us, we will cease to process their information immediately. 

10: How can I contact Transport for All about their Privacy Notice?

 

Please contact the Data Controller: 

  • by post: Transport for All, Cooper House, Lower Charlton Estate, Shepton Mallet, Somerset, BA4 5QE 
  • by email office@transportforall.org.uk 
  • by telephone 020 7737 2339 

 

11: Changes to this Privacy Notice

 

Transport for All may need to update this Privacy Notice from time to time. You can see when the Privacy Notice was last updated by checking the date at the bottom of the page. A summary of changes can be found in this section, along with the date they were made. 

If we make any updates, such as materially changing how we use your personal data, we will alert you as required by applicable privacy laws. 

The privacy policy is reviewed annually in line with our risk assessment and Data Protection Impact Assessments. 

20.11.23 New privacy policy adopted.   

20.11.24 Privacy policy to be reviewed. 

12: What can I do if I am unhappy with the way Transport for All has processed my personal data?

You also have a right to lodge a complaint with the supervisory authority for data protection. In the UK this is: 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF 

0303 123 1113 (local rate) 

https://ico.org.uk/  

 

ICO Registration Number: ZB272644 

13: Cookies

 

About cookies 

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server. 

Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed. 

Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies. 

 

How we use cookies 

We use cookies for the following purposes: 

  • Authentication – we use cookies to identify you when you visit our website and as you navigate our website 
  • Status – we use cookies to help us to determine if you are logged into our website 
  • Security – we use cookies as an element of the security measures used to protect user accounts, including preventing fraudulent use of login credentials, and to protect our website and services generally 
  • Analysis – we use cookies to help us to analyse the use and performance of our website and services 
  • Cookie consent – we use cookies to store your preferences in relation to the use of cookies more generally. 
  • Accessibility – if you use our accessibility toolbar, we will use cookies to remember your preferences for 12 hours of use throughout the website. 

 

Cookies used by our service providers:

Our service providers use cookies and those cookies may be stored on your computer when you visit our website. 

 

Managing cookies 

Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links: 

 

Blocking all cookies can have a negative impact upon the usability of many websites. 

If you block cookies, you will not be able to use all the features on our website. 

A man standing in front of a painted brick wall smiling at the camera. He is holding a cane and is wearing glasses, a black jacket and a grey t-shirt. A man standing in front of a painted brick wall smiling at the camera. He is holding a cane and is wearing glasses, a black jacket and a grey t-shirt.

Support us

We can't do this without your support. Take action, give what you can, or sign up as a member - and join our movement of disabled people fighting for a better future.