Last updated: 12 January 2022
ICO Registration Number: ZB272644
If you would like to request a hard copy be sent to you in the post, please email firstname.lastname@example.org or call 020 7737 2339.
In this privacy notice
Transport for All is a charity (1063733) and non-for-profit company limited by guarantee (03337948) based in the UK with registered offices at 336 Brixton Rd, London, SW9 7AA. We operate as a membership organisation, guided by our shared belief that all disabled and older people have the right to travel with freedom and independence.
For the purposes of data protection legislation, where Transport for All is processing your information, including in relation to our campaigns and policy work or your membership, it is a controller of your personal data.
Providing us with personal data is purely consensual. You are not obligated under any laws to provide us with any personal data, but without providing such personal data, we cannot provide you with our services.
What do we mean by personal data? Also known as personal information or personally identifiable information, personal data is any information related to an identifiable person. For example, email address, name, date of birth etc.
What do we mean by consent? It means that you don’t have to share data, but without sharing it, we cannot provide you with our services.
This notice applies to personal information we collect about you when you interact with us, for example when you use our websites such as www.transportforall.org.uk, or that we collect from third parties, as described in this privacy notice. It sets out:
- what information we collect, and from whom;
- how we use that information;
- how long we keep your information;
- who we share your information with;
- how your information is protected;
- your rights in relation to the information we hold about you.
We keep our privacy notice under regular review, and we encourage you to periodically review this page for the latest information on our privacy practices. Any material changes will be notified to you by updating them on our websites, together with any such other methods as may be appropriate.
1. How and when does Transport for All collect data from me?
Information you provide to us voluntarily
You may give us your personal information when you:
- opt-in to receive email, postal or telephone communications from us;
- use, or provide a comment on our websites;
- correspond with or contact us;
- interact with us on social media platforms;
- sign up to one of our newsletters or other communications;
- become a member;
- use our helpline and casework services;
- participate in our workshops, research, or focus groups;
- make a donation to us; or
- otherwise interact with us or provide information to a third party to be referred to us.
Where we request information from you, we will collect the information set out in the relevant forms or pages, or as explained to you over the telephone. You may choose to provide additional information to us when you contact us or otherwise interact with us or provide information to a third party to be referred to us.
Information we collect automatically
We also receive personal information indirectly, for example if you contact us by phone or email we may add a note to your file to explain the reason you contacted us.
We, or the companies which work on our behalf, collect data related to visitors to our websites automatically, including what pages you have viewed, what devices you used to view pages, for how long and your website journey.
Information is also collected about how you arrived at our websites in the first place, including what links or adverts of ours you have viewed or clicked on to reach us, or any search terms you have used. Information collected automatically using cookies or other tracking technologies includes your IP address.
Information which is available publicly
Your personal information may be available to us from external publicly available sources: for example, geo-demographic information and information from public registers such as listed directorships, information from the electoral roll and press reports. In addition, depending on your privacy settings for social media services, we may access information from those accounts or services.
2. What types of personal information does Transport for All process?
We collect, store and use the following types of information:
- your name, email address, postal address, phone number, location, age range, impairment category, social media identity;
- details relating to your helpline enquiry including medical, health and benefits related information if you provide this to us;
- financial information, such as bank account number, where required to process expenses;
- details about your membership;
- correspondence you have had with us;
- audio, images, videos and photographs of you, with your consent;
- your contribution to any research you take part in;
- information about your computer/mobile device and your visits to and use of our websites, including for example your IP address;
- details about you that are stored in documents in different formats, or copies of them; and
- any other information shared with us as described in section 1 above.
Special category data
Some of the information we collect about you is classified under GDPR as ‘special category data’ which requires an extra level of protection. This includes impairment and health data. Your impairment category and details on the mobility aids you use are stored securely in our CRM system (Nutshell).
We collect health and benefits information, for example PIP assessment letters or GP letters about your diagnosis, where we have explicit permission from you to do so when you need us to process this as part of your case. In these circumstances, we password-protect these documents, store them on our secure shared drive under a unique ID number, and only the person handling your case will have access to them. We store these letters for 7 years, after which they will be destroyed.
3. What does Transport for All use my personal information for, and on what legal basis?
The following sections describe in more detail how Transport for All may use your information, and in particular the legal grounds on which we rely in doing so.
What we use your personal information for
We use the information collected for a number of purposes, including:
- to verify your membership;
- to make and manage payments;
- to manage our relationship and communicate with you;
- to respond to complaints and seek to resolve them;
- to enhance your online experience;
- to conduct research and surveys;
- to better understand our members and supporters in general;
- to inform our policy influencing work;
- to research members’ and supporters’ views and experiences for research and editorial purposes, including through requests for help and surveys;
- to respond to individual experiences shared with us and for editorial content;
- to understand your website journey, including what pages you have viewed and for how long;
- to improve the effectiveness our campaigns;
- to administer and keep safe and secure our websites and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
- to respond to helpline enquiries you contact us with;
- If you use our casework services, to contact you about information relating to your case;
- to train our staff and measure the quality of the service we give you; and
- to obey laws and regulations that apply to us.
The legal grounds we rely on to process your information
The legal grounds on which we rely are:
- to fulfil our contractual obligations (for example in order to provide services requested by members and to contact you if a problem arises with them);
- to pursue our legitimate interests (for example to facilitate your use of our websites, or for marketing);
- your consent; and / or
- to fulfil a legal duty.
When we rely on our legitimate interests, these are as follows:
- keeping our records up to date;
- administering membership;
- developing our membership offer;
- marketing our products and services;
- administering our websites and keeping them safe and secure;
- ensuring that content is presented in the most effective manner for you and your devices;
- facilitating your use of our websites;
- measuring the use of our websites and improving their content and accessibility;
- measuring and understanding the effectiveness of advertising, and delivering relevant advertising to you;
- tailoring content and our communications so that they are most relevant to you;
- carrying out campaigns work and developing Transport for All’s policy and campaigns;
- complying with legal and/or regulatory requirements;
- identifying trends in member and supporter behaviour;
- informing and generating content.
4. Who does Transport for All share my personal information with?
To help us fulfil contracts and to pursue our legitimate interests, we share your personal information with third parties who provide services to Transport for All or who act on our behalf, for instance vendors, IT and other suppliers, research agencies, payment processors, financial institutions, or postal authorities that are involved in fulfilling your request. We do not authorise these companies to use or disclose your personal information except for the purpose of providing the service we request of them. Transport for All is based in the UK, but some third-party data processors will be based outside of the European Economic Area (EEA).
We use Stripe to process one-off donations and recurring payments. More information on how Stripe processes your personal data and your data protection rights, including your right to object, is available here: https://stripe.com/gb/privacy
We use Xero to manage financial administration. More information on how Xero processes your personal data and your data protection rights, including your right to object, is available here: https://www.xero.com/uk/about/legal/privacy/
We use Zoom to run events and meetings. More information on how Zoom processes your personal data and your data protection rights, including your right to object, is available here: https://explore.zoom.us/en/privacy/
We host our website and backups with Heart Internet Limited. Backups are retained for 30 days. You can access their privacy centre webpage at https://www.heartinternet.uk/privacy-centre
Google Forms and Google Drive
Google Analytics is a web analysis service provided by Google Inc. (“Google”). Google utilises the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the Data collected to contextualise and personalise the ads of its own advertising network.
Personal Data collected: Cookies and Usage Data.
Place of Processing: United States
Other circumstances in which we will disclose your information
We will disclose your information to local and foreign regulators, governments, law enforcement authorities, advisors, courts, tribunals and arbitrators when we have a legal obligation to do so or when we believe our compliance with the request to be fair, reasonable and lawful, eg to detect, prevent or investigate security breaches, fraud or other crimes.
We will also disclose your information to establish, exercise or defend legal claims, for example: (i) to ensure the safety and security of our users, consumers and third parties; and (ii) to protect our rights and property and the rights and property of our websites’ visitors, consumers and third parties.
Location of third parties
Some potential recipients of your information might be located outside the United Kingdom (UK) and European Economic Area (“EEA”), in jurisdictions which do not have the same data protection laws as those in the EEA. If we do transfer your information outside the EEA we will take appropriate steps to protect that information, which include:
- transferring to third parties in jurisdictions that the European Commission has determined offers adequate protection for your information (and information relating to adequacy decisions made by the European Commission are available here); and
- entering into an agreement with the recipient, which includes clauses that the European Commission has determined offers adequate protection for your information (a template copy of which is available here).
5. How long is my personal information stored?
Whenever we collect or process your personal data, we will only keep information about you for as long as we need to fulfil the purposes for which we are processing your information or for an appropriate retention period thereafter. At the end of that retention period, your data will either be deleted or anonymised. Examples of our retention periods are:
- Membership: Where you are a member, we would normally keep your information for the duration of your membership and then a period of up to seven years after you cease being a member.
- Helpline: We collect health and benefits information, for example PIP assessment letters or GP letters about your diagnosis, where we have explicit permission from you to do so when you need us to process this as part of your case. In these circumstances, we password-protect these documents, store them on our secure shared drive under a unique ID number, and only the person handling your case will have access to them. We store these letters for seven years, after which they will be destroyed.
- Finance: Where we need to keep your information for financial reporting obligations, we would normally keep it for seven years from the date of payment.
- Complaints: Where we need to keep your information relating to complaints you have made, we would normally keep it for seven years from the end of that matter.
We keep backups of data and renew these regularly to ensure preservation of your data.
6. What are my data protection rights?
Under data protection law, you have rights including:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
Please contact us at email@example.com if you wish to make a request.
7. Marketing and advertising
We may use the information you provide to send you communications about Transport for All’s membership or wider work. This might be by telephone or postal marketing in furtherance of our legitimate interests, or for marketing by email, with your consent.
You can change your marketing preferences at any time by clicking on the “unsubscribe” link in the footer of our emails, or by writing to us, telephoning or emailing us. All details can be found in section 10 (How can I contact Transport for All about its privacy notice?) below. You can also unsubscribe from receiving any further marketing communications.
We may analyse the information we collect about you to improve the targeting of communications. If you do not wish your data to be used in this way, please contact us at firstname.lastname@example.org or using the details in section 10 below.
We use tracking technology within our emails to improve our future interactions with you. This means we are able to capture information including (but not limited to) the time and date you open our emails and the type of device used to open the email.
We use this information primarily to understand, at an aggregate level, whether our emails are opened and what links are clicked on by our audiences. We then use this information to improve the emails and other communications (including post and digital advertising) that we send or display to you, and the services that we provide, and to evaluate the effectiveness of our campaigns. We may also use this data to clean our list to ensure that only people who are engaged with us continue to receive communications.
8. Social media
Where we provide links to other websites, we do so for information purposes unless otherwise indicated. The other websites are outside our control and are not covered by this privacy notice. If you access other websites using the links provided, the operators of these websites may collect information from you which will be used by them in accordance with their privacy notice, which may differ from ours.
On some pages of our websites, third parties that provide content, applications or plug-ins through our websites may track your use of content, applications, and plug-ins, or customise content, applications and plug-ins for you. For example, when you share an article using a social media sharing button on our websites (e.g., Facebook or Twitter), the social network that has created the button will record that you have done this.
Transport for All has an Instagram page, managed by us at: https://www.instagram.com/transport.for.all/
Transport for all has a TikTok account, managed by us at: https://email@example.com?lang=en
Transport for all has a YouTube channel, managed by us at: https://www.youtube.com/channel/UCr5GZ8xC9Lo4QR21NhSEjZg
9. Use of the Transport for All website and services by minors
Members of Transport for All are expected to be legal adults and at least the age of 18 years old. For helpline and casework enquiries, we will need to speak with a parent, carer or other representative of under-18s.
This site is not for the use of people aged under 18 years old. Users under this age are not allowed to provide us with information and, in the event this is reported to us, we will cease to process their information immediately.
10. How can I contact Transport for All about their Privacy Notice?
Please contact the Data Controller:
- by post: Transport for All, 336 Brixton Road, London, SW9 7AA
- by email firstname.lastname@example.org
- by telephone 020 7737 2339
11. Changes to this Privacy Notice
Transport for All may need to update this Privacy Notice from time to time. You can see when the Privacy Notice was last updated by checking the date at the top of the page. A summary of changes can be found in this section, along with the date they were made.
If we make any updates, such as materially changing how we use your personal data, we will alert you as required by applicable privacy laws.
12. What can I do if I am unhappy with the way Transport for All has processed my personal data?
You also have a right to lodge a complaint with the supervisory authority for data protection. In the UK this is:
Information Commissioner’s Office
0303 123 1113 (local rate)
A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.
Cookies may be either “persistent” cookies or “session” cookies: a persistent cookie will be stored by a web browser and will remain valid until its set expiry date, unless deleted by the user before the expiry date; a session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.
Cookies do not typically contain any information that personally identifies a user, but personal information that we store about you may be linked to the information stored in and obtained from cookies.
Most browsers allow you to refuse to accept cookies and to delete cookies. The methods for doing so vary from browser to browser, and from version to version. You can however obtain up-to-date information about blocking and deleting cookies via these links:
- https://support.google.com/chrome/answer/95647?hl=en (Chrome);
- https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences (Firefox);
- https://help.opera.com/en/latest/web-preferences/ (Opera);
- https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies (Internet Explorer);
- https://support.apple.com/kb/PH21411 (Safari);
- https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy (Edge).
Blocking all cookies can have a negative impact upon the usability of many websites.
If you block cookies, you will not be able to use all the features on our website.