Concessionary bus travel scheme: privacy notice

This privacy notice explains how Transport for Wales (TfW) collects and processes your personal data on behalf of the Welsh Government and Welsh Local Authorities in relation to the concessionary bus travel scheme in Wales.

Your personal data will be processed fairly, lawfully, and transparently in line with the UK General Data Protection Regulation (UK GDPR).

• Data Controllers: Welsh Government and Welsh Local Authorities
• Data Processor: Transport for Wales (TfW)
• TfW processes your personal data on behalf of the controllers to deliver and manage the concessionary travel scheme.

We collect and use your personal data to:

• process applications for concessionary bus passes
• assess and confirm eligibility
• issue and manage concessionary bus passes
• authenticate use of passes
• administer payments and reimbursements to bus operators
• prevent fraud and maintain the integrity of the scheme

Under UK GDPR Article 6(1)(e), the Welsh Government will be the data controller for any personal data you have provided in relation to the Concessionary Bus Travel Scheme. The information will be processed on our behalf as part of our public task and the official authority vested in us to undertake the core role and functions of the Welsh Government.

We may collect and process the following types of personal data:

• name, address and contact details
• date of birth and age
• National Insurance number
• language preferences
• photograph
• evidence of eligibility (including supporting documents)
• application records and case notes
• records of use of the concessionary bus pass
• communication and marketing preferences (where applicable)

Your data may be shared with:

• Welsh Government and Local Authorities
• bus operators (for reimbursement and validation purposes)
• approved contractors or service providers supporting the scheme
• support service teams and its system technical administrators who support the IT system. System technical administrators will not use your details in any way
• other organisations where required by law or for fraud prevention

All data sharing will be carried out securely and only where necessary.

We may contact you to request your permission to use your contact details for marketing activities. The Welsh Government will not use your data without your consent for this particular purpose.

Your contact details may be used for research and evaluation purposes, including where Welsh Government commission an independent contractor for the purpose of evaluation of the scheme/process.

Participation is completely voluntary. However, we really appreciate your participation since your views and experiences are important to inform organisational improvement. Please note that research organisations/ evaluators may only contact a sample of individuals and/or enterprises.

Your contact details will only be used for approved research and will be deleted once this approved research is complete.

Personal data provided to Transport for Wales is held on secure servers within the UK or European Economic Area, and for the Welsh Concessionary Travel Scheme your personal data is restricted to authorised staff. 
The Welsh Government has procedures to manage any suspected data security breaches. If a suspected breach occurs, the Welsh Government will notify you and any applicable regulator where legally required.

Your personal data will be retained:

• for as long as you remain part of the concessionary travel scheme
• for a defined period afterwards to meet legal, audit, and fraud prevention requirements

Data will be securely deleted when no longer needed.

Under data protection legislation, you have the right:

• to be informed of the personal data Welsh Government holds about you and to access it
• to require us to rectify inaccuracies in that data
• to (in certain circumstances) object to or restrict processing
• for (in certain circumstances) your data to be ‘erased’
• to (in certain circumstances) data portability
• to lodge a complaint with the Information Commissioner’s Office (ICO) who is our independent regulator for data protection.

Should you have any queries regarding this privacy notice please contact:

Transport for Wales, Data Protection Officer, Transport for Wales, 3 Llys Cadwyn, Pontypridd, Rhondda Cynon Taf, CF37 4TH

E-mail: dataprotection@tfw.wales

For further details about the information the Welsh Government holds and its use, or if you want to exercise your rights under the data protection legislation, please contact:

Data Protection Officer, Welsh Government, Cathays Park, Cardiff, CF10 3NQ

Email: dataprotectionofficer@gov.wales

The contact details for the Information Commissioner’s Office are:

Customer Contact, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk