Our concessionary travel and smart ticketing privacy policy

We are Transport Scotland, an executive agency of the Scottish Government. We are a data controller for the purposes of data protection legislation. If you have any questions, comments or requests regarding your personal information you can contact us at:

Data Protection Officer, Transport Scotland
Buchanan House
58 Port Dundas Road
Glasgow G4 0HF
Email: dpa@transport.gov.scot

If you are unhappy with how we handle your personal information, you can contact our Data Protection Officer and / or notify the Information Commissioner’s Office (ICO) by calling their helpline on 0303 123 1113.

Personal information relates to a living individual who can be identified from that information, either by that single piece of information or by combining it with another piece of information that we hold or might hold in the future. Personal information could include things like your name, address, email address or journey information.

We use the following personal information in connection with national concessionary travel schemes:

Information we receive from Dundee City Council, on behalf of your Local Authority (which operates the National Entitlement Card scheme in Scotland) in each case

What we hold

• Your date of birth, postcode and gender
• Information about your travel concession (type of concession and expiry date which may include information relating to your health, condition or disability)
• Technical coding in connection with your NEC and its expiry
• Details of the local authority that issued your NEC 
• Your NEC card number

Where there is a suspicion of fraud/misuse: we may also receive your name and address details from the organisation or authority that issued your NEC.

If you are entitled to concessionary ferry vouchers: we may receive, as part of sample data, your card number, your local authority and concession details and your unique ferry voucher ID numbers.

Information we may receive from transport operators in connection with your concessionary travel:

• Journey and card number information relating to use of your NEC

Information we may receive from Royal Mail:

• Undelivered ferry vouchers which include your name and card number, ferry voucher number, concessionary entitlement, address and photograph.

Why we hold it

We use this personal information for the following purposes:

• to provide travel concessions
  administering, managing and maintaining the travel concession schemes and our saltirecard smart travel platform
• gathering statistical information
• for the prevention and detection of fraud and concessionary travel card misuse

We may also link or match personal information we hold or receive from third parties for the purposes described in this Privacy Policy.

Legal basis

We process this personal information on the following legal grounds:

• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority
• The processing is necessary to perform a contract to which you are party, or to take steps at your request prior to entering into a contract
• The processing is necessary for compliance with our legal obligations.

We process personal information relating to health including disability on the following legal grounds:

• The processing is necessary for carrying out obligations and exercising rights in the field of employment and social security and social protection law
• The processing is necessary for reasons of substantial public interest

When you contact us

What we hold

We collect personal information which you give to us when you contact us in connection with travel concessions or the saltirecard. This information may include your name, telephone number email address and contact details and details about your card.

We may also ask Dundee City Council (which operates the National Entitlement Card scheme in Scotland) and/or the local authority which has issued your card to provide us personal information we require to respond to your query. The personal information provided to us may include your name, address and details about your card.

Why we hold it

We collect this information for the following purposes:

• To respond to your query and verify your identity and query details;
• Administering, managing, maintaining of the travel concession schemes and our saltirecard smart travel platform;
• Research and statistical analysis; and
• The prevention of fraud and misuse.

Legal basis

We process this personal information on the following legal grounds:

• The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority;
• The processing is necessary to perform a contract to which you are party or to take steps at your request prior to entering into a contract; and
• The processing is necessary for compliance with our legal obligations.

We process personal information relating to health including disability on the following legal grounds:

• The processing is necessary for carrying out obligations and exercising rights in the field of employment and social security and social protection law; and
• The processing is necessary for reasons of substantial public interest.

Further Information

Your NEC/Saltirecard travel card contains within it your date of birth, gender (where provided) and a unique NEC card number (also printed on the card).

All of this information may be visible to you, or anyone else who is given access to your travel card, if it is held against an NFC device where the user has installed a card reading app. An NFC device is one that allows data to be shared wirelessly.

Smart ticket machines do not read, record or store your personal data to allow free or reduced travel. The ticket machines check your card has a valid concessionary travel entitlement on it only.

We retain personal information in accordance with our Retention and Destruction Policy.

• We retain concessionary cardholder information (excluding journey information) whist the concession is valid and for a period of 7 years after the expiry of your concession.
• We retain journey information for a period of 7 years after the journey takes place.
• We retain information (including journey information) relating to fraud and misuse for 15 years after the fraud or misuse inquiry has been dealt with.
• We delete sample data held in connection with ferry vouchers after it has been checked by our team, usually within 12 months from receiving the information.
• We only retain personal information in connection with undelivered ferry vouchers until these have been passed on to a local authority.
• We retain information in connection with queries (which does not fall into any of the above categories) for a period of 6 years following receipt of the query.

We share your personal information with the third parties described below. We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

• We share your personal information with our contractors, suppliers and service providers, to allow us to administer, manage and maintain the travel concession schemes. This includes the following companies:
  
  • National Entitlement Card Programme Office (NECPO) and the Improvement Service: the bodies responsible for the delivery of the National Entitlement Card.
  • Traveline Scotland Limited: our travel concession schemes call centre service provider.
  • UNICARD Limited: a provider of software and IT services in connection with the saltirecard system.
  • Professional Data Management Services Limited (PDMS): our providers of back office managed services for our travel concession schemes.
  • Euclid: PDMS subcontract with Euclid to provide the best service for the travel concession schemes.
  • Iomart: our providers of back up storage and fire walls

• We may share your personal information with Police Scotland and British Transport Police where they request us to do so. We will only share either journey data or National Entitlement Card Numbers (ISRN or the MCRN) pursuant to such request.
  
  • We will only share personal information with Police Scotland or the British Transport Police for the following purposes:
    
    • the prevention and detection of serious crime (this means crime which is believed to involve a reasonable likelihood of either serious injury, loss of life or substantial financial loss);
    • the apprehension and prosecution of offenders in relation to serious crime;
    • the administration of justice in relation to serious crime; and
    • the protection of vital interests of individuals.
  • We may share personal information for the above purposes to assist Police Scotland and/or the British Transport Police in carrying out their statutory and common law functions. Our legal bases for sharing personal information are as follows:
    • processing is necessary to protect vital interests;
    • processing is necessary to comply with our legal obligations; and
    • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
• Where there is a suspicion of fraud/misuse we may also share your information with the Procurator Fiscal, Police Scotland and other relevant public authorities (and bodies which provide services to public authorities in Scotland) listed in Schedule 8 of the Digital Economy Act 2017.

We may share your personal information with our professional advisers including lawyers, bankers, auditors and insurers based who provide legal, banking, legal, accounting and insurance services.

We may share your information with local authorities or Strathclyde Partnership for Transport (SPT) to resolve any complex enquiries about National Entitlement Card applications or requests for renewals or replacement cards.

Your personal information may be stored inside the UK, the European Economic Area (EEA) or outside the EEA.

We transfer personal information outside the UK or the EEA where our service providers or contractors host, process, or store information outside the UK or the EEA. Where we do this, we ensure a similar degree of protection is afforded to your personal by ensuring at least one of the following safeguards is implemented:

• The country to which the personal information will be transferred has been deemed to provide an adequate level of protection for personal information by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
• Where we use certain service providers or contractors, we may use specific contracts approved by the European Commission which give personal information the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to non-EU countries.
• Where we use providers based in the US, we may transfer information to them if they are part of the Privacy Shield which requires them to provide similar protection to personal information shared between the Europe and the US. For further details, see European Commission: EU-US Privacy Shield.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal information out of the EEA.

You have certain rights under data protection legislation which can be exercised by writing to our Data Protection Officer at:

Transport Scotland
George House
2nd Floor, 36 North Hanover Street
Glasgow G1 2AD

by emailing dpa@transport.gov.scot, including:

• the right to access the personal information held about you by making a subject access request;
• the right to have your personal information rectified if it is inaccurate or incomplete;
• the right to request to have your personal information deleted in certain specific circumstances;
• the right to request the restriction of the processing of your personal information in certain specific circumstances;
• the right to ask us not to process your personal information for marketing purposes or for purposes based on our legitimate interests (where applicable);
• the right to ask us not to undertake automated decision making or profiling;
• the right to request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format.
  Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you;
• where you have provided consent, to request to withdraw such consent at any time; and
• the right to lodge a complaint with the UK Information Commissioner’s Office.

There are some exceptions to the above rights that are permitted under the data protection legislation. Please note that if you choose to exercise your rights to have personal information restricted or deleted, then we may not be able to provide you with concessionary travel.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or if you have made a number of requests. In this case, we will notify you and keep you updated.

Change of purpose

We will only use your personal information for the purposes outlined in this Privacy Policy, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

We may hold personal information where we act as a data processor for another party. As an example, we provide a service to a small number of transport operators to manage the transport operators’ commercial smart card schemes. We hold and use personal information in providing this service, however where we do so we are acting as a data processor, and will only process personal information on the instructions of the relevant transport operator. In this case transport operators may have provided you with a privacy policy or a privacy notice which will outline the purposes for which your personal information may be used.