Our concessionary travel and smart ticketing privacy policy

Personal information is any data that can identify a living person, either on its own or when combined with other information we have or might have in the future. This can include things like your name, address, email, or travel details.

What personal information we hold

We receive personal information from Dundee City Council, on behalf of your Local Authority (which operates the National Entitlement Card scheme in Scotland). This includes:

• Your date of birth, postcode, and
• Information about your concessionary travel entitlement (type of concession and expiry date which may include information relating to your health, condition or disability)
• Technical coding in connection with your NEC and its expiry
• Details of the local authority that issued your NEC 
• Your NEC card number

We may also hold the following additional information:

• Your name, address and card history details from the organisation or authority that issued your NEC if there is a suspicion of fraud or misuse.
• Your card number, your local authority and concession details, and your unique ferry voucher ID numbers if you are entitled to concessionary ferry vouchers.
• Journey and card number information relating to use of your NEC from transport operators in connection with concessionary travel.
• CCTV stills or footage from bus operators to assist in the investigation of cases involving fraud or misuse
• Undelivered ferry vouchers which include your name and card number, ferry voucher number, concessionary entitlement, address and photograph from Royal Mail

When you contact us in connection with concessionary travel, we collect personal information provided by you. This information may include your name, telephone number, email address, contact information, and details about your card.

We may also ask Dundee City Council (which operates the National Entitlement Card scheme in Scotland) and/or the local authority which has issued your card to provide us with personal information we require to respond to your query. This may include your name, address, and details about your card.

Why we hold your personal information

We collect your personal information for the following purposes:

• To respond to you and verify your identity and query details.
• To administer, manage, and maintain the concessionary travel schemes.
• For research and statistical analysis.
• For matters relating to fraud and misuse.

How long we hold your personal information for

We retain personal information in accordance with our Retention and Destruction Policy and will not hold data for any longer than is necessary for the discharge of our analytical and statutory functions.

• Anonymised statistical information which cannot identify individuals may be held in perpetuity for reporting purposes.We will retain concessionary cardholder information (excluding journey information) whist the concession is valid and for a minimum period of 9 years thereafter at which point it will be reviewed and disposed of if no longer needed.
• We will retain journey information for a period of 9 years after the journey takes place at which point it will be reviewed and disposed of if no longer needed.
• We retain information - including journey information - relating to fraud and misuse for 10 years following the date of last action.
• We delete sample data held in connection with ferry vouchers after it has been checked by our team - usually within 12 months from receiving the information.
• We only retain personal information in connection with undelivered ferry vouchers until these have been passed on to a local authority.
• We retain information in connection with queries (which does not fall into any of the above categories) for a period of 5 years following the date of last action.

Where we store your personal information

Your personal information may be stored inside the UK, the European Economic Area (EEA) or outside the EEA.

We may transfer personal information outside the UK or the EEA when our service providers or contractors host, process, or store data in those regions. When such transfers occur, we ensure your personal information is protected to a similar standard by implementing at least one of the following safeguards:

• The country to which the personal information will be transferred has been deemed to provide an adequate level of protection for personal information by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
• Where we use certain service providers or contractors, we may use specific contracts approved by the European Commission which give personal information the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to non-EU countries.
• Where we use providers based in the US, we may transfer information to them if they are part of the Privacy Shield which requires them to provide similar protection to personal information shared between the Europe and the US. For further details, see European Commission: EU-US Privacy Shield.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal information out of the EEA.

Legal basis

We process your personal information based on the following legal grounds:

• When it is necessary to carry out a task in the public interest or in the exercise of official authority.
• When it is required to fulfil a contract you are a party to, or to take steps at your request before entering into such a contract.
• When it is necessary for us to comply with legal obligations.

We process personal information related to health, including disability, on the following legal bases:

• When it is necessary to fulfil our obligations and exercise rights under employment, social security, and social protection laws.
• When it is required for reasons of substantial public interest.

Further information

Your card holds your date of birth, gender (where provided), and unique NEC and concessionary card numbers (also printed on the card). This information may be accessible to you or to anyone else with access to your card if it is scanned using a Near Field Communication (NFC) device equipped with a card reading app, such as the Transport Scot Pass Collect app, while the card is held against the scanning device. Smart ticket machines do not read, record, or store your personal data to enable free or reduced travel. They simply check whether your card holds a valid concessionary travel entitlement and, if a valid concessionary product is available, it can be downloaded onto the NEC using the Transport Scot Pass Collect App as a conduit. The app does not store any personal data.

We share your personal information with the third parties outlined below. We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.

Contractors, suppliers and service providers

We share your personal information with the following organisations to allow us to administer, manage, and maintain the concessionary travel schemes:

• National Entitlement Card Programme Office (NECPO) and the Improvement Service (IS) - the bodies responsible for the delivery of the National Entitlement Card.
• Traveline Scotland Limited - our concessionary travel schemes call centre service provider.
• UNICARD Limited - a provider of software and IT services in connection with the saltirecard system.
• Professional Data Management Services Limited (PDMS) - our providers of back office managed services for our concessionary travel schemes .
• Euclid -
• Iomart - our providers of back up storage and fire walls

Local authorities

We may share your information with local authorities or Strathclyde Partnership for Transport (SPT) to resolve any complex enquiries about National Entitlement Card applications or requests for renewals or replacement cards.

Police Scotland and the British Transport Police

We may share your journey data and/or National Entitlement Card (NEC) numbers with Police Scotland or the British Transport Police when requested, but only in specific circumstances. Personal information will only be disclosed for the following purposes:

• The prevention and detection of serious crime (defined as crime involving a reasonable likelihood of serious injury, loss of life, or significant financial loss).
• The apprehension and prosecution of individuals involved in serious crime.
• The administration of justice in connection with serious crime.
• The protection of an individual’s vital interests.

We may share personal information for the above purposes to assist Police Scotland and/or the British Transport Police in carrying out their statutory and common law functions. The legal bases for sharing personal information are:

• If processing is necessary to protect vital interests.
• If processing is necessary to comply with our legal obligations.
• If processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Social Security Scotland

We may share your journey data under Data Protection Act 2018, Schedule 2, Part 1, Section 2(1) [(a) the prevention or detection of crime with Social Security Scotland under regulation 4 of the Social Security Assistance (Investigation of Offences) (Scotland) Regulations 2020 when requested, but only in specific circumstances. Personal information will only be disclosed for the following purposes:

• If there is a lawful basis of the public task (the offence covers section 71 of the Social Security Act 2018)
• If necessary and the information cannot be corroborated by any other means
• If processing is necessary to comply with our legal obligations
• If processing is necessary for the performance of a task carried out in the public interest or exercise of official authority

In cases of fraud and misuse

Where there is a suspicion of fraud or misuse, we may share your personal and/or transactional details with the Crown Office and Procurator Fiscal Service, Police Scotland, and other relevant public authorities (and bodies which provide services to public authorities in Scotland) listed in Schedule 8 of the Digital Economy Act 2017.

We may share your personal information with our professional advisers—such as lawyers, bankers, auditors, and insurers—who provide legal, financial, accounting, and insurance services.

You have certain rights under data protection legislation which can be exercised by contacting us.

You have the right to:

• access the personal information held about you by making a subject access request;
• have your personal information rectified if it is inaccurate or incomplete;
• request to have your personal information deleted in certain specific circumstances;
• request the restriction of the processing of your personal information in certain specific circumstances;
• ask us not to process your personal information for marketing purposes or for purposes based on our legitimate interests (where applicable);
• ask us not to undertake automated decision making or profiling;
• request the transfer of your personal information to you or to a third party. We will provide this information in a structured, commonly used, and machine-readable format. This right applies only to data processed by automated means, which you provided with your consent or where it was necessary to perform a contract with you. If you have given consent, you may withdraw it at any time. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) by calling their helpline on 0303 123 1113.

There are some exceptions to the above rights that are permitted under the data protection legislation. Please note that if you choose to exercise your rights to have personal information restricted or deleted, then we may not be able to provide you with concessionary travel.

Cost

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

To protect your personal information, we may need to request specific details from you to verify your identity and confirm your right to access your data (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to anyone who is not entitled to receive it. We may also contact you for additional information related to your request to help process our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex, or if you have made a number of requests. In this case, we will notify you and keep you updated.

Change of purpose

We will use your personal information only for the purposes outlined in this Privacy Policy, unless we reasonably determine that it needs to be used for another purpose that is compatible with the original one. If you would like an explanation of how the new purpose aligns with the original, please

If we need to use your personal information for a purpose that is unrelated to those stated, we will inform you and explain the legal basis that permits this use.

Please note that, in certain circumstances, we may process your personal information without your knowledge or consent, but only where this is required or permitted by law and in accordance with the above principles.

We may hold personal information in situations where we act as a data processor on behalf of another party. For example, we provide services to a limited number of transport operators to support the management of their commercial smart card schemes. In doing so, we process personal information solely on the instructions of the relevant transport operator and do not determine the purposes for which the data is used.

In such cases, the transport operator remains the data controller and may have provided you with a privacy policy or notice that outlines how your personal information will be used.

If you have any questions, comments or requests regarding your personal information you can contact us by:

• Email
• Phone – 0141 272 7189
• Writing to the following address:

Data Protection Officer
Transport Scotland
177 Bothwell Street
Glasgow
G2 7ER

If you are unhappy with how we handle your personal information, you can contact our Data Protection Officer and / or notify the Information Commissioner’s Office (ICO) by calling their helpline on 0303 123 1113.