flexibus+ privacy notice

What this document is for

This privacy notice provides details on how we, Norfolk County Council, use your personal information for the purposes of managing bookings provided through the Swaffham flexibus+ service.

By 'use' we mean the various ways your personal information may be processed including storing and sharing the information.

Further details

We also provide the following details in our general privacy notice:

Who we are
How long we use your information for
Your rights under the UK General Data Protection Regulation (the GDPR) and
How to exercise them

You can also ask us for a copy of this information.

What we use your information for

We may use the information about you:

Name
Address
Date of Birth
Pick-up and Destination (Where you want to join and where the flexibus+ takes you)
Bank / Card Details (to facilitate payments)
Any relevant passenger mobility/disability impairment, including wheelchair, to ensure suitable delivery of the service

We use this information to enable the booking of and payment for the service, also to assess the quality of our services and evaluate and improve our policies and procedures.

We may also use information in other ways compatible with the above.

What personal data we collect and use about you

We will collect and use:

Name
Address
Date of Birth
Destination (Where you want to join and where the flexibus+ takes you)
Bank / Card Details (to facilitate payments)

We may also collect and use information about:

Information about health such as disabilities or mobility issues

This information is classed as "special category data" under the GDPR. We may only collect these data when it is relevant and for the purposes described above.

We do not collect information concerning criminal convictions and offences.

The GDPR includes safeguards to protect the use of your special category data and criminal conviction data. Further details can be found in the Special category data and criminal offences data policy which sets out our procedures for compliance with the principles of the GDPR and the retention and erasure of this information.

Who provides this information

We receive most of this information from you, but we may also obtain some of this data from:

If someone creates an account on your behalf.

Who we share your information with

We may need to share your information with:

Via Technologies (providers of the mobile application - flexibus+)
Vectare Ltd. (providers of the bus service)

Any information which is shared will only be shared on a need to know basis, with appropriate individuals. Only the minimum information for the purpose will be shared.

Your personal information will also be given to third parties contracted by the County Council to provide a service to the County Council. These service providers are known as data processors and have a legal obligation under GDPR and to the County Council to look after your personal information and only use it for providing that service. In particular, the County Council has entered into a contract with:

VIA Technologies (providers of the mobile application - flexibus+)
Vectare (providers of the bus service)

How the law protects you and the legal basis for processing your information

We have legal grounds under the GDPR to process this information because it is necessary:

To provide a service to you as part of fulfilling a contract. (This is as is detailed in the terms and conditions provided to you within the flexibus+ App.

We have legal grounds to process (including share) special category data because it is necessary:

To provide a service to you as part of fulfilling a contract. (This is as is detailed in the terms and conditions provided to you within the flexibus+ App
To comply with legal obligations, such as the Equality Act 2010 (to provide reasonable adjustments to individuals with disabilities)

How long will we keep your personal information for

When the information is no longer needed for the above purposes, it will be securely deleted. We anticipate the end of the period where we would require your information for the above to be the earliest of either:

You delete your account. You can delete your account within the flexibus+ App at any time. If you do this, this will delete the information we hold about you, which can be connected to yourself.
Your account is inactive for one year.
The flexibus service is permanently terminated by us.

If we need to use your information for research or reports, your information will be anonymised and any information taken from notes (handwritten or typed) during any consultation sessions will be securely destroyed.

The information will continue to be used in a summarised and anonymised form in any research reports or papers that are published. The anonymised information in the papers may be of historic interest and may be held in public archives indefinitely.

How we keep your information

The information is stored electronically, on VIA Technology's servers.

Please note that VIA Technology (the App provider) may send data outside of the UK/EEA to facilitate push notifications within the App.

Automated decision making

We do not make automated decisions about you (and your family).

Changes to this notice

We may amend this privacy notice at any time so please review it frequently. The date below will be amended each time this notice is updated.

This notice was created on 17 March 2022.