Home to School and Public transport privacy notice

This notice explains what personal data (information) we hold about you, how we collect, how we use and may share information about you.  We are required to give you this information under data protection law.

Who we are:

Powys County Council (PCC) collects, uses and is responsible for certain personal information about you. When we do so we are regulated under the UK General Data Protection Regulation (UK GDPR) and we are responsible as 'controller' of that personal information for the purposes of those laws.

Personal information we collect and use:

Information collected by us:

In the course of enabling access to transport schemes we may collect the following personal information when you provide it to us:

• name
• address
• contact details
• date of birth
• details of any additional needs you may have or other information needed to ensure the service we provide is appropriate for you
• certain financial information (if you need to make a payment for the service to be provided)
• information in relation to the onboarding of vehicles (school transport passes)

We also obtain personal information from the following other sources:

• other PCC departments, such as the Schools Services department
• educational establishments

How we use your personal information:

We use your personal information to:

• facilitate necessary transport arrangements including the use of transport cards and codes
• produce or replace travel passes
• accept payment in respect of fees and charges
• data may be processed automatically, for example when you submit an application via the internet and when a travel pass is manufactured.

How long your personal data will be kept:

We will hold your personal information for the period in which travel, or benefit is being provided plus 1 year or in accordance with our published retention schedule.

For the purposes of vehicle onboarding, then

• Learners' personal data for routes they have travelled is held for 7 days
• Anonymised route data 8 years

Reasons we can collect and use your personal information:

For the delivery and management of the school transport service, then the legal basis being relied upon is that of delivering public tasks in the wider public interest, and those of substantial public interest.  

The provision of personal and/or sensitive personal data is required from you to enable us to facilitate your access to the transport services provided by PCC.

Sharing of personal data:

We routinely share

• personal data where it is necessary to make appropriate travel arrangements or to enable access to PCC provided transport services
• sensitive personal data where it is necessary to ensure that the transport provided meets your particular needs

This information would be shared with:

• transport providers
• third party travel card manufacturers (such as Transport for Wales)
• educational establishments
• third party software suppliers to the Council

This data sharing enables appropriate travel arrangements to be made. For a list of our third party suppliers please email buses@powy.gov.uk quoting a GPDR request. We will share personal information with law enforcement or other authorities if allowed or required by applicable law.

Keeping your personal information secure

We have appropriate technical and operational security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

For more details on your information rights and how Powys County processes personal data then please visit  https://en.powys.gov.uk/privacy

Contact

Please contact the Data Protection Officer at information.compliance@powys.gov.uk  to exercise any of your information rights, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

The supervisory authority in the UK for data protection matters is the Information Commissioner who may be contacted on 03031 231113.