Statement of intent

1.    We will treat your personal data with great care.  All data is collected, stored, processed and retained in accordance with data protection law.

 

2.    VEST Community Transport is the data controller and data processor for the purposes of data protection law.  Our data protection officer is Caroline Cook

 

Data collection

3.    We collect data relating to our customers when they register for our services.  This data is necessary for providing a safe and effective service to our customers.  

 

4.    Our registration process makes clear that this data will be shared within VEST Community Transport purely to fulfil the requirements to make our service safe and to deliver good service to our customers.

 

5.    Data relating to our staff and volunteers is collected upon their joining the organisation.  This data is used for the purpose of complying with our legal obligations in terms of employment law, health and safety and for effective performance management to maintain our service standards.

 

6.    If you notify us of any changes to your personal data, our office manager will ensure these changes are reflected in our systems and that information stored is accurate.

 

Legitimate interests

7.    We will process your data in accordance with the legitimate interests of VEST Community Transport, our customers and staff to ensure that customers are transported safely and efficiently.

 

Data retention

8.    Customer data will be retained by VEST Community Transport whilst that individual remains a customer.  Any data will be removed from our records if a customer has not used our services for a period of 2 years.

 

9.    Staff and volunteer data will be retained for the duration of employment or volunteering.  Data will be removed from our systems 7 years after the relationship ends.  This allows the periods for any disputes, tax issues or employment claims to be resolved.

 

Individual rights

10. As an individual you have the right to request access to your data, to request rectification of any inaccuracies in data, to have the data erased, or to withdraw consent for us to process your data at any time. 

 

11. It is the responsibility of the office manager to respond to any requests to exercise any of the rights under GDPR. 

 

12. All requests will be responded to and the office manager will ensure any necessary changes to data are made.

 

13. If a customer exercises their rights to erasure, the office manager will make sure information is removed from all our systems.  If they want to use our services again in the future they will need to re-register.

 

14. If a customer exercises their right to withdraw consent any data which VEST Community Transport no longer has a right to process will be deleted.  This may mean that the customer can no longer use our services.

 

Right to complain

15. If you are unhappy with the manner in which we have handled your personal data you should complain in the first instance to the data protection officer. 

 

16. If, following discussions with the data protection office you are not satisfied that we have acted correctly you may make a complaint to the Information Commissioner’s Office.