School transport service privacy notice
The data controller for your data
Brighton & Hove City Council is the data controller for purposes of the Data Protection Act (2018) and The General Data Protection Regulation (EU) 2016/679 ("GDPR") and is registered as a data controller with the Information Commissioner’s Office (ICO) under registration number Z5840053.
Brighton & Hove City Council are committed to protecting your personal information. As a data controller, we have a responsibility to make sure you know why and how your personal information is being collected in accordance with relevant data protection law.
Why we’re collecting your data
- We are collecting your data for the purpose of assessing transport eligibility and making arrangements for home to school transport.
- The information you provide may be verified against information held by other council departments and used in the prevention of fraud.
What is the lawful basis for collecting your data
- We have a legal basis for processing your information because we are performing a task carried out in the public interest or official authority. Another lawful basis of processing is a legal obligation which means we have a statutory obligation which is to provide transport assistance to eligible pupils.
- We also collect special category data, such as physical, mental health needs and our lawful basis is substantial public interest.
The data we may collect
We may collect personal data or special category data.
The type of personal information collected from you is as follows:
- Contact details; including name, address, email address, telephone number, etc.
- Date of birth
- Information about your family
- Social and personal circumstances
- Financial details for purposes of receiving or making payments
Special category data
We may also collect special category of personal data that may include:
- Physical or mental health details
Who we’ll share your data with
Your data may be shared with schools, other council departments, third party transport providers and the Department for Education.
How long we’ll keep data for and why
- We will hold your data on council systems for up to 6 years after receiving your application.
- If your child receives transport assistance, we will hold your data for 6 years after you child has ceased to be transported.
- After this time your data will be securely destroyed.
How your data will be stored
- Your information will be stored electronically.
- We will only make your information available to those who have a right to see them.
- Example of the security measures we used are:
- training for our staff allows us to make them aware of how to handle information and how and when to report when something goes wrong
- we use Encryption meaning that information is hidden so that it cannot be read without special knowledge (such as a password). This is done with a secret code. The hidden information is said to then be ‘encrypted’.
- controlling access to systems and networks allows us to stop people who are not allowed to view your personal information from getting access to it.
- Regular testing of our technology and ways of working including keeping up to date on the latest security updates (commonly called patches).
Transferring data outside the European Economic Area
Your information is not processed outside of the European Economic Area.
Depending on the lawful basis for processing your information you may have the following rights:
- A right to a copy of data held about you, an explanation for its processing and who it has been shared with – this right applies to data processed under any lawful basis
- A right to rectification (correction) of data which is demonstrably wrong – this right applies to data processed under any lawful
- A right to restrict processing – this right applies if it has been shown that there is no lawful basis for processing your data, but you wish it to be retained
- A right to object to processing – this right does not apply where the council is under a legal duty to process your data, but can be used where you dispute that there is a lawful basis to process your data until the council can demonstrate what basis exists
- A right to erasure – this applies where there is no longer a lawful basis to retain your data
- A right to portability of your data (having it moved to another organisation) – this right applies only where the lawful basis was either consent or performance of a contract but data will usually be transferred to another local authority if a child in care moves to a new location.
- A right to object to automated decision making – this right is applicable under all lawful bases for processing
How to get advice or make a complaint
Data Protection Contacts
If you wish to discuss any of your data protection rights, you can contact the Data Protection Team on 01273 29 5959 or by email at firstname.lastname@example.org
The council has also appointed a Data Protection Officer. Contact the Data Protection Officer.
Whilst we would prefer that you contact us first with any concerns that you might have, you can also contact the Information Commissioner’s Office. The ICO is the national regulator with responsibility for ensuring compliance with data protection.
Information Commissioner’s Office
You also have the right to lodge a complaint with a supervisory authority.
Contact details for ICO are stated below:
The ICO can be contacted:
- on their website
- by phone: 0303 123 1113
- by post: Wycliffe House, Water Ln, Wilmslow SK9 5AF
This privacy notice will be subject to review when there is a change.