Customer Relations Privacy Notice

Our core data protection obligations and commitments are set out in the organisation’s primary privacy notice.

This notice provides additional privacy information for: customers of TfGM (including Metrolink and the Bee Network mobile app) and the travelling public who may contact us with enquiries and complaints.

---

Purposes

We collect [or obtain] your personal information for the following purpose(s):

• To process payments for Bee Network products
• To process payments for smart ticketing products on behalf of Metrolink and Greater Manchester Travel Cards Ltd (GMTL);
• To process payments and administrate travel taken on Bee Network Buses and Metrolink using contactless payment methods;
• To administer registered accounts created via the Bee Network website and Bee Network mobile app;
• To administer National Concessionary Travel Scheme passes;
• To administer igo passes for 11-16 year olds;
• To administer the Our Pass scheme;
• To administer Care Leavers travel passes;
• To administer the Scholars Concessionary Permit passes;
• To administer Free School Bus passes;
• To manage Local Link registrations and journey bookings;
• To manage Ring & Ride registrations and journey bookings
• To provide journey planning services;
• To manage Cycle Hub membership;
• To manage enquiries and complaints; and
• To research, evaluate and make improvements on use of all schemes.

Information collected by our Bee Network Mobile App

As well as the information you provide when registering for an account, we also collect some additional information using cookies or similar technologies (Cookies are small text files placed on your computer or device by websites or apps to store and retrieve information). The following information is collected by us for security purposes and to prevent fraud.

• Device ID and model
• Operating system and version
• Application name and version

We also use cookies or similar technologies to collect anonymous data about your use of the app and its performance. This includes App activity, IP address (anonymised) and Diagnostic data such as crash logs and screen resolution. We cannot use this data to identify you. Collecting this data helps us to monitor the application for faults, analyse how it is used and ultimately improve the App and our services.

---

Categories of personal data

In order to carry out these purposes we collect and obtain:

• Personal details;
• Visual images, personal appearance and behaviour;
• Employment and education details;
• Travel pass details
• Medical history;
• Family details;
• Journey history;
• Financial details;
• Details of complaints;
• Goods and services provided;
• Licenses, permits or certificates held
• Case file information;
• Incident and accident details.

We may also collect, store and use the following special category personal information:

• Race or ethnic origin;
• Health;
• Political opinions;
• Religious or philosophical beliefs;
• Trade union membership;
• Genetics;
• Biometrics;
• Sex life;
• Sexual orientation;
• Criminal Offence data

---

Legal basis for processing

The legal basis we rely on for processing your personal information is:

• The processing is necessary for the performance of a contract with the data subject;
• The processing is necessary for compliance with our legal obligations under s93 of the Transport Act 1985, s145 of the Transport Act 2000, s99 of the Local Transport Act 1968 and general powers under Part II of the Transport Act 1968;
• The processing is necessary for the performance of a task carried out in the public interest;
• Marketing purposes: where we have asked and you have consented to receive electronic marketing information about our services (you may withdraw your consent at any time).

The legal basis we rely on for processing your special category personal information is:

• The processing is necessary in the substantial public interest; or
• The data subject has given explicit consent to the processing.

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (for example, providing cycle hub membership), or we may be prevented from complying with our legal obligations (for example to provide you with a concessionary travel pass).

---

Information sharing recipients

We may share personal information about you with the following types of organisations:

• GMCA – in order for enquiries to be responded to appropriately where the GMCA and/or the Mayor is responsible for the subject matter;
• Transport Providers – including KeolisAmey Metrolink, bus operators and other public transport operators in order for enquiries to be responded to appropriately where the operator is responsible for the subject matter;
• Suppliers – in order to deliver services on our behalf;
• Partners – in order to deliver services for them (for example sharing information with the BBC to offer them Cycle Hub Membership);
• Police – in response to requests for information for crime investigations;
• Local Authorities – for confirmation of eligibility for Concessionary Plus and Care Leavers Travel Passes, and in order for enquiries to be responded to appropriately where the local authority is responsible for the subject matter;
• Healthcare Providers – for confirmation of eligibility for Concessionary Plus passes; and
• Educational Institutions – to administer funding for the Our Pass scheme.
• Cabinet Office – for the purpose of preventing and detecting fraud.

---

Sources of personal data other than the data subject

As well as information collected directly from you, we also collect or receive information from:

• Social Media;
• Police;
• Local Authorities;
• Greater Manchester Combined Authority;
• Transport Operators;
• Health and social care professionals;
• Family members;.
• Educational institutions.

---

Automated decisions

Registration for a customer account, purchase of tickets and validation of travel passes include some automated processing. If you think there has been an error, please contact us so we can investigate.

All other decisions we make about you involve human intervention.

---

Data retention criteria

We will only keep your information for as long as we need to for legal reasons, or for the length of time that we need to for our business needs.

If you request for your Bee Network Mobile App account to be deleted, we will anonymise your account details within 30 days. This means that you will no longer be able to access your account, purchase history or active tickets. We will retain the anonymised data for analysis and reporting purposes, but it could not be used to identify you.

Please note that data relating to your purchase history and transactions will be trained in our financial systems in line with our established retention periods.

Please see our Retention Schedule for further details.

---

Rights of individuals

You have a right to be informed about how and why your personal information is being processed. This notice fulfils that obligation. You also have a number of other rights.

Information about the following rights is available in our Guide to Exercising Your Rights:

• Contacting our Data Protection Officer;
• Raising a concern with us; and/or
• Making a compliant to the Information Commissioner

---

Updates

We may update or revise this Privacy Notice from time to time and provide supplementary privacy information as is necessary to TfGM’s current workforce.

Last updated: 15 September 2022

---