Information Services Privacy Notice

Our core data protection obligations and commitments are set out in the organisation’s primary privacy notice.

This notice provides additional privacy information for: suppliers and contacts at suppliers whose data we process to manage services provided under contract; customers whose data we collect in surveys; customers and employees of TfGM where their records or accounts are the subject of enquiries to our internal Serviceline helpdesk.

For details of how we use cookies on our website, please see our Cookie Policy.

---

Purposes

We collect [or obtain] your personal information for the following purpose(s):

• To process data required for the management of IT services provided by TfGM.

---

Categories of personal data

In order to carry out these purposes we collect and obtain:

• Personal details;
• Visual images, personal appearance and behaviour;
• Details of complaints;
• Incident and accident details;
• business activities of individuals;
• Licenses, permits or certificates held;
• Goods and services provided

We do not collect, store or use any special category personal information.

We may also collect, store and use the following special category personal information:

• Race or ethnic origin;
• Religious or philosophical beliefs;
• Health.

---

Legal basis for processing

The legal basis we rely on for processing your personal information is:

• The processing is necessary for the performance of a contract with the data subject; or
• The processing is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller, namely carrying out our duties under s10A of the Transport Act 2968.

The legal basis we rely on for processing your special category personal information is:

• The processing is necessary for reasons of substantial public interest, namely equality of opportunity or treatment.

If you fail to provide certain information when requested, we may not be able to perform the contract we have entered into with you (such as being able to contact your company to discuss the performance of a contract).

---

Information sharing recipients

We may share personal information about you with the following types of organisations:

• Suppliers – in order to process data and deliver services on our behalf.

---

Sources of personal data other than the data subject

As well as information directly collected directly from you, we also collect or receive information from:

• Suppliers – providing contact details of their employees for the performance of the contract we have with them.

---

Automated decisions

For this processing, all the decisions we make about you involve human intervention

---

Data retention criteria

Our Retention Schedule outlines how long we retain certain types of information.

---

Rights of individuals

You have a right to be informed about how and why your personal information is being processed. This notice fulfils that obligation. You also have a number of other rights.

Information about the following rights is available in our Guide to Exercising Your Rights:
- Contacting our Data Protection Officer;
- Raising a concern with us; and/or
- Making a compliant to the Information Commissioner

---

Updates

We may update or revise this Privacy Notice from time to time and provide supplementary privacy information as is necessary to TfGM’s current workforce.

---