Our core data protection obligations and commitments are set out in the organisation’s primary privacy notice.

This notice provides additional privacy information for: visitors to TfGM buildings and individuals with whom we do business such as professional contacts and colleagues in other organisations.

Please note: for details of how visitors personal data is processed using CCTV, please see the CCTV Privacy Notice. Other Privacy Notices may also be relevant to you, which can be accessed from the primary privacy notice above.

Purposes

We collect [or obtain] your personal information for the following purpose(s):

  • Conducting business for TfGM or another organisation;
  • To help create a safe working environment for you when entering the premises;
  • Inviting visitors to meetings, and administrating visits to TfGM buildings.

Categories of personal data

In order to carry out these purposes we collect and obtain:

  • Personal details;
  • Employment details;
  • Goods and services provided.

Legal basis for processing

The legal basis we rely on for processing your personal information is:

  • Because it is necessary for a task carried out in the exercise of official authority vested in TfGM under s10A of the Transport Act 1968; or
  • Because it is necessary for the purpose of the legitimate interests of TfGM or a third party organisation.

A Legitimate Interests assessment has been undertaken for this processing.

Information sharing recipients

We may share personal information about you with the following types of organisations:

  • Suppliers – in order to deliver services on our behalf;
  • Partners – in order to conduct business over email between a number of parties, and to book meetings with attendees from a number of organisations.

Sources of personal data other than the data subject

As well as information directly collected directly from you, we also collect or receive information from:

  • Publicly available information e.g. an organisation’s webpage; and
  • Colleagues in the individual’s employing organisation, or other colleagues in other organisations.

Automated decisions

For this processing, all the decisions we make about you involve human intervention

Data retention criteria

Our Retention Schedule outlines how long we retain certain types of information.

Rights of individuals

You have a right to be informed about how and why your personal information is being processed. This notice fulfils that obligation. You also have a number of other rights.

Information about the following rights is available in our Guide to Exercising Your Rights:

  • Contacting our Data Protection Officer;
  • Raising a concern with us; and/or
  • Making a compliant to the Information Commissioner

Updates

We may update or revise this Privacy Notice from time to time and provide supplementary privacy information as is necessary.