Voice of Customer survey privacy notice

Transport for Greater Manchester is committed to making sure that we tell you about the ways in which we use your personal information and that we have the right controls in place to make sure it is used responsibly and kept safe from inappropriate access, theft, or misuse.

This notice explains how we use your information and tells you about your privacy rights and how to law protects you.

Summary of the use of personal data for consultation and surveys

TfGM uses surveys as a way of measuring Customer Satisfaction levels across the Bee Network. In order for us to be able to respond to positive and negative feedback we need to give the customer the opportunity to provide their personal details.

We also collect personal demographic data to ensure that we are providing a good customer experience for the whole GM population.

---

What information we will collect from you (the purpose and legal basis for processing information)

The personal data that we need to be able to respond to customer consists of:

• A first name
• An email address OR a phone number

The personal data that we need to be able to ensure an equitable service across The Bee Network consists of:

• Gender
• Sexuality
• Ethnicity
• Age
• Disability

We process personal information as the law requires us to, or as it’s needed to perform a public function.

For personal data captured on our surveys and consultations we may use:

• Article 6(1)(a) consent: the individual gives clear consent for us to process their personal data for this specific purpose.
• Article (6)(1)(e) public task: the processing is necessary for the performance of a task carried out in the public interest.

For special category data we may use:
- Article 9(2)(g) processing is necessary for reasons of substantial public interest

---

How we ensure the security of your data

We are committed to keeping your information safe and protected from accidental loss or alteration, inappropriate access, misuse or theft.

As well as technical, physical and organisational controls, we recognise that a well-trained, informed, and security alert workforce minimises privacy risks from human error and/or threats from malicious actors.

We require our service providers to implement appropriate industry standard security measures, and only allow them to process your personal information for specified purposes as written in our contracts with them.

---

Information retention

TfGM will only keep your personal information for as long as the law specifies. Where the law doesn't tell us this, we'll decide how long we need to keep your personal information to meet our business needs.

We will keep personal data that is provided for Voice of the Customer for 2 years. This is to be able to complete a fair comparison of customer experiences on The Bee Network.

---

Transferring data

For surveys and consultations conducted by TfGM, personal data will not be transferred out of the UK/EU.

Where personal data is transferred outside of the UK/EU TfGM will only do so under certain circumstances including:

• With your consent
• If we have a lawful reason or legitimate interest to do so
• If we use service providers or contractors that are outside of the EU.

In these circumstances TfGM will provide further explanations and continue to make sure that the personal data is protected in the same way as it would be if data was remaining in the UK/EU.

At all times TfGM will comply with UK privacy laws.

---

Data sharing

There may be occasions where TfGM will share information with third parties. Where information may be shared TfGM will only do so if they have a lawful basis to do so and inform individuals who that information will be shared with, what information will be shared, the purpose of the sharing, and the security measures around the sharing.

We may also pass your information to other people and organisations providing a service on our behalf. These providers are legally obliged to keep your details securely and use them only to provide the service to you in accordance with our instructions.

If you have agreed that you wish to be contacted to discuss your responses in more detail, we will pass your name and contact details to our Customer Contact Centre who will be in further contact.

We may share personal information about you with the following types of organisations:

• GMCA – in order for enquiries to be responded to appropriately where the GMCA and/or the Mayor is responsible for the subject matter;
• Transport Providers – including KeolisAmey Metrolink, bus operators and other public transport operators in order for enquiries to be responded to appropriately where the operator is responsible for the subject matter;
• Suppliers – in order to deliver services on our behalf;
• Partners – in order to deliver services for them (for example sharing information with the BBC to offer them Cycle Hub Membership);
• Police – in response to requests for information for crime investigations;
• Local Authorities – for confirmation of eligibility for Concessionary Plus and Care Leavers Travel Passes, and in order for enquiries to be responded to appropriately where the local authority is responsible for the subject matter;
• Healthcare Providers – for confirmation of eligibility for Concessionary Plus passes; and
• Educational Institutions – to administer funding for the Our Pass scheme.
• Cabinet Office – for the purpose of preventing and detecting fraud.

---

What rights do individuals have?

TfGM must comply with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018.

Under data protection law, your rights include:

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
• Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
• Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish to make a request, please contact us at:
- Email: officeofdpo@greatermanchester-ca.gov.uk
- Post: Data Protection Officer, Transport for Greater Manchester, 2 Piccadilly Place, Manchester, M1 3BG

Information about the following rights is available in our Guide to Exercising Your Rights:

• Contacting our Data Protection Officer;
• Raising a concern with us; and/or
• Making a compliant to the Information Commissioner

---

How can I make a complaint?

If you are not satisfied with how TfGM is using the information we hold about you please contact our Data Protection Officer by emailing officeofdpo@greatermanchester-ca.gov.uk.

If you are still not satisfied with the TfGM’s response to any request to exercise your individual rights or if you believe that TfGM is not processing your personal data in accordance with the law, you can contact the Information Commissioners’ Office:
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
- Telephone: 0303 123 1113

---