Our Pass Evaluation Privacy Notice

1. Who we are?

Transport for Greater Manchester [“TfGM”] is committed to making sure that we tell you about the ways in which we use your personal information and that we have the right controls in place to make sure it is used responsibly and kept safe from inappropriate access, theft, or misuse.
This notice explains how we use your information and tells you about your privacy rights and how to law protects you.
For further information about our core data protection obligations and commitments please see TfGM’s primary privacy notice.

---

2. Summary of the survey

TfGM is undertaking an online survey to understand the impacts of the concessionary Our Pass scheme.

Key aspects of this research will be to explore:
(1) bus use amongst those who no longer have the pass; and
(2) extent to which Our Pass supported freedom of choice of college.

Findings from this survey will feed into decision-making around whether to continue funding the concessionary pass or not.

SYSTRA have been commissioned to undertake this work on TfGM’s behalf.

TfGM is the Data Controller. This means TfGM has decided how your personal data is processed and for what purposes.

SYSTRA is a Data Processor. This means that they are responsible for collecting and processing your personal data on behalf of the Data Controller.

---

3. What information we will collect from you (the purpose and legal basis for processing information)

The personal information we hold in order to contact you about the survey includes your name and email address. This was collected when you applied for your Our Pass.

The survey will ask you questions in relation to your travel behaviour, attitudes and perceptions, to understand what type of transport user you are, why you travel in the way you do, and if this has changed. We also ask further questions in the survey to capture demographic information. These questions are optional and include:

• Postcode
• Age
• Gender
• Working status
• Health and disability
• Ethnicity

As part of the survey, we will also ask if you want to be entered into a prize draw and/or to be contacted regarding future research opportunities. If you answer yes, we will ask you to provide:

• Name
• Telephone number
• Personal email address

These questions are optional.

---

4. Our lawful basis for processing under GDPR is:

Article 6 1(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

For the more sensitive data: Article 9 2(g) processing is necessary for reasons of substantial public interest.

For the prize draw: Article 6 1 (a) the data subject has given consent to the processing of their personal data.

You can withdraw your consent at any time by contacting the TfGM Customer Contact Centre (0161 244 1000) or emailing Insight@tfgm.com.

---

5. How information is collected

This online survey will be distributed by SYSTRA and is completed online.  This is collected via SNAP Survey software. SNAP Surveys is ISO 27001 certified.

More information can be found on the SNAP Survey website.

---

6. How we ensure the security of your data

TfGM and SYSTRA comply with their obligations under data protection legislation by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

TfGM have contracts in place with SYSTRA to ensure that, as a data processor, SYSTRA have all the necessary security measures in place.

All electronic survey information will be encrypted with a secure password. SYSTRA will restrict access to your personal information.

Your data will be analysed anonymously with all other participant data. SYSTRA will report the findings of the research to TfGM. No individual will be made identifiable during reporting.

---

7. Information retention

All personal data we collect during the survey will be deleted within two years of the survey closing.

All contact details gathered for future research will be deleted after two years, unless you request their deletion. Please contact insight@tfgm.com to request to remove yourself from our records.

Personal data for those who have entered the prize draw will only be kept until the prize has been announced (2 weeks after the end of fieldwork) and the winner has received their prize.

---

8. Transferring data

Data collected and stored by TfGM and SYSTRA will be stored in the United Kingdom.

The survey data is being collected using a survey tool called SNAP Surveys. SNAP Surveys use UK Rackspace as the web host and data collected is held on servers in the UK. For technical reasons it maybe be necessary for SNAP Surveys staff in the USA to access the data. However, SNAP Surveys have put in place an Intra Group Data Processing Agreement with their US subsidiary which incorporates standard contractual clauses which provide safeguards to ensure that your data is held securely.

Similarly, should Rackspace need to permit access to its servers from outside of the EEA or the UK, it will ensure that it has put in place appropriate and compliant means to do so. If you would like more details on how SNAP Surveys comply with data protection legislation you will find it on the SNAP Surveys website.

Once the survey closes all data will be deleted from SNAP surveys and stored by SYSTRA in the UK where access is restricted to the immediate project team.

Data sharing

The information collected as part of this survey will only be used by TfGM for the purposes explained above. We will not share any information that can identify you with any third parties.

---

9. What rights do individuals have?

TfGM must comply with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018.

Under data protection law, your rights include:

• Your right of access - You have the right to ask us for copies of your personal information.

• Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

• Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.

• Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.

• Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish to make a request, please contact us at:

Email: data.protection@tfgm.com

Should you wish to find out more about SYSTRA's data protection processes or contact their Data Protection Officer, please contact SYSTRA's UK Compliance Team at UK_compliance@systra.com

---

10. How can I make a complaint?

If you are not satisfied with how TfGM is using the information we hold about you, please contact our Data Protection Officer by emailing data.protection@tfgm.com.

If you are still not satisfied with TfGM’s response to any request to exercise your individual rights or if you believe that TfGM is not processing your personal data in accordance with the law, you can contact the Information Commissioners’ Office: Telephone 0303 123 1113.

---