Domestic Rail Pass Survey: Privacy Notice
- We are providing you with this information so you know what data we are collecting from you as part of this research study; what we are going to do with it; and your rights over our use of your personal data.
Your personal data
- Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation 2016/679 (the “GDPR”).
Who are we?
- ATOC Ltd (ATOC), who manages Railcards on behalf of Britain’s train companies, is the Data Controller. ATOC Ltd has contracted SYSTRA Ltd to conduct market research on their behalf.
- SYSTRA Ltd (SYSTRA) is the Data Processor, and Dynata is a Sub-Processor. This means they are
- responsible for collecting and processing your personal data for the purposes of the optional prize draw only.
What information is being collected?
- As part of the survey we will ask you some questions about: your travel behaviour, attitudes and preferences; how these might be affected by factors such as Covid-19; and your feedback on a proposed rail pass. The survey responses will be anonymised and will not be linked to your personal data.
- If you are interested in participating in a prize draw, we will ask you to confirm your email address. This is so we can send you the prize if you are one of the winners. If you choose not to enter the prize draw, we will not collect your personal data.
How is it collected?
- For those of you completing the survey after being invited by ATOC, you will be asked if you want to provide your email address for the optional prize draw at the end of the survey.
- For those of you completing this survey through Dynata, you will have already provided personal data as part of your registration to the panel. This information will not be shared with ATOC or SYSTRA.
- Any further information regarding your travel behaviour, attitudes and preferences is collected through the online survey.
Why is it being collected?
- Our legal basis for collecting this data is known as ‘legitimate interests’. This means we are processing your data in a way that you as the data subject would reasonably expect.
- Your email address will need to be confirmed if you are interested in taking part in the prize draw.
How will it be used?
- SYSTRA complies with its obligations under the GDPR by keeping personal data accurate; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
- Your personal data will only be used in the prize draw for the purpose to send you the prize if you are one of the winners. If you choose not to enter the prize draw, we will not collect your personal.
- Your data will be analysed anonymously with all other participant data. SYSTRA will report the aggregated, anonymous findings of the research to ATOC; which may share the anonymised results with other partners and publish the research. No personal identifiers will be used in the report.
Who will it be shared with?
- Your responses will only be shared between SYSTRA and Dynata. How long do we keep your personal data?
- We keep your personal data for no longer than reasonably necessary. After the end of the study, SYSTRA will erase all personal data that was collected as part of the research.
- This will be no later than 30th April 2022, after which all personal data will be destroyed.
Your rights and your personal data
- You have the following rights with respect to your personal data:
- The right to request a copy of your personal data which SYSTRA holds about you;
- The right to request that SYSTRA corrects any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for SYSTRA to retain such data;
- The right to withdraw your consent to the processing at any time;
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data;
- The right to lodge a complaint with the Information Commissioners Office.
To exercise all relevant rights, queries or complaints please contact SYSTRA’s UK Compliance Team at UK_compliance@systra.com.
If you have any concerns or questions you can also contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
If you would like any more information about the research study please contact the SYSTRA research manager, Rafael Maldonado: firstname.lastname@example.org.