Railcard Survey Privacy Notice
This privacy notice
- We are providing you with this information so you know what data we are collecting from you as part of this research study; what we are going to do with it; and your rights over our use of your personal data.
Your personal data
- Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation 2016/679 (the “GDPR”).
Who are we?
- Rail Delivery Group is the Data Controller. This means it decides how your personal data is processed and for what purposes.
- SYSTRA Ltd. Is the Data Processor. This means they are responsible for collecting and processing your personal data as part of the surveys you are being sent on a monthly basis.
What information is being collected?
- During each survey we are collecting your gender, date of birth, first part of your postcode and email address. We are also collecting information on your rail travel, usage of your 26-30 Railcard and satisfaction with the Railcard.
How is it collected?
- The surveys are web-based.
Why is it being collected?
- Our legal basis for collecting this data is known as ‘legitimate interest’. We require your email address in order to link the different surveys that you complete so that we can understand how the 26-30 Railcard is being used throughout the year in order to inform the full release of the Railcard. Email addresses are also required to know who has completed each survey to enable us to know who is entitled to a £30 voucher for completing all 12 surveys.
How will it be used?
- SYSTRA complies with its obligations under the GDPR by: keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
- Your data will be analysed anonymously with all other participant data. SYSTRA will report the findings of the research to the Rail Delivery Group. No personal identifiers will be used in the report.
Who will it be shared with?
- SYSTRA will not share your personal data outside the research team and RDG.
How long do we keep your personal data?
- We keep your personal data for no longer than reasonably necessary. This will be no later than 31st August 2019, after which all personal data will be destroyed.
Your rights and your personal data
You have the following rights with respect to your personal data:
- The right to request a copy of your personal data which SYSTRA holds about you;
- The right to request that SYSTRA corrects any personal data if it is found to be inaccurate or out of date;
- The right to request your personal data is erased where it is no longer necessary for SYSTRA to retain such data;
- The right to withdraw your consent to the processing at any time;
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
- The right to object to the processing of personal data;
- The right to lodge a complaint with the Information Commissioners Office.
To exercise all relevant rights, queries or complaints please contact the Data Protection Officer at firstname.lastname@example.org.
You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
If you would like:
- Any more information about the research study, or our use of your data;
- To request to see the personal data held on you; or
- To request to withdraw your personal data
Please contact 2630RailcardSurvey@systra.com.