Privacy Notice

 

Our contact details 

Name

Mike Duncombe 

Address

Paradise House, 35, Paradise Street, Sheffield, S3 8PZ

Phone Number

0114 3035701

Email

mike.duncombe@yorcard.co.uk

The type of information we have

We currently collect and process the following information as Data Processor under contract to one or more Data Controllers:

  • For Public Transport Customers
    • Name, Email Address, Mobile Phone Number
    • Payment Card details (Account Number, Name on Card, Expiry Date, CVV)
    • Age
    • Ticket Products bought and Used
    • Entitlement to reduced fare
    • Concessionary Cards Held
    • Bus and Train Services where passengers have used their tickets and cards
    • Approximate location where passengers have used their tickets, entitlement, or concessionary cards

We collect and process the following information as Data Controller:

  • For Employees
    • Name, Street Address
    • Date of Birth
    • Salary
    • National Insurance and Tax details
    • Nationality and right to work in the UK
    • Personal Email Address
    • Personal Mobile Phone Number
  • For Employees of Third-Party Organisations
    • Name
    • Work Email Address
    • Work Telephone and Mobile Phone Number

How we get the information and why we have it

You provide some of the personal data we process directly for one of the following reasons:

  • To create and maintain a secure ticket wallet for users of MCard Mobile:
    • Yorcard keeps:
      • Name, 
      • Email Address,
      • Mobile Phone Number,
      • Entitlement to reduced fare status,
      • Age
      • Tickets purchased and the price paid
      • Transport Service on which the passenger used the ticket
      • The location of the ticket usage
    • Yorcard passes on to a regulated third-party:
      • Payment Card details.

We also receive personal information indirectly, from the following sources in the following scenarios:

  • When you use a ticket or card on a bus or train, Yorcard receives the following information from the transport operator
    • Concessionary Card Number, or Entitlement Card Number, or Ticket Unique Identifier
    • Ticket Type
    • Approximate location
    • Service Details (for example, route information, date and time)

 

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

Legitimate interests (in respect of processing ENCTS and Entitlement cardholder data):

the processing is necessary for Yorcard’s legitimate interests or the legitimate interests of the Data Controller

Contract (in respect of all other data):

 

the processing is necessary for a contract Yorcard has with the individual

What we do with the information we have

We use the information that you have given us to provide information to the Data Controller to enable them to pay transport operators. There are two cases: a reimbursement of fares foregone by the operator in concessionary and entitlement schemes, and apportionment of the receipts for multi-operator tickets sold. In both cases, the Data Controller needs accurate ticket and card usage data. 

We may share this information with some transport operators in the concessionary and entitlement schemes:

  • A Lyle & Son
  • Acklam’s Travel
  • Calderdale MBC
  • Coachlines
  • CT Plus
  • DK Minibuses
  • E Stott and Son
  • East Riding of Yorkshire Council 
  • Fourways
  • Globe Holidays Limited
  • Greenline
  • Guest Automotive
  • Halifax Bus (TJ Walsh)
  • Hull City Council
  • Hulley’s Of Baslow
  • Hunter Coaches
  • J&B Travel Ltd
  • Jacksons of Silsden
  • Kilvington’s of Leeds
  • Kirklees MBC
  • Leeds City Travel
  • North East Lincolnshire Council 
  • North Yorkshire County Council
  • Powell’s Bus Company Limited
  • Procter’s
  • R & S Waterson
  • Red Bus Days
  • Reliance Motor Services
  • Ross Travel Group
  • Sheffield Community Transport
  • South Pennine Community Transport
  • South Yorkshire PTE 
  • Station Coaches
  • Streamline
  • Stringers
  • Tetley’s Travel
  • TLC Travel
  • TM Travel
  • Transdev Blazefield Ltd
  • TravelXpress
  • West Yorkshire Combined Authority
  • Yelloway Coaches Ltd
  • York Pullman
  • Yorkshire Tiger

We only share name, date of birth, email address, and payment card details given to us through MCard Mobile app with West Yorkshire Combined Authority. 

How we store your information 

We store your information securely in data centres in the UK, France and Ireland. 

We keep all personal information for six years. 

Your data protection rights

Under data protection law, you have rights, including:

Your right of access 

You have the right to ask us for copies of your personal information. 

Your right to rectification 

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 

Your right to erasure 

You have the right to ask us to erase your personal information in certain circumstances. 

Your right to restriction of processing 

You have the right to ask us to restrict the processing of your information in certain circumstances. 

Your right to object to processing 

You have the right to object to the processing of your personal data in certain circumstances.

Your right to data portability 

You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

There is no charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at DPO@yorcard.co.uk if you wish to make a request.

How to complain

You can also complain to the Information Commissioner (ICO) if you are unhappy with how we have used your data.

The ICO’s address:            

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113