1. Who we are
Transport for Greater Manchester is committed to making sure that we tell you about the ways in which we use your personal information and that we have the right controls in place to make sure it is used responsibly and kept safe from inappropriate access, theft, or misuse.
This notice explains how we use your information and tells you about your privacy rights and how to law protects you.
2. Summary of the use of the project/programme/survey
TfGM holds various events, workshops and conferences to promote its work as a transport provider and to support its statutory functions. Eventbrite is the software used to manage registrations for these events through online registration forms. This privacy notice tells you what to expect when TfGM collects personal information submitted within Eventbrite registration forms.
3. What information we will collect from you (the purpose and legal basis for processing information)
The information we will collect from you:
Personal data – Those who wish to attend will be asked to provide their first name, last name and email address.
Special category data – Those who wish to attend have the option to provide us with the following information, if they would like to do so: their racial or ethnic origin, religious or philosophical beliefs, their sexual orientation, and health data (whether they have any accessibility requirements or a disability that will affect how they are able to attend and experience the session). There is also a prefer not to say option for each of these fields on the application form.
Why are we collecting this data from you?
Collection of this data will help to facilitate the smooth running of all events in the series. Colleagues will be able to understand who is due to attend each event and any accessibility requirements that may need to be in place to ensure that attendees are able to benefit from attending the event. Collection of email addresses helps to disseminate information to those who have registered to attend, both before and after the event, allowing for information relating to the subject of the sessions to be shared effectively The collection of special category data allows us to understand which groups we are engaging with in Greater Manchester and will help us to strengthen future engagement activity.
Legal bases for the collection and processing of your information:
As TfGM has legal responsibilities for the wellbeing of Greater Manchester residents, and a responsibility to treat them fairly and equally, the legal basis for collecting and using the data will be:
- Article 6(1)(a) the individual(s) has given clear consent for the processing of their information for a specific purpose
- Article 6 1(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
Special category data:
Where the form asks for special category data (access requirements), the legal bases for processing this personal information are Article 6(1)(f), Article9(2)(a) and Article 9 (2)(g)
- The data subject has given explicit consent to the processing of those personal data for one or more specified purposes.
- The processing is essential for the public interest grounds. The register may be requested to disclose any access needs, this may prompt them to reveal physical or mental health information. This is asked to make sure that the event can accommodate everyone.
Withdrawal of consent:
- Participants sign up for an event and provide their information, they can manage the account they have made to share the information.
- Participants have the option to change, update or remove their account at any time.
- Participants can withdraw their consent whenever they want by letting us know and asking us to erase any information, we have hold.
4. How we ensure the security of your data
We are committed to keeping your information safe and protected from accidental loss or alteration, inappropriate access, misuse or theft.
As well as technical, physical and organisational controls, we recognise that a well-trained, informed, and security alert workforce minimises privacy risks from human error and/or threats from malicious actors.
We require our service providers to implement appropriate industry standard security measures, and only allow them to process your personal information for specified purposes as written in our contracts with them.
5. Information retention
We are only able to retain a copy of your personal information as long as it is still needed for the purpose(s) for which it was collected.
If you choose to register for a TfGM event through Eventbrite, any personal information within the Eventbrite form will be retained for as long as is considered necessary by Eventbrite and in accordance with their privacy policy Information on how to delete your Eventbrite account can also be found within their privacy policy.
If you register for an event through emailing or telephoning TfGM directly, the personal information you provide will be kept for one month after the end of the event. After that point, your personal information will be confidentially and securely disposed of.
6. Transferring data
Eventbrite physically stores personal data in the United States. To ensure that personal data can be lawfully transferred from the EU to our US-based servers, Eventbrite agrees that it will be bound by the Contractual Clauses European Commission. These clauses provide organisations based in the USA with a way of showing they provide adequate protection to personal information transferred from the UK.
Eventbrite provides a copy of these standard clauses on their website.
GMCA have carried out our own assessment of the organisation’s security and data protection provisions and are satisfied they have appropriate measures in place to protect your personal information.
7. Data sharing
As your personal information will be submitted within a registration form on Eventbrite, any personal information you submit will be stored by, and accessible to, Eventbrite.
- Eventbrite processes personal information in accordance with its own privacy policy
- Please only submit any personal information which you are happy to have processed in accordance with Eventbrite’s privacy policy.
- To ensure the health and safety of participants at TfGM events we will share your any relevant dietary requirements to catering staff at the event venue so that your dietary requirements can be met.
- We will also share any relevant access requirements with the event venue to ensure that the needs of participants are met.
- On occasion we will share details of the names of attendees with the TfGM security team. This is to ensure that appropriate security measures are in place to create a safe event for all attendees. Any sharing of names will be deleted in line with this Privacy Notice.
- We will not disclose your information to any other organisation other than those listed above except where required to do so as part of our functions or by law.
8. What rights do individuals have?
TfGM must comply with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018.
Under data protection law, your rights include:
- Your right of access - You have the right to ask us for copies of your personal information.
- Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
- Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
- Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
If you wish to make a request, please contact us at:
- Email: data.protection@TfGM.com
- Post: Data Protection Officer, Transport for Greater Manchester, 2 Piccadilly Place, Manchester, M1 3BG
9. How can I make a complaint?
If you are not satisfied with how TfGM is using the information we hold about you please contact our Data Protection Officer by emailing data.protection@TfGM.com.
If you are still not satisfied with TfGM’s response to any request to exercise your individual rights or if you believe that TfGM is not processing your personal data in accordance with the law, you can contact the Information Commissioners’ Office:
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
- Telephone: 0303 123 1113