hart@medibus.org.uk 01964 536684

Data Protection Policy


North Holderness Community Transport (H.A.R.T.) Data protection

Information about what personal information might be held, what a data protection request is, who can use the service, is there a cost, how to apply, enquiring about someone who has died, getting copies of everything held about you, is information limited for each request, what the North Holderness Community Transport (H.A.R.T.) obligations are, what if you find incorrect data, what is information is missing and help in understanding the information.

What personal information might the North Holderness Community Transport (H.A.R.T.) hold about me?

The North Holderness Community Transport (H.A.R.T.) holds a range of personal information on its members that it uses to carry out its work.

We keep personal information so that we can provide you with the services you require. It also allows us to maintain a record of the services you have requested. Your personal details are a vitally important part of making sure that we deliver effective and efficient services to you.


What is the Data Protection Act 2018?

The Data Protection Act 2018 is a law that came into force in May 2018. It was introduced to protect personal data, that is data about living identifiable individuals, no matter how it is processed, what it is processed for or who processes it.

The act covers data held on computers and manually processed records.

The act specifies rules and conditions which all users (the act calls us “Controllers”) of personal information must obey when obtaining and using information about you. This includes North Holderness Community Transport (H.A.R.T.).

Under Data Protection legislation, members of the public can:

  • ask the North Holderness Community Transport (H.A.R.T.) whether or not we hold personal information about themselves
  • ask what we use the information for
  • be given the information that we hold about themselves, provided that it does not disclose information about a third party
  • be given details about the purposes for which North Holderness Community Transport (H.A.R.T.) uses the information, and of other organisations or persons to whom we may disclose it
  • ask for incorrect data to be corrected
  • ask us not to use personal information about them for direct marketing
  • ask us not to process information which is likely to cause damage or distress
  • ask us not to make decisions about them based on the automatic processing of the data
  • seek compensation for damage or distress if these are caused by a failure to comply with certain requirements of the Act.

What are the North Holderness Community Transport (H.A.R.T.) obligations to me under the Act?

  • When you supply us with information, you will be told all the purposes for which it may be used and to whom it may have to be disclosed
  • We will not disclose your information to any third party without your consent unless we are legally required to do so, or it is necessary in order to provide you with the services to which you are entitled, or which you have requested
  • We will ensure that any third party to whom we disclose your data uses it only for purposes that we have stipulated
  • We will not hold any information about you unless it is relevant to the purposes for which it is being processed
  • We will periodically review the information that we hold about you and delete information that is out of date and no longer needed
  • We will not transfer or disclose your information, without your consent, to any country outside of the European Economic Area that is not considered to provide an adequate level of protection

What is a subject access request (SAR) data protection request?

A subject access request (SAR) /data protection request is a request made by anyone to see personal information held about them by the North Holderness Community Transport (H.A.R.T.). For the request to be valid a fee of £10 and identification is needed. Once the request is valid, the North Holderness Community Transport (H.A.R.T.) have 40 days to process the request and provide the information to the individual. If the request takes longer than this to process it is a breach of the Data Protection Act 2018.


Who can make a request?

Anyone can request access to their personal information held on file. If information is requested about someone else, written consent from that person would be required.

Can I make a request for my child’s information (parent or guardian)?

Everyone has a right of access to their personal information, including children. However, as young children may not understand this right or are not capable of exercising this right, in some cases their parents may do so on their behalf.

There is no particular age when a child becomes capable of exercising his or her own data protection rights. Rather, the North Holderness Community Transport (H.A.R.T.) must assess the child’s maturity and level of understanding when determining whether a parent should be making a request on the child’s behalf. To do this, the North Holderness Community Transport (H.A.R.T.) may have to contact you to obtain further information.

As a general guide, a child of 12 and above is likely to have sufficient maturity but as stated, this will depend on the individual circumstances.

The North Holderness Community Transport (H.A.R.T.) needs to be very careful about the disclosure of children’s personal information. If the North Holderness Community Transport (H.A.R.T.) is in any doubt as to whether the parent or guardian is entitled to make a request on their child or ward’s behalf, then the North Holderness Community Transport (H.A.R.T.) may refuse to grant access.


Can I ask for information on someone else’s behalf?

You can only request someone else’s information if you have their written consent to do so or have a legal form of authority (such as power of attorney) to act on their behalf.


Can someone ask for information on my behalf?

You may have a representative to act on your behalf when making a subject access request, such as, a solicitor, financial adviser, doctor, carer or family member.

In this case, the North Holderness Community Transport (H.A.R.T.) must be satisfied that you have consented to this arrangement so we ask your representative (and, in some cases, you) to demonstrate this by providing proof of your identity and your signature.


How do I make a request?

You can make a request by downloading the SAR form (link) and sending it to the following address:

North Holderness Community Transport (H.A.R.T.)

H.A.R.T Yard

Cliff Road

Hornsea

HU18 1JB

or by email:

hart@medibus.org.uk

To accompany the request we will need a £10 fee (cheque made payable to North Holderness Community Transport or postal order) and proof of identity and address. The proof of identity will often be a passport, driving licence with photograph, or birth certificate, the proof of address needs to be a bank statement or bill dated in the last three months where the address is the same that you wish the information to be sent to. You can also pay your fee and submit your request form or letter at the same time.

If possible, please complete the form and send with your payment (and copies of you identity and proof of address as above) to us (postal address is included in the form). Completing this form is not essential, but it does help us to deal with your request more swiftly.


Is there a cost involved?

The North Holderness Community Transport (H.A.R.T.) makes a £10 charge per request, payable in advance.


Can I make a request about someone who has died?

You cannot make a subject access request/ data protection request about someone who has died as the Data Protection Act only applies to living individuals. You can still make a request for information on someone who has died under the Freedom of Information Act.


Will I get copies of everything held about me?

In most cases you will be supplied with all the information you have requested (as long as it is held by the North Holderness Community Transport (H.A.R.T.) and does not include third party information). Sometimes it may be necessary to summarise information so as not to disclose third party information. There are other circumstances where information can be withheld for example if it would put at risk a criminal investigation or catching an offender. In all cases it will be made clear to you if information has not been released and for what reason.


Is the amount of information I request limited?

If ‘disproportionate effort’ (e.g. costly, takes a long time, difficult to retrieve information) is required to fulfil your request then you may not receive all the information you have asked for as a written copy.

To avoid such situations, it is advisable to limit your request to a single area of business. Larger requests can be submitted, but may be split and each charged £10. We would advise you at the point of receipt if this would be the case.


What do I do if I find my information is incorrect?

You must write to the North Holderness Community Transport (H.A.R.T.) telling us what data is incorrect and asking for the data to be corrected. The North Holderness Community Transport (H.A.R.T.) must tell you what it has done within 21 days of receiving your request. If the North Holderness Community Transport (H.A.R.T.) does not agree that the information is incorrect you can ask it to record your disagreement on your records.


What do I do if my information is missing?

You can appeal to North Holderness Community Transport (H.A.R.T.) through its appeals procedure. Alternatively, you can appeal to the Data Protection Commissioner who will look into the matter on your behalf.

How can I stop the North Holderness Community Transport (H.A.R.T.) using my information for direct marketing, or for a purpose that could cause me damage or distress?

If you do not want us to use your personal details for direct marketing, you should write to us at the address shown on this page asking us not to allow this.

If you think that the use of your personal data could cause you damage or distress you should write to us and explain how we are causing you possible distress or damage, so that we can take any necessary steps to stop this happening.

The Act requires us to respond no later than 21 days after we have received your request. If we do not do so, or refuse to do as you ask, you can appeal to the court.


Who can I contact if I need further information?

You can contact the North Holderness Community Transport (H.A.R.T.) by:

phone: 01964 536684

or email: hart@medibus.org.uk

You can also get further information about the Act, and about your rights, by contacting the Information Commissioner: Information Commissioners Office (external website)


What do I do if I’m not happy with how the North Holderness Community Transport (H.A.R.T.) has dealt with me?

The Information Commissioner’s Office (ICO) is the United Kingdom’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. If you think we have failed to comply with the legislation, then you can contact the them using the details below.

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

ICO helpline: 0303 123 1113 or (01625) 545745

or by visiting their website: Information Commissioners Office (external website)