Privacy Notice for Service Users
Introduction
We are committed to protecting the privacy and security of your personal information. We make sure we comply with all aspects of the UK’s data protection framework including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.
We have developed this privacy notice in order to be as transparent as possible about the personal information we collect and use.
Please ensure you read this notice carefully and contact us if you have any questions or concerns about our privacy practices.
Who we are?
In this Privacy Policy, “WMDAS”, “we” “us” or “our” means The Wales Mobility and Driving Assessment Service, registered charity in England and Wales (1056588).
We are a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
We have appointed a dedicated a Data Privacy Manager to ensure appropriate oversight of our data processing activities. The Data Privacy Manager, is Sandra Hutchings (Director of Services) who can be contacted by telephone on 029 20 555130 or by email sandra@wddac.co.uk and can provide any clarity that you may need about this privacy notice.
What this Notice Covers?
We ask that you read this privacy notice carefully as it contains important information about:
- how we collect your personal information;
- the personal information that we collect and use;
- the lawful bases we rely on to collect and use personal information;
- why we collect and use personal information;
- sharing your personal information;
- whether we transfer personal information outside the EEA;
- how long we keep information;
- how we ensure personal information is secure; and
- your privacy rights.
You should ensure that you read this general privacy notice alongside any specific privacy notice we may issue to you, from time to time, in relation to your information.
How we collect your personal information
We will collect, store and use a variety of personal information about you. A large proportion of the information we hold will be given to us directly by you through the application process but we may also receive information from third parties including from health care professionals (such as motability consultants/ general practitioners/ occupational therapists) or the DVLA in order to gain a better understanding of your needs.
Any third party that provides your personal information to us will need to make sure that they have a lawful basis for giving us your data, which may mean you have consented to the data being given to us although there may be other lawful reasons which justify them having passed your data on to us.
The personal information that we collect and use
The personal information that we collect from you includes:
- your name
- your contact details (including postal address, telephone number and e-mail address)
- your date of birth
- your gender
- any medical condition that you may have and how it affects you
- the outcome of your driving assessment
- a record of your contact with us (including details of any phone calls or emails)
Certain types of personal information are in a special category under data protection laws, as they are considered to be more sensitive. Examples of this type of data include information about health, race, religious beliefs, political views, trade union membership, sex life or sexuality and genetic/biometric information.
We only collect this type of information about you to the extent that there is a clear reason for us to do so or where you make it public or volunteer it to us. Wherever it is practical for us to do so, we will make why we are collecting this type of information clear and what it will be used for.
The lawful basis that we rely on to collect and use personal information
Save in certain circumstances (which are outlined below), we will only process your personal information when you have given us your explicit consent to do so. Consent is initially obtained at the outset of the process when an application for a driving assessment is made and thereafter will continue to be requested at each stage of the driving assessment.
As noted above, in very limited circumstances we may need to process your information without your consent where required by law or where we have another legitimate interest in doing so. For further information as to when this might apply, please refer to the ‘sharing your personal information’ section below.
You have the right to withdraw your consent at any time, but please note that this will prevent us from being able to continue with the driving assessment (see below for further detail).
Why we collect and use personal information
We collect and use personal information for the following purposes, relying on your explicit consent to do so:
- to provide you with the service you asked for;
- to assist us to complete your driving assessment;
- to keep a record of your relationship with us;
- to respond to or fulfil any requests, complaints or queries you make to us;
- to send you correspondence and communicate with you, including updating your contact details.
What happens if you withdraw consent to us processing your personal information?
Withdrawal before the assessment
Please note that if you withdraw your consent to us processing your personal information before the driving assessment takes place, we will not be able to continue with the driving assessment and we will cease taking any further instructions from you in this regard. We will then proceed to delete the personal information that we hold about you.
Withdrawal after the assessment
If you withdraw your consent to us processing your personal information after the driving assessment has taken place, please be advised that we will need to keep a limited amount of your personal information on file, even if consent is withdrawn. This personal information is limited to your name, address and outcome of the assessment (and any related correspondence to the assessment outcome). This is in the interests of safety in the event that we believe that you are unsafe to continue driving and pose a threat to both yourself and other road users.
Sharing your personal information
We sometimes need to share your personal information with other people or organisations. This includes family members, the DVLA, occupational therapists who have been involved in the driving assessment and your general practitioner or consultant. We will generally only do this when you have given us your consent to share the information with the third party, or in some limited circumstances where required by law or where we have another legitimate interest in doing so.
As indicated above, we may need to share your information with third parties without your consent. If we need to do this, we will notify you and explain the legal basis which allows us to do so. For example, in rare circumstances we may need to inform the DVLA if the outcome of your assessment is such that you are not fit to drive and we have serious concerns over your safety and other road users. We will only do this where you do not self-report to the DVLA and continue to drive against our advice.
We will always write to you and give you two weeks to self-report in this first instance, but if we are concerned that you have not done this and continue to drive, we will proceed to contact the DVLA. We will share your name and address with the DVLA and highlight our concern that you are unsafe to drive. We will only share a copy of your assessment outcome with the DVLA when we are expressly asked to do so.
We may also be required to share personal information with regulatory authorities, government agencies and law enforcement agencies from time to time. We will use reasonable endeavours to notify you before we do this, unless we are legally restricted from doing so.
Transfers Outside the European Economic Area (EEA)
We do not send personal data outside the EEA. None of the service providers we use to help us run our businesses are based outside of the EEA.
Data security
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
Automated decision-making
We do not currently take any decisions about you using automated means, however we will notify you in writing if this position changes.
Keeping your information updated
We would really appreciate it if you let us know if your contact details change so at to ensure that the information we have is as up to date and accurate as possible.
How long we keep personal information
Our policy is to not hold personal information for longer than is necessary to fulfil the purposes we collected it for.
We will keep the personal information that we collect about you for a period of 6 years from the date that it was collected from you.
How we ensure personal information is secure
We are strongly committed to information security and we take reasonable and appropriate steps to protect your personal information from unauthorised access, loss, misuse, alteration or corruption. We have put in place physical, electronic, and managerial procedures to safeguard and secure the information you provide to us including the use of encryption and pseudonymisation.
Your privacy rights
You have a number of rights in relation to your personal data which we have. Not all of the rights apply in all circumstances. If you wish to exercise any of the rights, please contact us in the ways detailed below:
- You have a right of access to the personal information we hold about you
- You have the right to ask us to correct any information we hold about you that you think is wrong or incomplete
- You have the right to object to any processing of your personal information where we are relying on a legitimate interest to do so and you think that your rights and interests outweigh our own and you wish us to stop. There may, however, be legal or other legitimate reasons why we need to keep or use your information. If this is the case, we will consider your request and explain why we cannot comply with it. You can ask us to restrict the use of your personal information while we are considering your request.
- You have the right to ask us to delete your information. This is also known as the right to be forgotten or to erasure. We will not always agree to do this in every case as there may be legal or other legitimate reasons why we need to keep or use your information. If this is the case, we will consider your request and explain why we cannot comply with it. You can ask us to restrict the use of your personal information while we are considering your request.
- Where our processing of your personal information is based on your consent, you have the right to withdraw it at any time. Please contact us if you want to do so. Please also refer to the relevant section above which explains that in certain circumstances we may need to continue processing your personal information even when consent is withdrawn where required by law or where we have another legitimate interest in doing so.
- You may have a right to obtain the personal information that you have given us in a format that be easily re-used and to ask us to pass this personal information on in the same format to other organisations. Please contact us to find out if this right applies to you.
How to Complain
Please let us know if you are unhappy with how we have used your personal information. You can contact us the following ways:
By telephone, email or writing to the centre at which you were assessed. Address all correspondence to the Director of Services, Sandra Hutchings.
Telephone 02920 555130 or email sandra@wddac.co.uk
You also have the right to complain to the Information Commissioner’s Office. Find out on their website how to report a concern https://ico.org.uk/make-a-complaint/
Changes to this Privacy Notice
This privacy notice was last updated on 20th May 2019. We keep this privacy notice under regular review and may change it from time to time by updating this page in order to reflect changes in the law and/or our privacy practices. We would encourage you to check this privacy notice for any changes on a regular basis.
