Privacy Policy

This is the privacy policy for the NET system. This policy explains what personal information we have, how we use it and how you can check and update any of your personal information. For the purposes of this Privacy Policy, “we” means Tramlink.

Nottingham Limited and other companies associated with delivery of the services for NET, including Nottingham Trams Limited.

Under the UK General Data Protection Regulation (GDPR) the ‘data controller’ is the organization responsible for protecting information and, in our case, is Tramlink Nottingham Ltd, 2 King St, Nottingham NG1 2AS.

.

What Information We Collect About You

We collect information about you when you register for a product or service with us or contact us directly. We also collect information when you voluntarily complete customer surveys, provide feedback and participate in competitions. CCTV recordings from tram stops, and body-worn video (BWV) equipment (some with audio), NET park and ride sites, and from on- board the trams, are maintained to ensure safety and security on the network. We may also share your data with law enforcement agencies should they make a request to us.

How We Use The Information About You

We collect and use personal information about the individuals or service users who come into contact with the business in order to carry on our work. This may involve the transfer of necessary information to contracted third parties who provide operational services on our behalf. We have contractual safeguards in place to ensure that these third parties respect your privacy as much as we do.

We will not share your information for marketing purposes with external companies unless you have specifically told us that you want us to. If you have provided your consent to marketing, you have the right to withdraw this. This can easily be done via our preferences centre on the website or by emailing us via the “contact us” option on our website.

Customer Service

We may collect and use your personal information to provide you customer service, including responses to your enquiries. This typically requires the collection and use of certain personal contact information (such as your name or email address) and information regarding the reason for your inquiry (e.g. product question/comment, general question, etc.). Customer service may be provided through various forms of communication, including email correspondence, our travel centre, our customer service telephone number or through social media private messaging. Calls to our Customer Services on 0115 824 6060 or via the Help Points at tram stops and park and ride sites are recorded.

Marketing

We may send you information about products and services of ours which we think may be of interest to you. If so, we will request your consent to do so. If you have consented to receive marketing, you may opt out at a later date. Anyone who is currently subscribed to the NET mailing list has opted in to do so.

You have a right at any time to stop us from contacting you for marketing purposes. If you no longer wish to be contacted for marketing purposes, please contact us by email to dataprotectionenquiries@tramlinknottingham.co.uk or by letter at the address above.

Ticket Sales

If you choose to purchase a ticket which requires you to complete a form with your personal details to complete the transaction we will store this data so as to provide a service to the user.

We do not share this information with any third parties except those to the extent necessary to provide this service or if the user has chosen to “opt in” to receive marketing information (i.e such as an email newsletter).

Website

Along with our business and internal computer systems, our website is designed to comply with the following national and international legislation with regards to data protection and user privacy:

• Data Protection Act 2018 (DPA)
• UK General Data Protection Regulation (GDPR)

The website collects and uses personal information for the following reasons:

Website Tracking

Like most websites, the NET site uses Google Analytics (GA) to track user interaction. We use this data to determine the number of people using our site, to better understand how they find and use our web pages and to see their journey through the website.

Although GA records data such as your geographical location, device, internet browser and operating system, none of this information personally identifies you to us. GA also records your computer’s IP address which could be used to personally identify you but Google do not grant us access to this. We consider Google to be a third party data processor.

GA makes use of cookies, disabling cookies on your internet browser will stop GA from tracking any part of your visit to pages within this website.

Email Newsletter

If you choose to join our email newsletter, the email address that you submit to us will be forwarded to Hubspot who provide us with email marketing services. We consider Hubspot to be a third-party data processor. The email address that you submit will be directly entered into a database provided by Hubspot. It will not be stored in any of our internal computer systems.

Your email address will remain within Hubspot’s database for as long as we continue to use Hubspot’s services for email marketing or until you specifically request removal from the list. You can do this by unsubscribing using the unsubscribe links contained in any email newsletters that we send you or by requesting removal via email. When requesting removal via
email, please send your email to us using the email account that is subscribed to the mailing list.

Ticket Sales

If you choose to purchase a ticket which requires you to complete a form with your personal details through our website, we will store this data in order to provide a service to the user. We do not share this information with any third parties except those to the extent necessary to provide this service or if the user has chosen to “opt in” to receive information (i.e such as an email newsletter). As detailed above you can remove this consent (opt out) by emailing us or using the unsubscribe option on newsletters and emails sent to you.

Mobile App

We have recently made available to customers the ability to access some of our services via a mobile app. Customers can choose to download the app. The services we will provide via the app include the ability to make purchases, monitor your account activity and receive information on tram service availability. The lawful basis for processing, upon which we rely to collect this information, is legitimate interests.

We may also use the app to provide customers with information on ticket offers and other offers from our loyalty partners.

The type of data we may collect from you via the app is as follows:

Customer name
Email address
Payment card details

Where we do collect data from you, to enable you to make a purchase, your details will be collected by our third party payments services provider who will store your transaction details securely, on our behalf, so we can access the data if we need to provide you a refund.

We will not pass on any personal information you provide us via the app to third parties for the purposes of marketing unless you have specifically chosen to “opt in”.

We may also provide access to your transaction details to a third party customer service provider in order to provide specific customer services such as refunds and payment confirmations.

We may also provide our App Developer with access to some aspects of your personal data to help us improve the quality and performance of the app.

CCTV

CCTV monitoring takes place from tram stops, park and ride sites and on-board the trams and recordings are maintained to ensure safety and security on the Network. Nottingham Trams Ltd, who are the operator of the NET system, control the CCTV system. Recordings or images may be shared with the police where they have reasonable grounds to request the data. For operational or safety reasons our CCTV recordings or images may be shared with local highway authority control rooms.

Penalty Fares

We may collect some personal data including name, address and other details in order to meet contractual obligations for enforcement of the NET Byelaws. No other organizations will have access to this personal data unless the process requires them to do so: the data is shared with HM Courts and the Independent Appeals Panel, and systems are in place to ensure the secure exchange of data with such organizations. We may use legal public sources to obtain information about you, for example, to verify your identity. If we hold your details as a result of issuing a PFN we will keep those details for up to three years after the PFN has been resolved, so that we can monitor for re-offending. If we have not recovered full payment the retention period will increase to six years.

How Long We Keep Your Data

If we hold your contact details as a result of you contacting Customer Services we will keep the information for 3 years after the comment has been closed and after this period it will be deleted.

CCTV data from tram stops can be accessed for up to two months, or for up to seven days from on-board trams. BWV recordings can be accessed for up to 31 days. However, if a specific incident requires a separate copy of the information to be retained we will keep a copy of the recording for up to three years, (five years in the case of BWV if used for an investigation), or longer if investigation of an incident requires more time or the information can be useful for training purposes.

We may hold your data in respect of smartcard activity two years after the last use of the card after which the card and associated data will be deactivated and deleted as part of quarterly card management procedures.

Third Party Data Processors/Controllers

We use a number of third parties both on and offline to process personal data on our behalf.

These third parties have been carefully chosen and measures have been taken to ensure that all comply with current Data Protection Regulations and all legislation. Details of these third parties may be supplied upon request.

Both Google and MailChimp are based in the United States of America and data may therefore be processed outside of the EU. Data security is important to us and our third-party data controllers and both organizations hold the relevant US-EU privacy shield certificate to enable compliance with EU GDPR regulations in respect of the lawful transfer of information. https://www.privacyshield.gov/list

Your Data Protection Rights

We must assist individuals to exercise the following data protection rights, consistent with the requirements of applicable UK data protection law:

The right of access:
You have the right to request a copy of the information that we hold about you. If you would like a copy of some or all of your personal information free of charge*, please contact us by email to dataprotectionenquiries@tramlinknottingham.co.uk or at the above address.

This information will be provided within one month. For complex cases we retain the right to extend the time limit but we will write to you first about this.

*We reserve the right to refuse to provide information for any manifestly unfounded requests (including multiple/duplicate requests) or charge a fee for complex cases.

The right of rectification:
We want to make sure that your personal information is accurate and up to date. You may ask us to correct or remove information you think is inaccurate.

The right to erasure:
You may also choose to withdraw your consent for us to hold your information at any time, where relevant. This can easily be done via our preferences centre on the website or by
emailing us via the “contact us” option on our website.

The right to restriction:
This is a right for an individual to require a controller to restrict processing of personal information about them on certain grounds;

The right to object:
This is a right for an individual to object, on grounds relating to their particular situation, to a
controller's processing of personal data about them, if certain grounds apply;

The right to data portability:
This is a right for an individual to receive personal information concerning them from a controller in a structured, commonly used and machine-readable format and to transmit that information to another controller, if certain grounds apply.

You may exercise any of the above rights by contacting us at the above address or by email to: dataprotectionenquiries@tramlinknottingham.co.uk

If at any time you are not satisfied with the way your request was handled, you may be able to refer your complaint to the Information Commissioner’s Office.

Their contact details are:
By phone: 0303 123 1113.
Online: https://ico.org.uk/concerns

Changes To Our Privacy Policy

We keep our privacy policy under regular review and we will place any updates on our web page. This privacy policy was last updated July 2024.