Lothian Buses Limited and our subsidiary companies (the Lothian Group) collect and use information about individuals. These can include customers, suppliers, business contacts, employees and other people the organisation has a relationship with or may need to contact.
This personal information must be dealt with properly and securely however it is collected, recorded and used – whether on paper, in a computer, or recorded on other material – and there are safeguards to ensure this in the General Data Protection Regulation 2016 (GDPR).
successful and efficient performance of our functions, and to maintain confidence between those with whom we deal.
The purpose of this policy is to ensure that the staff, volunteers and trustees of the Lothian Group are clear about the purpose and principles of Data Protection and to ensure that it has guidelines and procedures in place which are consistently followed.
Failure to adhere to GDPR is unlawful and could result in legal action being taken against the Lothian Group or its staff, volunteers or trustees.
Data users must comply with the data protection principles of good practice which underpin the Regulation. To comply with the law, information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully.
Personal data will be processed fairly, lawfully and in a transparent manner in relation to individuals.
Data will only be collected and used for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes.
taken to ensure that personal data that are inaccurate are erased or rectified without delay.
destruction or damage, using appropriate technical or organisational measures.
The principles apply to “personal data” which is information held on computer or in manual filing systems from which they are identifiable. Lothian Group employees, volunteers and trustees who process or use any personal information in the course of their duties will ensure that these principles are followed at all times.
2. Lothian Group’s external data records; Members, customers, clients.
Lothian Buses Limited as a body is a Data Controller under the Act, and the Executive Committee is ultimately responsible for the policy’s implementation.
and in some cases other documents from staff, volunteers and trustees. This data is stored and processed as per the Employee Privacy Notice.
organisation without their explicit consent.
for Health and Safety purposes to be used in emergency situations e.g. fire/ bomb evacuations. Staff, volunteers and trustees will be supplied with a copy of their personal data held by the organisation if a request is made through our Subject Access Request form on our website.
All confidential post must be opened by the addressee only.
We will take reasonable steps to keep personal data up to date and accurate.
responsibility for destroying personnel files.
Personal data is kept in paper-based systems and on password-protected computer systems.
systems and access limited to relevant personnel.
We operate a clear desk policy at all times.
published on the organisations website or on internal media outlets.
We obtain personal data (such as names, addresses, email addresses, photographs and phone numbers) from members/clients/customers. This data is obtained, stored and processed solely to assist staff and volunteers in the efficient running of services. Personal details supplied are only used to send material that is potentially useful after explicit opt in or under legitimate interest.
This information is stored on the organisation’s databases and is processed as per our Customer Privacy Notice.
We obtain personal data and information from clients and members in order to provide services. This data is stored and processed only for the purposes outlined in the agreement and service specification signed by the client/ member.
initial contact, the data owner is given an explanation of how this information will be used.
individual freely gives their own details.
Personal data will not be passed on to anyone outside the organisation without explicit consent from the data owner unless there is a legal duty of disclosure under other legislation.
Only the organisation’s staff, volunteers and trustees will have access to personal data.
Security Policy and their obligation not to disclose personal data to anyone who is not supposed to have it.
Information supplied is kept in a secure filing, paper and electronic system and is only accessed by those individuals involved in the delivery of the service.
Individuals will be supplied with a copy of any of their personal data held by the organisation if a request is made via our Subject Access Request Form.
records, their records will be destroyed according to our Data Retention Schedule.
their details from all database and ensure that all staff holding paper or electronic details for the organisation securely destroy them. This work will be carried out by the Data Protection Officer.
This procedure applies if we are informed that an organisation ceases to exist.
Paper-based data are stored in organised and secure systems.
Where practicable, we will seek consent of members/ individuals before displaying photographs in which they appear. If this is not possible (for example, a large group photo), the organisation will remove any photograph if a complaint is received. This policy also applies to photographs published on the organisation’s website or other external media outlets.
comply with the law, personal information must be collected and used fairly, stored safely and not disclosed to any other person unlawfully.
Staff, paid or unpaid must abide by this policy.
misconduct. Any such breach could also lead to criminal prosecution.
Any questions or concerns about the interpretation or operation of this policy statement should in the first instance be referred to the line manager.
No documents will be stored for longer than is necessary. For guidelines on retention periods see the Data Retention Schedule.
All documents containing personal data will be disposed of securely in accordance with the Data Protection principles.