Management and Ownership 

The www.birthdaybus.co.uk site is owned and operated by Smart Applications Management, formally South West Smart Applications Limited (SWSAL), on behalf of the West of England Combined Authority and the four local authorities in the West of England: Bath and North East Somerset, Bristol City, North Somerset and South Gloucestershire Councils (referred to as ‘us’, ‘we’ or ‘our’). 

West of England Combined Authority is a member of SAM/ SWSAL ( www.talktosam.co.uk/  ) a not for profit mutual, member owned managed service provider. 

Terms of use 

In using the www.birthdaybus.co.uk site, and birthday month bus pass supplied to you, you agree to this Privacy Notice and our Terms of use. Terms and conditions may be revised at any time without notice. Continued use of this site after a change has been made is your acceptance of the change. 

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it. 

Privacy Notice 

This privacy policy aims to give you information on how the West of England Combined Authority collects and processes your personal data through your use of the www.birthdaybus.co.uk site and the birthday month bus pass supplied to you. This privacy policy also tells you about your privacy rights and how the law protects you. 

It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them. 

Identity Verification

By agreeing to this privacy policy, you acknowledge and consent to us using the GBG IB3 Global Product for identity verification. This check is necessary to establish your entitlement for any products you may have applied for and prevent fraud.

The GBG IB3 Global Product will cross-check the personal information you provide against several databases, including but not limited to credit reference agencies and electoral roll data. This process does not affect your credit rating. Please note that the information used for this purpose includes your full name, residential address, date of birth, and other personally identifiable information as may be required.

Your personal data will be processed in accordance with our privacy policy and in full compliance with UK and EU data protection laws, including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

Should you choose not to consent to this identity verification, you may be unable to access certain services or engage in transactions on our platform. Your rights to withdraw consent and the consequences of withdrawal are set out in our privacy policy.

A copy of a GBG Privacy Notice can be found here.

Controller 

West England Combined Authority is the controller and responsible for your personal data (collectively referred to as “WECA”, “we”, “us” or “our” in this privacy policy). 

If you have any questions about this privacy policy, or our privacy practices, including any requests to exercise your legal rights, please contact us using the details set out below. 

Contact details 

Full name of legal entity: West of England Combined Authority 

Email address: [email protected]  

Postal address: West of England Combined Authority, 70 Redcliff Street, Bristol, BS1 6AL. 

You have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance. 

Changes to the privacy policy and your duty to inform us of changes 

We keep our privacy policy under regular review. This version was last updated on 15 May 2023. Any historic versions can be obtained by contacting us. It may change and if it does, these changes will be posted on this page and, where appropriate, notified to you through email.  

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. 

Third-party links 

This site may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave the www.birthdaybus.co.uk site we encourage you to read the privacy policy of every website you visit. 

The West of England Combined Authority is the data controller, and Smart Applications Management/ SWSAL is the data processor, for the purposes of the Data Protection Act 2018 and other regulations including the General Data Protection Regulation (Regulation (EU) 2016/679), which means it determines what your data is used for and why it is collected. 

The purpose of this privacy notice is to tell you about what information we collect about you when you use our service, how we use that information and who we may share it with. 

What data we need to collect and the legal basis for processing it: 

Collecting this data is necessary to provide services in relation to the www.birthdaybus.co.uk site and your use of the birthday month bus pass. 

To provide this service, we will process: 

• name 
• residential Address 
• email address 
• telephone numbers 
• date of birth 
• gender
• employment status
• occupation
• photographs
• documents and other submitted evidence
• survey questions

By choosing to provide your personal details when applying for, and using, the birthday month bus pass through the www.birthdaybus.co.uk site you are consenting to us using your data for the provision of the services you require 

We may collect anonymous usage data through the www.birthdaybus.co.uk site and usage of the Birthday Month Bus Pass to better serve our users in future online services or to improve current ones. 

We also ask a series of equality monitoring questions when you register. Answering these questions is voluntary. We ask these equality monitoring questions to ensure that:

• Promotion and marketing about the Birthday Bus Pass reach all sections of the community
• to understand possible differences in uptake of the Bus Pass and ensure equality opportunity to access the offer, and
• to improve the effectiveness of the way we communicate with all our customers

How long we will keep your data for: 

We will hold this information for whilst you have a live card on your account (a live card is one that is within its expiry date and has not been blocked/cancelled). After this your personal information will be held for 7 years and then deleted or archived. 

Marketing and promotion: 

We may use your Identity, Contact, Technical, Usage and other data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which services and offers may be relevant for you (we call this marketing). 

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We will only send you direct marketing communications by email or text if we have your consent. You have the right to withdraw that consent at any time by contacting us. We will get your express opt-in consent before we share your personal data with any third party for marketing purposes. 

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of a service purchase or other transactions. 

Service messages and public sector promotions:

Once your application for the birthday bus pass offer is accepted, you may occasionally receive service messages and surveys regarding the product, and your use of the birthday bus pass.

These messages may contain promotional messages relating to bus services in your area that you can use your birthday bus pass on, as well as information about fares, and free guidance on journey planning. The West of England Combined Authority have a statutory duty to promote and encourage the use of safe, integrated, efficient and economic transport under Part 2 of the Transport Act 2000.

You can object to these communications at any time by unsubscribing on any of the service message or promotional emails we may send to you.

Why we need to collect your data: 

Smart Application Management processes personal data on behalf of the Data Controllers for the following purpose(s): 

• to provide card support service to the customers; 
• to verify entitlement to a card product (Eligibility); 
• to comply with contractual obligations; 
• to comply with legal obligations; and 

• network support, customer support and troubleshooting. 
• to advise customers of major changes to the scheme 
• to advise customers of serious issues that are impacting the availability of the service 

Who we share your data with and why: 

Your personal details are stored for operational purposes by Smart Applications Management/ SWSAL (14 High Cross, Truro, Cornwall, TR1 2AJ, Registration Number: 07205882) and may be shared with us. Representatives of South West Smart Applications Limited will have access to your personal details for operational purposes only. Payment details shall remain private unless you voluntarily provide these over the phone. 

We may also share anonymised data with the 3rd parties listed below in relation to managing and evaluating the scheme – 3rd parties include Local Transport Authorities (normally local councils – including the four local authorities in the West of England: Bath and North East Somerset, Bristol City, North Somerset and South Gloucestershire Councils); professional advisors (including lawyers, bankers, auditors, insurers); The Department for Transport and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances. 

We don’t share your data with any other organisation or individual unless you give your express consent or unless there is a lawful requirement to do so (for example – for the detection and prevention of crime). 

As part of processing personal data on behalf of the Data Controller, Smart Applications Management/ SWSAL does not transfer personal data to third countries outside the EEA. 

Your rights as a data subject: 

Under certain circumstances you have the following rights under data protection laws in relation to your personal data. 

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. 
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. 
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. 
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms. 
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: 

• a) if you want us to establish the data’s accuracy; 
• b) where our use of the data is unlawful but you do not want us to erase it; 
• c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or 
• d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. 
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. 

• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. 

You can exercise any of these rights requests should be sent to [email protected]   

You also have a right of complaint to the Information Commissioner’s Office (ICO) at www.ico.org.uk if you think we have not dealt with your information in a proper manner. 

You can ask to see what information we hold about you and have access to it. If you have any concerns or questions about how we look after your information, please contact us at [email protected] or write to us at 70 Redcliff Street, Bristol, BS1 6AL and we will be pleased to help you.  

Other questions about the data being processed may also be sent to the above address. 

Fraud Prevention and Detection: 

The West of England Combined Authority is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing, administering public funds, or where undertaking a public function, in order to prevent and detect fraud.  

This website complies with the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations of 2011. 

Click here to read more about the Birthday Bus Cookies Policy.