This Privacy Statement provides guidance and information to applicants regarding the processing of customer personal data by Credit Card Systems Ireland Ltd (“CCS”) acting on behalf of the National Transport Authority (“NTA”) in connection with the Student Leap Cards (“SLC”).
NTA and CCS acting on behalf of the NTA ("us", "we" or "our") are committed to protecting and respecting your privacy. This Privacy Statement together with the Terms and Conditions and the documents referred to in them set out the basis on which any personal data we collect from you or that you provide to us (“Data”) in connection with your Student Leap application will be processed by us. Please read this Privacy Statement carefully to understand our treatment and use of Data. In this Privacy Statement, references to “you” means the person whose personal information we collect, use and process.
We will use your personal data only for the purposes and in the manner set forth below, which describes the steps we take to ensure the processing of your personal data is in compliance with the Data Protection Acts 1988 and 2003 and any subsequent data protection and privacy legislation (the “Acts”), European Union Law including the General Data Protection Regulation (the “Regulation”) and any subsequent amendments.
Please note that by clicking accept on the Student Declaration on the SLC application, you acknowledge that you have read, understood and agree to the information contained in this Privacy Statement and the Terms and Conditions, in particular with regard to your data protection obligations. If you do not agree with or are not comfortable with any aspect of this Privacy Statement, your only remedy is to cease the SLC application process as we are required to process your Data for the purposes of providing you with an SLC and for the purposes set out in paragraph 5 below.
We seek to maintain the privacy, accuracy, and confidentiality of personal information (including your personal data) that we collect and use concerning the SLC applications.
2.IDENTITY OF THE CONTROLLER OF PERSONAL INFORMATION
For the purposes of the Acts and Regulation and any subsequent amendments, the Data Controller is the National Transport Authority, Dún Scéine, Iveagh Court, Harcourt Lane, Dublin 2. CCS collect and process your information solely on behalf of the NTA.
3. WHEN DOES THIS PRIVACY STATEMENT APPLY
This Privacy Statement applies to personal information that we collect, use and otherwise process about you on behalf of the NTA in connection with your SLC application.
4. WHAT PERSONAL INFORMATION IS COLLECTED AND PROCESSED?
We may collect and process the following categories of information about you: your personal information including forename, surname, gender, address, contact number, email address, date of birth, College/School/Institute, year of study and photo identification. We also collect your payment card details for postal SLC applications only, however, we do not retain the card details once the payment has been made and processed.
5. WHAT DO WE USE YOUR PERSONAL INFORMATION FOR?
The main purposes for which we use your personal information are as follows: to process your SLC application, to send you service communications in relation to your SLC including but not limited to instructions in relation to registration, notification of expiry of your SLC, duration of the validity of your SLC credit, to send you information on latest discounts and offers brought to you by our retail brand partners by email, and/or post (in accordance with your marketing preferences above), to conduct statistical and market research for our retail brand partners (please note that your Data will be wholly anonymised when it is being used for this purpose). Your consent is the basis for processing your personal data for the provision of marketing information relating to our Brand Partners.
The legal basis for this use and other processing will include (as relevant): to enable us to perform our obligations under our contract with the NTA (i.e. in relation to the SLC application form); processing for legitimate interests provided these are not overridden by your interests and fundamental rights and freedoms (this includes our own legitimate interests), in particular this is relevant when we use and process your personal data in order to respond to your enquiries and to address our good governance obligations; and processing which is necessary for compliance with our legal obligations laid down by applicable national laws. This personal data processing is necessary for the performance of our contract with you to provide a Student Leap Card on behalf of the NTA.
6. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF THE PERSONAL DATA
We do not disclose your information to third parties, other than to public transport operators that participate in the Leap scheme, in the event of misuse of the card.
Your personal information will not be transferred, stored or processed in any country outside the European Economic Area (EEA).
7.PERIOD FOR WHICH THE PERSONAL DATA WILL BE STORED, OR IF THAT IS NOT POSSIBLE, THE CRITERIA USED TO DETERMINE THAT PERIOD
We keep your personal data for as long as it is necessary to do so to fulfil the purposes for which it was collected as described above and in accordance with our Data Retention Policy. Your personal data will be stored for a maximum period of eighteen (18) months from the date of expiry of your SLC in order to facilitate the renewal of your SLC.
8. YOUR RIGHTS
You have various rights under the Act and Regulation in relation to the collection and processing of your personal data, including (as relevant):
the right to withdraw your consent to the processing of your personal data. However, we may continue to process your personal information if there is an alternative legal basis for the processing;
the right to request, in writing, copies of the personal data we hold about you. We will provide you with a copy of the Data held by us as soon as practicable and in any event not more than one (1) month after the request in writing is received by us. We may also request proof of identification to verify your access request. All access requests should be addressed to email@example.com. If you are unsatisfied with the outcome of your access request you are entitled to make a complaint to the Office of the Data Protection Commissioner who may investigate the matter for you;
the right to rectification including to require us to correct inaccurate personal data. We endeavour to keep your Data accurate, complete and up to date. If your Data that we hold is inaccurate, you can let us know and we will make the necessary amendments, erase or block the relevant Data as you request and notify you within one (1) month of your request that relevant action has been taken. All requests should be addressed to firstname.lastname@example.org;
the right to request restriction of processing concerning you or to object to processing of your personal data if:
processing is based on legitimate interests or the performance of a task in the public interest or exercise of official authority;
processed for direct marketing; or
processed for the purposes of scientific or historical research and statistics;
the right to prevent further processing in specific circumstances and where there is no other lawful ground for continuing to process that information. These include for example:
where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed;
where you withdraw consent; or
where you object to us processing your information;
the right to request the erasure of your personal data where it is no longer necessary for us to retain it;
the right to block or suppress processing of your personal information. While we are entitled to store your personal information, we cannot further process it if you request it to be blocked;
the right to data portability including to obtain personal data in a commonly used machine readable format in certain circumstances such as where our processing of it is based on a consent; and
the right to object to automated decision making including profiling (if any) that has a legal or significant effect on you as an individual; and the right to withdraw your consent to any processing for which you have previously given that consent.
Please see “Contact Us” if you wish to exercise any of these rights (as relevant).
9.YOUR RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
Without prejudice to any other administrative or judicial remedy you might have, you may have the right to lodge a complaint with the Office of the Data Protection Commissioner (i.e. the Supervisory Authority in Ireland) if you consider that the NTA and/or CCS have infringed the Acts and/or Regulation when processing your personal data.
We endeavour to use appropriate technical and physical security measures to protect your personal data which is transmitted, stored or otherwise processed by us, from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our service providers are also selected carefully and are required to use appropriate protective measures.
As effective as modern security practices are, no physical or electronic security system is entirely secure. The transmission of information via the internet is not completely secure. Although we will do our best to protect your Data, we cannot guarantee the security of your Data transmitted to our Site. Any transmission of Data is at your own risk. Once we receive your Data, we will use appropriate security measures to seek to prevent unauthorised access. We will continue to revise policies and implement additional security features as new technologies become available.
11. UPDATING THE PRIVACY STATEMENT
We reserve the right to change this Privacy Statement at our sole discretion. If we make changes, we will notify you by email and on the website www.studentleapcard.ie so that you can see what information we gather, how we might use that information and in what circumstances we may disclose it.
12. CONTACT US
Questions, comments and requests regarding this Privacy Statement and the information we hold are welcome and should be addressed to the Data Protection Officer of the NTA at email@example.com or alternatively you can write to us at National Transport Authority, Dún Scéine, Iveagh Court, Harcourt Lane, Dublin 2.