Privacy Notice – The National Bus Pass Scheme

Purpose of collecting and processing your personal data:

The DTCCA is committed to ensuring that personal information is processed fairly, lawfully and securely in accordance with data protection laws.

In order to assess your eligibility for a bus pass or companion concessions under The National Bus Pass Scheme (NBPS) and, if eligible, issue with a pass, the authority will need to collect and use personal information about you.

Personal information can be anything that identifies and relates to a living person.  This can include information that, when put together with other information, can then identify a person.

What information are we processing?

We may collect, store or otherwise process information about you which may include your:

• Full name and title
• Postal address including postcode
• Date of birth
• Email address
• Home telephone number and mobile phone number
• Eligibility criteria such as your age and any health conditions which may include learning disabilities, blindness, profound or severe deafness, no speech, unfitness to drive or anything which may adversely affect your mobility.  This data is likely to constitute special category data and will be processed accordingly.

The legal basis for us collecting your personal data:

Where we collect your personal data for any of the purposes set out in this Privacy Notice, we rely on the following lawful basis for processing:-

UK GDPR Article 6(1) (e) – ‘Public Task’ – the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

As the Transport Authority, the DTCCA must process personal data in order to fulfil its statutory duties, which include the effective administration of the concessionary travel scheme and delivery of this service.

Where we process special category personal data (for example health or medical information), this will only take place where an additional lawful basis under Article 9 of the UK GDPR applies.  

In such circumstances, we rely upon UK GDPR Article 9(2)(g) – ‘Substantial Public Interest’, supported by Schedule 1, Part 2, paragraph 6 of the Data Protection Act 2018, (statutory and government purposes).

We do not use personal data collected for the purposes outlined in this notice for direct marketing, and we do not sell personal data to third parties.

Recipients or categories of recipients that we may share your personal data with:

To ensure that the Authority provides you with an efficient and effective service we will need to share your information with other partner organisations who help us to deliver the NBPS.  There is a Data Processing Agreement in place with each of the two providers we currently use for this purpose, who are:

• Devon County Council
• Torbay Council

We may also share information to enable us to comply with court orders and other legal obligations. If this is necessary, we will only share the minimum amount of personal data needed for this purpose.

International transfers

Most personal information we collect is stored on electronic systems in the UK and European Economic Area. For example, some personal information may be stored on computer services located in the European Economic Area (EEA).

Generally, personal information in our control will not be sent outside EEA, unless stored within cloud-based computer services. If this is done, appropriate assessments, procedures and technologies will be put in place to maintain the security of all personal information processed outside of the EEA.

How long will we hold your personal data?

The DTCCA will retain your personal data for the duration of the bus pass and for a further six years plus the current year, in line with the Limitation Act 1980.

Once your information is no longer needed it will be securely and confidentially destroyed.

Your data protection rights

Under Data Protection Legislation, you have certain rights in relation to your personal data.  You can exercise your rights by contacting us at dtccadataprotection@devon.gov.uk

Further details on your rights under data protection legislation are available here and within the Authority’s Data Protection Policy.

Automated decision making

‘Automated decision making’ is when decisions are made about you by a computer, without any human involvement.

No automated decision making is currently undertaken in relation to the processing of personal data for bus pass eligibility assessment purposes.

Changes to this privacy notice

This privacy notice was last updated on 1June 2026, and is regularly reviewed. If we use your personal data for any new purposes, updates will be made to the privacy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this Notice should be directed to our DPO at dtccadataprotection@devon.gov.uk

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data in relation to the National Bus Pass Scheme, please contact our DPO at dtccadataprotection@devon.gov.uk who will look into this for you.

If you remain dissatisfied following our DPO’s response, you are entitled to escalate your concerns to the Information Commissioners Office (ICO), the UK data protection regulator.

Privacy notice history