Fleet Operator Recognition Scheme (FORS) – Privacy Statement

Fleet Operator Recognition Scheme (FORS) – Privacy Statement

Purpose

The Fleet Operator Recognition Scheme (“FORS”) is operated by AECOM Limited (Company Number 01846493) (“AECOM”) on behalf of Transport for London (TfL).

In the regular course of operating FORS, FORS acquires personal data by interaction and communication with various third parties (including individuals). AECOM takes seriously its obligations to protect such personal data. As evidence of its commitment to privacy, AECOM has established this Privacy Statement to articulate the privacy and data protection principles that guide AECOM in the operation of FORS.

This Privacy Statement (together with the FORS Terms and Conditions, any additional data protection policy we may issue from time to time and any other related documents we provide to you) are designed to accomplish the following specific objectives:

  • Increase awareness of regulatory, legal, and corporate requirements for handling and protecting personal data
  • Set forth minimum guidelines for the collection, use, sharing, protection and other processing of personal data
  • Enable FORS to meet business, legal, and regulatory responsibilities relating to personal data.

For the purpose of data protection legislation (the General Data Protection Regulation (GDPR) (EU) 2016/679 (the “Regulation”) and Data Protection Act 2018) TfL is the Data Controller and AECOM is the Data Processor of the personal data provided to us about you.

Collection of Personal Data

FORS will directly collect personal data of individuals who:

  • Browse the FORS website
  • Request FORS accounts on the FORS website
  • Contact us (including through social media)
  • Register their organisations for FORS membership
  • Are the nominated contact for FORS audits
  • Are customers of FORS Professional training
  • Are customers of other services FORS provides either directly or through the FORS Affinity Partners

Personal information we hold

The personal data you give us / that we will process may include:

  • Your name and job title
  • Contact details including your postal address, email address, phone number
  • Payment details including your financial/bank and credit card information
  • Driving details, including your driver licence number
  • Training records               

Purposes of Processing Personal Data

We will use the information you give to us or that we collect about you to:

  • Carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us
  • Ensure we comply with our reporting and legal requirements
  • Provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about
  • Notify you about changes to our service
  • Ensure that content from the FORS website is presented in the most effective manner for you and for your computer
  • Administer the FORS website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
  • Improve the FORS website to ensure that content is presented in the most effective manner for you and for your computer
  • Allow you to participate in interactive features of our service, when you choose to do so
  • Measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you
  • Make suggestions and recommendations to you and other users of the FORS website about goods or services that may interest you or them
  • Responding to correspondence, queries, feedback and complaints submitted to FORS
  • Ensuring compliance with the FORS Standard, Rules and Procedures and Terms and Conditions including investigating complaints made against FORS companies

Legal Basis for Processing of Personal Data

We process your personal data because:

  • It is necessary to do so to perform the services we are to provide to you
  • We have your express consent
  • Processing personal data is necessary for compliance with a legal obligation that applies to us

FORS obtains consent from or provides other choices to individuals regarding the processing of their personal data when required by applicable law. FORS also appropriately communicates any choices available to individuals with respect to FORS’s sharing of their personal data with third parties or access to their personal data by third parties.

Specifically, when consent or choice is required or otherwise determined to be appropriate, FORS:

  • Requests the consent of the individual using a type of consent (opt-out or opt-in, implicit or explicit) or other choice mechanism that is appropriate in light of applicable requirements
  • As appropriate, informs individuals of the consequences for failing to consent or to provide their information
  • As appropriate, informs individuals regarding how they can change their consent decisions or choices
  • Processes an individual’s personal data in a manner that is consistent with consent or other choices exercised by the individual 

Sharing of Personal Data

We work closely with third parties to whom we may provide and receive information about you. These third parties include:

  • FORS Affinity Partners (whom you register with or purchase services from)
  • FORS Associates
  • Training providers delivering FORS approved training
  • Training providers appointed to deliver FORS Professional Training
  • Companies and individuals providing FORS audit services
  • Suppliers and sub-contractors including technical, payment and delivery services such as PayPal, MailChimp, EventBrite and Gotowebinar
  • Analytics and search information providers
  • Telematics companies and system providers
  • FORS Champions and specifiers
  • DVSA
  • The Chartered Institute of Logistics and Transport

FORS may share personal data with third parties as required for reasonable business purposes (in accordance with applicable legal requirements) including:

  • FORS Community Partnership
  • FORS publication partners and mailing houses
  • FORS workshop, conference, training course, webinar and other event sponsors
  • FORS Audit Providers
  • FORS Champions
  • FORS Affinity Partners
  • DVSA
  • Environment Agency
  • The police (on a case by case basis for prevention and detection of crime)
  • Suppliers/sub-contractors for the performance of any contract we enter into with you or them (including third parties who deliver e-mails to you on our behalf)
  • Training providers delivering FORS approved training and training providers appointed to deliver FORS Professional Training
  • Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others or those who run events
  • Analytics and search engine providers that assist us in the improvement and optimisation of the FORS website
  • Credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you

FORS will display the training record of individuals on the FORS website.

Duration of Retention of Personal Data

We will not hold your personal data for longer than we consider necessary for reasonable business purposes described in this Privacy Statement, or to comply with our obligations under applicable law and the FORS Concession Contract and, if relevant, to deal with any claim or dispute that might arise between you and us.

Personal data held in member’s user accounts is maintained in line with the status of the organisation they are part of and if the organisation is made dormant or withdrawn the data is removed in accordance with the FORS data retention schedule. Dormant means that a company (or other body) is no longer an active member of FORS. For dormant members, membership data will be retained but anonymised.

 
FORS Professional or FORS Approved training records will be retained for the validity of the course and for 24 months after the validity of the training expires or as long as the training account is active.

Training accounts will be held for as long as any training record is valid and for 24 months after. Where no training records exist training accounts will be removed after 24 months of inactivity.

General enquiries, and complaints received from FORS members or from members of the public will be retained for the duration of the FORS Concession Contract and for 12 months after.

More detailed information on data retention periods is held in the FORS data retention schedule. For any queries related to data retention periods, please contact us at enquiries@fors-online.org.uk

Marketing

The email address that you provided us in order to opt in to receiving marketing communications (including FORS eNews) is retained until you unsubscribe to these communications.

If you would like to unsubscribe from service or marketing messages, please use the link we include at the end of every email. You can also email unsubscribe at any time by emailing enquiries@fors-online.org.uk.

Your information rights

Under data protection legislation, you have a number of information rights in relation to your personal data:

  • The right to access your personal data
  • The right to request the rectification and/or erasure of your personal data that you have provided to FORS
  • The right to restrict the use of your personal data
  • The right to object to the processing of your personal data
  • The right to request to port your personal data that you have provided to FORS
  • Where you have given your consent to receive marketing communications, the right to withdraw your consent to the processing at any time.

If you wish to exercise any of the rights set out above, please contact us at enquiries@fors-online.corg.uk

Data Security

We take appropriate technical and organisational security measures to prevent unauthorised access and to ensure that the personal data we hold as Data Processor is kept secure.

All information you provide to us is stored on our secure servers, or those of our sub-contractors, within the European Economic Area (“EEA”).

Any electronic payment transactions will be encrypted and conducted by our third-party payment providers in accordance with their terms.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of the FORS website, you are responsible for keeping this password confidential.

The FORS website may, from time to time, contain links to and from the websites of our partner networks, advertisers and Affinity Partners.  If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies.  Please check these policies before you submit any personal data to these websites.

Web Browser Cookies

The FORS website may use “cookies” to enhance User experience. User’s web browser places cookies on their hard drive for record-keeping purposes and sometimes to track information about them. User may choose to set their web browser to refuse cookies, or to alert you when cookies are being sent. If they do so, note that some parts of the FORS website may not function properly.

By visiting the FORS website we will automatically collect the following information:

  • Technical information, including the Internet protocol address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, information through platforms you use; and

Information about your visit to the FORS website, including the full Uniform Resource Locators, clickstream to, through and from the FORS website (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call the FORS Helpline.

Changes to this Privacy Statement

Any changes we make to this Privacy Statement in the future will be posted on this page and, where appropriate, notified to you by email or through the FORS eNews.

Complaints, Questions and Comments

If you have a complaint about the way in which we collect, process and store your personal data which you do not feel can be resolved by contacting us, you have the right to complain to the Information Commissioners Office.

Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to enquiries@fors-online.org.uk

Useful links

FORS Data Protection Policy
FORS Terms and Conditions
EU-GDPR – Procedure for Responding to Personal Data Requests