The Fleet Operator Recognition Scheme (“FORS”) is operated by AECOM Limited (Company Number 01846493) (“AECOM”) on behalf of Transport for London (TfL).
In the regular course of operating FORS, FORS acquires personal data by interaction and communication with various third parties (including individuals). AECOM takes seriously its obligations to protect such personal data. As evidence of its commitment to privacy, AECOM has established this Privacy Statement to articulate the privacy and data protection principles that guide AECOM in the operation of FORS.
This Privacy Statement (together with the FORS Terms and Conditions, any additional data protection policy we may issue from time to time and any other related documents we provide to you) are designed to accomplish the following specific objectives:
- Increase awareness of regulatory, legal, and corporate requirements for handling and protecting personal data
- Set forth minimum guidelines for the collection, use, sharing, protection and other processing of personal data
- Enable FORS to meet business, legal, and regulatory responsibilities relating to personal data.
For the purpose of data protection legislation (the General Data Protection Regulation (GDPR) (EU) 2016/679 (the “Regulation”) and Data Protection Act 2018) TfL is the Data Controller and AECOM is the Data Processor of the personal data provided to us about you.
Collection of Personal Data
FORS will directly collect personal data of individuals who:
- Browse the FORS website
- Request FORS accounts on the FORS website
- Contact us (including through social media)
- Register their organisations for FORS membership
- Are the nominated contact for FORS audits
- Are customers of FORS Professional training
- Are customers of other services FORS provides either directly or through the FORS Affinity Partners
Personal information we hold
The personal data you give us / that we will process may include:
- Your name and job title
- Contact details including your postal address, email address, phone number
- Payment details including your financial/bank and credit card information
- Driving details, including your driver licence number
- Training records
Purposes of Processing Personal Data
We will use the information you give to us or that we collect about you to:
- Carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us
- Ensure we comply with our reporting and legal requirements
- Provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about
- Notify you about changes to our service
- Ensure that content from the FORS website is presented in the most effective manner for you and for your computer
- Administer the FORS website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
- Improve the FORS website to ensure that content is presented in the most effective manner for you and for your computer
- Allow you to participate in interactive features of our service, when you choose to do so
- Measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you
- Make suggestions and recommendations to you and other users of the FORS website about goods or services that may interest you or them
- Responding to correspondence, queries, feedback and complaints submitted to FORS
- Ensuring compliance with the FORS Standard, Rules and Procedures and Terms and Conditions including investigating complaints made against FORS companies
Legal Basis for Processing of Personal Data
We process your personal data because:
- It is necessary to do so to perform the services we are to provide to you
- We have your express consent
- Processing personal data is necessary for compliance with a legal obligation that applies to us
FORS obtains consent from or provides other choices to individuals regarding the processing of their personal data when required by applicable law. FORS also appropriately communicates any choices available to individuals with respect to FORS’s sharing of their personal data with third parties or access to their personal data by third parties.
Specifically, when consent or choice is required or otherwise determined to be appropriate, FORS:
- Requests the consent of the individual using a type of consent (opt-out or opt-in, implicit or explicit) or other choice mechanism that is appropriate in light of applicable requirements
- As appropriate, informs individuals of the consequences for failing to consent or to provide their information
- As appropriate, informs individuals regarding how they can change their consent decisions or choices
- Processes an individual’s personal data in a manner that is consistent with consent or other choices exercised by the individual
Sharing of Personal Data
We work closely with third parties to whom we may provide and receive information about you. These third parties include:
- FORS Affinity Partners (whom you register with or purchase services from)
- FORS Associates
- Training providers delivering FORS approved training
- Training providers appointed to deliver FORS Professional Training
- Companies and individuals providing FORS audit services
- Suppliers and sub-contractors including technical, payment and delivery services such as PayPal, MailChimp, EventBrite and Gotowebinar
- Analytics and search information providers
- Telematics companies and system providers
- FORS Champions and specifiers
- The Chartered Institute of Logistics and Transport
FORS may share personal data with third parties as required for reasonable business purposes (in accordance with applicable legal requirements) including:
- FORS Community Partnership
- FORS publication partners and mailing houses
- FORS workshop, conference, training course, webinar and other event sponsors
- FORS Audit Providers
- FORS Champions
- FORS Affinity Partners
- Environment Agency
- The police (on a case by case basis for prevention and detection of crime)
- Suppliers/sub-contractors for the performance of any contract we enter into with you or them (including third parties who deliver e-mails to you on our behalf)
- Training providers delivering FORS approved training and training providers appointed to deliver FORS Professional Training
- Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others or those who run events
- Analytics and search engine providers that assist us in the improvement and optimisation of the FORS website
- Credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you
FORS will display the training record of individuals on the FORS website.
Duration of Retention of Personal Data
We will not hold your personal data for longer than we consider necessary for reasonable business purposes described in this Privacy Statement, or to comply with our obligations under applicable law and the FORS Concession Contract and, if relevant, to deal with any claim or dispute that might arise between you and us.
FORS Professional or FORS Approved training records will be retained for the validity of the course and for 24 months after the validity of the training expires or as long as the training account is active.
Training accounts will be held for as long as any training record is valid and for 24 months after. Where no training records exist training accounts will be removed after 24 months of inactivity.
General enquiries, and complaints received from FORS members or from members of the public will be retained for the duration of the FORS Concession Contract and for 12 months after.
More detailed information on data retention periods is held in the FORS data retention schedule. For any queries related to data retention periods, please contact us at firstname.lastname@example.org