Privacy Policy

Introduction

Transport for West Midlands (TfWM) is an executive body of the West Midlands Combined Authority (WMCA), set up to improve the region’s transport infrastructure and create a fully integrated, safe and secure network.

This website is operated and provided by TfWM. (“TfWM,” “we,” “us,” or “our”). When you browse the Convex websites and subdomains (collectively the “Services"), we will collect some personal information/data from you. This Privacy Policy ("Policy") explains what information we collect, how we use it, with whom we share it, and the choices you have to control, access, and update your information

By using our Services, you are agreeing to the collection and use of your personal information as described in this Policy. If you do not agree with this Policy, do not use our Services. If you continue to use the Services, you express that you accept this Policy.

This Privacy Policy should be read in conjunction with our Terms and Conditions

Who is collecting your personal data?

The West Midlands Combined Authority (WMCA) is a Data Controller in terms of the Data Protection Act 2018 for information we hold and process. (please find our contact details below).

We are responsible for managing the information you provide us and we recognise that this information is important to you. We will only use personal data fairly, correctly and safely in line with the UK’s data protection laws.

Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of data is governed by the Data Protection Act 2018.

How do we process your personal data?

  • Only collecting from you what we are lawfully permitted to;
  • Only using information, we collect in a lawful and fair manner;
  • keeping personal data up to date;
  • storing and destroying it securely;
  • not collecting or retaining excessive amounts of data;
  • protecting personal data from loss, misuse, unauthorised access and disclosure;
  • ensuring that appropriate technical measures are in place to protect personal data;
  • ensuring your privacy is lawfully protected.

Why we need your personal data

We use the information we collect about you in order to provide and improve our Services and to provide you with features that interest and work well for you. Some of the ways that we use your information include to:

  • facilitate the use of the Services (uploading and downloading content, content purchases, etc.);
  • provide technical support for using the Services;
  • develop new products and services, and improving them and your experience with them;
  • seek your views or comments on the Services we provide;
  • notify you of changes to our Services;
  • communicate with you about the Services by email, for example to respond to your technical support inquiries or, if you choose this option, to send you information about our products or services, or the products and services of our authorized partners and affiliates, and new offers that we think may interest you;
  • monitor and analyze trends and usage, including generating aggregate statistical studies and conducting research which may be used in marketing our services to you or to third parties;
  • enhance the safety and security of our Services;
  • verify your identity or prevent or detect fraud or other unauthorized or illegal activity;
  • use information we collect from cookies and other technologies to enhance the Services and your experience with them; and
  • enforce this Policy, the Terms and Conditions, and any other terms that you have agreed to, including protecting the rights, property, or safety of us, our users, or any other person, or the copyright-protected content of the Services.

What Information we may collect and ways in which we will collect information

When you use the Convexs ervices, we collect information in three ways:

  1. Information you provide to us:

    When you use our Services, we collect information that you choose to share with us.

    Use of our Websites without an Account: You do not need to create an account to browse our websites. When you use the websites, even without creating an account, we still collect from you some of the information described in the below “Information we collect when you use the Services” section.

    • User account: To use the majority of our Services, you need to set up a user account. We may collect and store the information you provide when setting up your account including: your name, email address, work phone number and address, name of entity on behalf of which you are using the Services (if any), and your work title.
    • Communications with us and our technical support team: If you contact technical support for assistance with the Services, or if you send us messages, or suggestions, or communicate with us in any other way, we will collect and store the information you provide including your name and contact information, the time of such communication and the content of your communications.
    • Payment information: To make payments to us, you will need to provide billing information, such as a name, address, email address, and if you have opted to make payments electronically, payment card information. The processing of online payments is done by a third party, Worldpay Limited. We do not have access to your payment card information or other information you provide to facilitate electronic payments.

  2. Information we collect when you use the Services:

    Each time you use our websites, we may automatically collect the following types of information:

    • Information with respect to your Content: We monitor the volume and nature (e.g., static vs. real-time) of Content uploaded, the number of uploads, and the number of downloads.
    • Log file information: We collect log file information that your browser or device automatically reports each time you interact with the Services. This information includes:
      • when you first access our Services, and when you return;
      • device information, such as hardware settings, web browser type, and language;
      • IP address;
      • identifiers associated with cookies or other technologies that may uniquely identify your device or browser;
      • times you access pages;
      • pages you view, searches you submit; and
      • pages you visited before or after navigating to our websites.

    • Information from cookies and other technologies:

      Our use of cookies

      We use cookies and other technologies, such as web beacons, to collect information about your activity, browser, and device.

      what are cookies?

      cookies are small amounts of data that are sent to your browser from a website’s computers and stored on your computer or device.

      we and our third-party providers use both session cookies (that expire once you close your web browser), and persistent cookies (that stay on the device for a set period of time or until you delete them).

      the cookies we use:

      we use the following cookies for the purposes described below:

      Type Purpose
      Strictly necessary

      These cookies are required for making use of the Services. These cookies include security cookies that authenticate users, prevent fraudulent use of login credentials, and protect user data from unauthorized parties, as well as session cookies that remember your log-in session so you can move easily within the Services

      Functionality

      These cookies record some of your activity on the Services, as well as information about your device, such as what pages you access, and what browser you are running. This information helps us and our third party service providers diagnose server and software errors, and in cases of abuse, track and mitigate the abuse

      Analytics/ Performance / Marketing Our service providers, including Google Analytics and Pardot, use cookies as part of their tools. These cookies allow our service providers and us to recognize and count the number of users of the Services, to see how they move around the Service, and how they engage with different functions, including usage statistics, when they are using the Service and how they came to use the Service. This helps us to improve the way the Services work, for example by making sure our users are finding what they need easily. If you give us consent to do so, we will track your usage and activities also to ascertain users' interest so we can tailor our marketing messages to them

  3. Information we receive from third parties:

    We use Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics may set cookies on your browser or mobile device or read cookies that are already there to collect information. Google Analytics may also receive information about you from apps you have downloaded that partner with Google. Google Analytics collects information such as how often you use the Services and how you use the Services. We use information provided by Google Analytics to improve the Services. We do not combine the information collected through the use of Google Analytics with personally identifiable information. For more information regarding how Google collects, uses, and shares your information please visit http://www.google.com/policies/privacy/partners/

    Your choice with respect to your information:

    Analytics:You can control the information provided to Google and opt out of certain ads provided by Google by using any of the methods set forth at http://www.google.com/policies/privacy/partners/ or using the Google Analytics opt out browser add-on at http://tools.google.com/dlpage/gaoptout?hl=en.

    Cookies and other technologies: Persistent cookies can be removed by following your web browser’s directions. A session cookie is temporary and disappears after you close your browser. You can reset your web browser to refuse all cookies or to indicate when a cookie is being sent. However, some features of the Services may not function properly if the ability to accept cookies is disabled.

    Turning off your browser’s cookies will also prevent web beacons from tracking your specific activity. The web beacon may still record an anonymous visit from your IP address, but unique information will not be recorded.

    If you do not want to receive tracking pixels, you will need to disable HTML images in your email client, which may affect your ability to view images in other emails that you receive. To find out how to see what cookies have been set, and how to reject and delete the cookies, please visit: http://www.aboutcookies.org.

    You can, in certain circumstances request the deletion or removal of your personal data where there is no compelling reason for its continued processing and a copy of your personal data a structured, commonly used and machine-readable format, and to transmit it to another controller.

How the law allows us to use your information?

  • Contract - You have asked us to provide you with the service.
  • WMCA have responsibilities to perform a task in the public interest or is exercising an official function which has a clear basis in law.

Who do we share your information with

Except as expressly set out in this Policy or our Terms and Conditions we do not share, sell, or lease personal information about you to any third parties for their marketing use.

We may share information collected about you in the following ways:

With Service Providers: We share information about you with service providers to perform functions and process your data, and to help provide our Services, including hosting and storage providers or email service providers as well as payment processing.

With Analytics Service Providers: For analytics, we use Google Analytics, to improve the Services. We do not combine the information collected through the use of Google Analytics with personal information. For further information about Google Analytics, please see above.

With Third Parties for Legal Reasons: We may share information about you if we reasonably believe that disclosing the information is needed to:

  • comply with any valid legal process, governmental request, or applicable law, rule, or regulation;
  • investigate, remedy, or enforce potential violations of our Terms and Conditions or this Policy;
  • protect the rights, property, and safety of us, our users, or others; or
  • detect and resolve any fraud or security concerns.

With Third Parties as Part of an Acquisition or Liquidation: If we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings, we may share your information in connection with such transaction or proceeding before and/or after the transaction closes or the proceedings are completed.

Aggregate Information: We may also share with third parties aggregated or de-identified information, and we do not limit our third-party providers from using, selling, licensing, distributing, or disclosing de-identified data.

What we will do with your information

When deciding what personal information to collect, use and hold, we are committed to making sure that we:

  • Only collect, hold and use personal information where it is necessary and fair to do so;
  • Keep your personal information secure and safe;
  • Securely dispose of any personal information when it is no longer needed;
  • Be open with you about how we use your information and who we share it with; and
  • Adopt and maintain high standards in handling any personal information

How long do we keep your personal information?

In accordance with WMCA Data Retention and Disposal Policy your data will be kept for a controlled limited period and no longer than it is necessary.

What you can do with your information?

You as the Data Subject, have the following rights, subject to conditions set out in the Data Protection Act 2018.

Rights Description

Access - You have a right to get access to the personal information we hold about you

If you would like a copy of the personal information, we hold about you please contact us at:

Email: Information.officer@wmca.org.uk
Address: Data Protection Officer, 16 Summer Lane, Birmingham, B19 3SD

Rectification – You have a right to rectification of inaccurate personal information and to update incomplete personal information

If you believe that any information that we hold about you is inaccurate, you have a right to request that we restrict the processing of that information and rectify the inaccurate personal information.

Please note that if you request us to restrict processing your information, we may have to suspend any services we provide to you.

Erasure - You have a right to request that we delete your personal information

You may request that we delete your personal information if you believe that:

  • we no longer need to process your information for the purposes for which it was provided;
  • we have requested your permission to process your personal information and you wish to withdraw your consent; or
  • we are not using your information in a lawful manner.

Please note that if you request us to restrict processing your information, we may have to suspend the services we provide to you

Restriction - You have a right to request us to restrict the processing of your personal information

You may request us to restrict processing your personal information if you believe that:

  • any of the information that we hold about you is inaccurate;
  • we no longer need to process your information for the purposes for which it was provided, but you require the information to establish, exercise or defend legal claims; or
  • we are not using your information in a lawful manner.

Please note that if you request us to restrict processing your information, we may have to suspend the services we provide to you.
Portability - You have a right to data portability

Where we have requested your permission to process your personal information or you have provided us with information for the purposes of entering into a contract with us, you have a right to receive the personal information you provided to us in a portable format
Objection - You have a right to object to the processing of your personal information

You have a right to object to us processing your personal information (and to request us to restrict processing) unless we can demonstrate compelling and legitimate grounds for the processing, which may override your own interests, or where we need to process your information to investigate and protect us or others from legal claims.

Please note that if you request us to restrict processing your information, we may have to suspend the services we provide to you

Withdraw consent - You have a right to withdraw your consent

Where we rely on your permission to process your personal information, you have a right to withdraw your consent at any time.

We will always make it clear where we need your permission to undertake specific processing activities

Lodge complaints - You have a right to lodge a complaint with the regulator.

If you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter.

We hope that we can address any concerns you may have, but if you remain unhappy you can contact the Information Commissioner’s Office (ICO). For more information, visit: ico.org.uk

How to contact us

For further details on how your information is used, how we maintain the security of your information, and your rights to access information we hold on you please contact Information.officer@wmca.org.uk or contact the Data Protection Officer at:

Data Protection Officer
West Midlands Combined Authority
16 Summer Lane,
Birmingham,
B19 3SD