The Fleet Operator Recognition Scheme (“FORS”) is operated by Sopra Steria Limited (Company Number 04077975) (“Sopra Steria”) on behalf of Transport for London (TfL).
In the regular course of operating FORS, FORS acquires personal data by interaction and communication with various third parties (including individuals). Sopra Steria takes seriously its obligations to protect such personal data. As evidence of its commitment to privacy, Sopra Steria has established this Privacy Statement to articulate the privacy and data protection principles that guide Sopra Steria in the operation of FORS.
This Privacy Statement (together with the FORS Terms and Conditions, any additional data protection policy we may issue from time to time and any other related documents we provide to you) are designed to accomplish the following specific objectives:
Increase awareness of regulatory, legal, and corporate requirements for handling and protecting personal data
Set forth minimum guidelines for the collection, use, sharing, protection and other processing of personal data
Enable FORS to meet business, legal, and regulatory responsibilities relating to personal data.
For the purpose of data protection legislation (the General Data Protection Regulation (GDPR) (EU) 2016/679 (the “Regulation”) and Data Protection Act 2018) TfL is the Data Controller and Sopra Steria is the Data Processor of the personal data provided to us about you.
Collection of Personal Data
FORS will directly collect personal data of individuals who:
- Browse the FORS website
- Request FORS accounts on the FORS website
- Contact us (including through social media)
- Register their organisations for FORS membership
- Are the nominated contact for FORS audits
- Are customers of FORS Professional training
- Are customers of other services FORS provides either directly or through the FORS Affinity Partners
Personal information we hold
The personal data you give us / that we will process may include:
- Your name and job title
- Contact details including your postal address, email address, phone number
- Payment details including your financial/bank and credit card information
- Driving details, including your driver licence number
- Training records
Purposes of Processing Personal Data
We will use the information you give to us or that we collect about you to:
- Carry out our obligations arising from any contracts entered into between you and us and to provide you with the information, products and services that you request from us
- Ensure we comply with our reporting and legal requirements
- Provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about
Notify you about changes to our service
Ensure that content from the FORS website is presented in the most effective manner for you and for your computer
Administer the FORS website and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
Improve the FORS website to ensure that content is presented in the most effective manner for you and for your computer
Allow you to participate in interactive features of our service, when you choose to do so
Measure or understand the effectiveness of advertising we serve to you and others, and to deliver relevant advertising to you
Make suggestions and recommendations to you and other users of the FORS website about goods or services that may interest you or them
Responding to correspondence, queries, feedback and complaints submitted to FORS
Ensuring compliance with the FORS Standard, Accreditation Guide and Terms and Conditions including investigating complaints made against FORS companies
Legal Basis for Processing of Personal Data
We process your personal data because:
- It is necessary to do so to perform the services we are to provide to you
- We have your express consent
- Processing personal data is necessary for compliance with a legal obligation that applies to us
- FORS obtains consent from or provides other choices to individuals regarding the processing of their personal data when required by applicable law. FORS also appropriately communicates any choices available to individuals with respect to FORS’s sharing of their personal data with third parties or access to their personal data by third parties.
Specifically, when consent or choice is required or otherwise determined to be appropriate, FORS:
- Requests the consent of the individual using a type of consent (opt-out or opt-in, implicit or explicit) or other choice mechanism that is appropriate in light of applicable requirements
- As appropriate, informs individuals of the consequences for failing to consent or to provide their information
- As appropriate, informs individuals regarding how they can change their consent decisions or choices
- Processes an individual’s personal data in a manner that is consistent with consent or other choices exercised by the individual
Sharing of Personal Data
We work closely with third parties to whom we may provide and receive information about you. These third parties include:
- FORS Affinity Partners (whom you register with or purchase services from)
- FORS Associates
- Training providers delivering FORS approved training
- Training providers appointed to deliver FORS Professional Training
- Companies and individuals providing FORS audit services
- Suppliers and sub-contractors including technical, payment and delivery services such as PayPal, MailChimp, EventBrite, Gotowebinar and Olive
- Analytics and search information providers
- Telematics companies and system providers
- FORS Champions and specifiers
FORS may share personal data with third parties as required for reasonable business purposes (in accordance with applicable legal requirements) including:
- FORS Community Partnership
- FORS publication partners and mailing houses
- FORS workshop, conference, training course, webinar and other event sponsors
- FORS Audit Providers
- FORS Champions
- FORS Affinity Partners
- Environment Agency
- The police (on a case by case basis for prevention and detection of crime)
- Suppliers/sub-contractors for the performance of any contract we enter into with you or them (including third parties who deliver e-mails to you on our behalf)
- Training providers delivering FORS approved training and training providers appointed to deliver FORS Professional Training
- Advertisers and advertising networks that require the data to select and serve relevant adverts to you and others or those who run events
- Analytics and search engine providers that assist us in the improvement and optimisation of the FORS website
- Credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you
FORS will display the training record of individuals on the FORS website.
Duration of Retention of Personal Data
We will not hold your personal data for longer than we consider necessary for reasonable business purposes described in this Privacy Statement, or to comply with our obligations under applicable law and the FORS Concession Contract and, if relevant, to deal with any claim or dispute that might arise between you and us.
Personal data held in member’s user accounts is maintained in line with the status of the organisation they are part of and if the organisation is made dormant or withdrawn the data is removed in accordance with the FORS data retention schedule. Dormant means that a company (or other body) is no longer an active member of FORS. For dormant members, membership data will be retained but anonymised after 12 months of becoming dormant. Within 12 months of becoming dormant, FORS retains the right to contact you with company updates, marketing and/or sales messaging.
FORS Professional or FORS Approved training records will be retained for the validity of the course and for 24 months after the validity of the training expires or as long as the training account is active.
Training accounts will be held for as long as any training record is valid and for 24 months after. Where no training records exist training accounts will be removed after 24 months of inactivity.
General enquiries, and complaints received from FORS members or from members of the public will be retained for the duration of the FORS Concession Contract and for 12 months after.
More detailed information on data retention periods is held in the FORS data retention schedule. For any queries related to data retention periods, please contact us at [email protected]
The email address that you provided us in order to opt in to receiving marketing communications (including FORS eNews) is retained until you unsubscribe to these communications.
If you would like to unsubscribe from service or marketing messages, please use the link we include at the end of every email. You can also email unsubscribe at any time by emailing [email protected].
Your information rights
Under data protection legislation, you have a number of information rights in relation to your personal data:
- The right to access your personal data
- The right to request the rectification and/or erasure of your personal data that you have provided to FORS
- The right to restrict the use of your personal data
- The right to object to the processing of your personal data
- The right to request to port your personal data that you have provided to FORS
- Where you have given your consent to receive marketing communications, the right to withdraw your consent to the processing at any time.
- If you wish to exercise any of the rights set out above, please contact us at [email protected]
We take appropriate technical and organisational security measures to prevent unauthorised access and to ensure that the personal data we hold as Data Processor is kept secure.
All information you provide to us is stored on our secure servers, or those of our sub-contractors, within the European Economic Area (“EEA”).
Any electronic payment transactions will be encrypted and conducted by our third-party payment providers in accordance with their terms.
Where we have given you (or where you have chosen) a password which enables you to access certain parts of the FORS website, you are responsible for keeping this password confidential.
The FORS website may, from time to time, contain links to and from the websites of our partner networks, advertisers and Affinity Partners. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.
Web Browser Cookies
By visiting the FORS website we will automatically collect the following information:
Technical information, including the Internet protocol address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, information through platforms you use; and
Information about your visit to the FORS website, including the full Uniform Resource Locators, clickstream to, through and from the FORS website (including date and time), page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to browse away from the page, and any phone number used to call the FORS Helpline.
Changes to this Privacy Statement
Any changes we make to this Privacy Statement in the future will be posted on this page and, where appropriate, notified to you by email or through the FORS eNews.
Complaints, Questions and Comments
If you have a complaint about the way in which we collect, process and store your personal data which you do not feel can be resolved by contacting us, you have the right to complain to the Information Commissioners Office.