1. About This Notice
Care Cars Ltd ("Care Cars", "we", "us") provides specialist home to school transport for children and young people with special educational needs and disabilities. This notice explains what personal data we collect, why we collect it, how long we keep it and what rights you have in relation to it.
This notice applies to visitors to care-cars.co.uk, to passengers and their families, to staff at schools and local authorities who commission our services, and to applicants for employment with us.
We are the data controller for the personal data described in this notice. Where we transport a passenger under contract to a local authority or school, that body will typically also be a controller in its own right, and you may wish to consult their privacy notice alongside this one.
2. Who We Are
- Care Cars Ltd, a company registered in England and Wales, company number 17398657.
- Registered office: 7 Sutherland Avenue, London, England, W9 2HE.
- Data protection enquiries: info@care-cars.co.uk.
- Our designated safeguarding lead is Fahmi Fuad Mohamed, who may be contacted at info@care-cars.co.uk.
3. Personal Data We Collect
The information we hold depends on your relationship with us.
| Who | What we collect |
|---|---|
| Website enquiries | Your name, email address, telephone number, the organisation you represent, the collection area and destination, the pattern of journeys required, your intended start date, and any support needs or further information you choose to provide. Our systems also record the IP address and browser identifier of the device used to submit the form. |
| Passengers | Name, date of birth, home address, school or provision, details of the Education, Health and Care Plan where one exists, mobility and wheelchair requirements, medical and behavioural information relevant to safe transport, communication needs, emergency contacts, and any risk assessment or care plan shared with us. |
| Parents, carers and guardians | Name, address, telephone number, email address and relationship to the passenger. |
| School and local authority contacts | Name, job title, work email address, work telephone number and correspondence relating to a placement. |
| Job applicants and staff | Name, contact details, employment history, references, right to work documentation, driving licence details, private hire licensing details, the outcome of enhanced DBS checks with children's barred list checks, and training records. |
4. Special Category and Criminal Offence Data
Information about a passenger's disability, medical conditions, behavioural needs and mobility requirements is special category data under Article 9 of the UK GDPR. We collect it because it is not possible to transport a young person safely without it.
Our lawful basis under Article 9 is Article 9(2)(b), processing necessary for obligations in the field of social protection law, and Article 9(2)(c), processing necessary to protect vital interests, in each case read with the substantial public interest conditions in Schedule 1 of the Data Protection Act 2018 relating to safeguarding of children and of individuals at risk.
Information about the criminal record of our staff, obtained through the Disclosure and Barring Service, is criminal offence data under Article 10. We process it in reliance on the safeguarding condition in Part 2 of Schedule 1 to the Data Protection Act 2018.
We maintain an appropriate policy document covering our processing of special category and criminal offence data, as required by Schedule 1 of the Data Protection Act 2018. A copy is available on request.
5. Why We Process Your Data and Our Lawful Basis
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and have concluded that they are not. You may object to processing carried out on this basis at any time, as described in section 11.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries submitted through our website | Legitimate interests — responding to a person who has contacted us about our services. |
| Planning routes, allocating staff and delivering transport | Performance of a contract with you, or with the local authority or school commissioning the journey. |
| Assessing and managing risk, and completing risk assessments | Legal obligation, and our legitimate interest in operating a safe service. |
| Safeguarding children and young people, including making referrals | Legal obligation, and protection of vital interests. |
| Meeting licensing, insurance and operator obligations | Legal obligation. |
| Recruiting and employing staff, including background checks | Performance of a contract, and legal obligation. |
| Investigating complaints, incidents and insurance claims | Legal obligation, and our legitimate interest in defending legal claims. |
| Keeping accounting and tax records | Legal obligation. |
6. Children's Data
Most of the passengers we transport are children, and we treat their information with corresponding care.
Our website is directed at parents, carers and professionals rather than at children, and we do not knowingly collect personal data submitted by a child through it. Information about a passenger reaches us from a parent or carer, from a school, or from a local authority.
We disclose information about a passenger only where it is necessary for their safe transport, where we are required to do so by law, or where a safeguarding concern makes disclosure necessary. Our drivers and passenger assistants receive only the information they need in order to carry out the journey safely.
7. Who We Share Data With
We do not sell personal data, and we do not share it for marketing purposes. We share it in the following circumstances.
- With the local authority or school commissioning a placement, where necessary to arrange and evidence the transport provided.
- With our drivers and passenger assistants, limited to the information required to complete the journey safely.
- With the emergency services, where there is a risk to life or a medical emergency during a journey.
- With social services, the police or another safeguarding partner, where a safeguarding concern requires it. We will not seek your consent before making a safeguarding referral where doing so would place a child at increased risk.
- With our insurers, brokers and legal advisers, in connection with a claim or a legal matter.
- With our accountants and auditors, in connection with our statutory obligations.
- With regulators, including the Information Commissioner's Office and licensing authorities, where required.
- With the service providers listed in section 8, who process data on our behalf under written contract.
8. Service Providers and International Transfers
We use the following processors to operate our website and enquiry system. Each is engaged under a written data processing agreement.
| Provider | Purpose and location |
|---|---|
| Vercel Inc. | Hosting of the public website. Content is served through a global content delivery network. |
| Railway Corp. | Hosting of our enquiry application and its database, in which website enquiries are stored. |
| Resend (Plus Five Five, Inc.) | Delivery of notification emails generated by the enquiry form. Our sending region is configured as Ireland (eu-west-1). |
| Cloudflare, Inc. | Domain name resolution for care-cars.co.uk. |
| [EMAIL PROVIDER] | Hosting of our info@care-cars.co.uk mailbox and correspondence. |
9. Transfers Outside the United Kingdom
Some of the providers listed above are established in the United States and may process data outside the United Kingdom. Where personal data is transferred outside the UK, we rely on the International Data Transfer Addendum to the European Commission's standard contractual clauses, or on UK adequacy regulations where these apply to the receiving country.
You may request further information about the safeguards applied to a particular transfer by contacting us at info@care-cars.co.uk.
10. How Long We Keep Data
At the end of the applicable period, records are securely deleted or destroyed.
| Record | Retention period |
|---|---|
| Website enquiries that do not lead to a placement | Twelve months from the date of the enquiry. |
| Passenger records where transport was provided | [SEVEN YEARS] from the end of the placement. |
| Safeguarding and child protection records | Until the individual's twenty-fifth birthday, in line with recognised retention guidance for records concerning children. |
| Incident, accident and complaint records | Seven years from the date of the incident, or longer where a claim remains live. |
| Accounting and tax records | Six years from the end of the accounting period, as required by the Companies Act 2006. |
| Recruitment records for unsuccessful applicants | Six months from the date of the decision. |
| Employment records after a member of staff leaves | Six years from the date of leaving. |
| DBS certificate information | The certificate number and date of issue only. Certificate content is not retained beyond six months from the recruitment decision. |
11. Your Rights
Under the UK GDPR you have the following rights in relation to your personal data.
- The right to be informed about how we use your data, which this notice is intended to satisfy.
- The right of access to the personal data we hold about you.
- The right to have inaccurate data corrected.
- The right to have data erased in certain circumstances.
- The right to restrict processing in certain circumstances.
- The right to data portability, where processing is carried out by automated means on the basis of consent or contract.
- The right to object to processing carried out on the basis of legitimate interests.
- The right not to be subject to solely automated decision-making with legal or similarly significant effects. We do not carry out such decision-making.
A parent or person with parental responsibility may generally exercise these rights on behalf of a child who is not old enough to do so themselves. Where a young person is competent to exercise their own rights, we will deal with them directly.
To exercise any of these rights, contact us at info@care-cars.co.uk. We will respond within one month. We may ask for proof of identity before disclosing personal data. There is no charge unless a request is manifestly unfounded or excessive.
Some rights are qualified. We may not be able to erase or restrict records we are required to keep for safeguarding, licensing, insurance or accounting purposes.
12. Cookies and Website Analytics
Our website does not set cookies, does not use analytics or tracking technologies, and does not embed advertising or social media trackers. No consent banner is therefore required.
Our hosting and content delivery providers process technical information such as IP addresses in server logs in order to deliver the site and protect it from abuse.
Where you submit the enquiry form, we record the IP address and browser identifier of the submitting device. This is used to identify and block automated abuse of the form, and is retained for the same period as the enquiry itself.
13. Security
We take appropriate technical and organisational measures to protect personal data. These include encryption of data in transit using TLS, access controls limiting staff access to what is necessary for their role, contractual confidentiality obligations on all staff, and data processing agreements with each of our providers.
No transmission over the internet is entirely secure. Where you send us sensitive information about a child, we encourage you to use the enquiry form or a secure channel agreed with us rather than unencrypted email.
14. Vehicle Cameras
[Where cameras are fitted to our vehicles, describe here: which vehicles carry them, whether they record the interior, the exterior or both, whether audio is captured, the purpose of the recording, how long footage is retained, and who may view it. Signage must be displayed in any vehicle fitted with a camera, and a data protection impact assessment must be completed before cameras are used.]
[If no cameras are fitted to any vehicle, replace this section with a single sentence confirming that, and delete this bracketed text.]
15. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at info@care-cars.co.uk so that we can try to resolve the matter.
You also have the right to complain to the Information Commissioner's Office at any time. The ICO can be contacted at ico.org.uk, on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
16. Changes to This Notice
We review this notice periodically and will update it where our processing changes. The version number and date at the top of this page indicate when it was last revised. Where a change materially affects how we use your data, we will take reasonable steps to bring it to your attention.
CARE CARS LTD · Registered in England & Wales no. 17398657
Registered office: 7 Sutherland Avenue, London, England, W9 2HE
Data protection enquiries: info@care-cars.co.uk