Tees Valley Combined Authority - Care Leavers Portal Privacy Policy

1. Management and Ownership

The Tees Valley Care Leavers Portal is owned and operated by South West Smart Applications Limited, trading as Smart Applications Management (SAM), on behalf of the Tees Valley Combined Authority (TVCA).

In this policy, “we”, “us” and “our” refer to TVCA as the Data Controller.

SAM acts as a Data Processor, processing personal data on our behalf for the purposes described in this policy.

2. Terms of Use

By using the Portal, you agree to this Privacy Policy and to our Terms of Use. These may be updated from time to time without prior notice. Continued use of the Portal after any changes indicates acceptance of the updated terms.

This Privacy Policy explains what personal data we collect, how we use it, the legal basis for processing, how long we keep it, who we share it with, and your rights under UK data protection law.

3. Purpose of This Privacy Policy

This Privacy Policy explains how the Tees Valley Combined Authority collects and processes your personal data when you use the Care Leavers Portal and associated services.

It should be read together with any additional privacy notices provided at the point of data collection. This policy supplements those notices and does not override them.

4. Data Controller

Tees Valley Combined Authority is the Data Controller for all personal data processed through the Care Leavers Portal.

Contact details

Tees Valley Combined Authority

Teesside Airport Business Suite

Teesside International Airport

Darlington

DL2 1NJ

If you have any questions about this policy or wish to exercise your data protection rights, please get in touch with us using the details above.

You also have the right to raise concerns with the Information Commissioner’s Office (ICO) at www.ico.org.uk

5. Changes to This Policy / Duty to Inform Us of Changes

We regularly review this Privacy Policy. This version was last updated on 14 November 2025.

Historic versions can be obtained by contacting us.

To ensure your information remains accurate, please notify us of any changes to your personal data during your relationship with us.

6. Third-Party Links

The Portal may contain links to third-party websites, plug-ins or applications. Clicking these may allow third parties to collect data about you. We do not control these sites and are not responsible for their privacy practices.

Please read the privacy policies of any external websites you visit.

7. What Personal Data We Collect

To provide and operate the Care Leavers Portal and the Care Leavers Pass scheme, we collect and process the following personal data:

• Name
• Delivery Address
• Email address
• Date of birth
• Photographs
• Portal usage data and ticket/pass usage information

This data is required to administer your eligibility and to provide the services offered through the Portal.

8. Legal Basis for Processing

We process your personal data under the following lawful bases of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018:

a) Performance of a contract (Article 6(1)(b))

To:

• verify your eligibility for the Care Leavers Pass
• issue and manage your pass
• administer your Portal account

• provide customer support and operational services

b) Compliance with a legal obligation (Article 6(1)(c))

Including obligations relating to:

• fraud prevention
• audit requirements

• statutory responsibilities under transport legislation

c) Public task (Article 6(1)(e))

TVCA has statutory transport duties under Part 2 of the Transport Act 2000, including promoting safe, integrated, efficient and economic transport.

d) Legitimate interests (Article 6(1)(f))

SAM may process limited usage data to improve system performance and enhance the user experience, where this does not override your rights.

9. How We Use Your Personal Data

We use your data to:

• provide and manage the Care Leavers Portal
• verify entitlement to the Care Leavers Pass
• maintain your account and issue passes
• provide customer support and troubleshooting
• notify you of significant changes or service issues

• comply with legal and contractual obligations

We may also use aggregated, anonymised usage data to improve the Portal and future online services. This data cannot identify you.

10. Service Messages and Statutory Transport Information

You may receive operational and service-related messages, including:

• account information
• pass usage or expiry notifications
• security alerts
• updates necessary to provide the service

• significant scheme changes or service interruptions

Because TVCA has a statutory duty to promote local transport, occasional messages may include public sector transport-related information, such as:

• bus service changes
• fare information

• journey planning guidance

These messages support TVCA’s public task and are not marketing.

11. Marketing

We do not use any personal data for marketing purposes. Specifically:

• We do not carry out direct marketing
• We do not profile individuals for marketing
• We do not sell, rent or share personal data for marketing
• We do not ask for or rely on marketing consent

• We do not share your personal data with any third party for their marketing purposes

All contact you receive is strictly service-related.

12. How Long Do We Keep Your Data

We keep your personal data for as long as you have an active pass (i.e., within its expiry date and not blocked or cancelled).

After your pass becomes inactive, we retain your personal data for 12 months, after which it will be deleted or securely archived.

13. Who We Share Your Data With

Your personal data is stored and processed by SAM, acting as Data Processor. SAM staff may access your data only for operational purposes and only on our instructions.

We do not share your data with any other organisation unless:

• you give explicit consent; or

• we are legally required to do so (e.g., for fraud prevention or law enforcement).

SAM does not transfer personal data outside the UK or EEA.

14. Fraud Prevention and Detection

As a public authority, TVCA is required to protect public funds. We may share information with relevant bodies for:

• preventing or detecting fraud
• auditing public funds

• ensuring compliance with statutory obligations

Such sharing is always carried out lawfully and proportionately.

15. Your Rights Under UK Data Protection Law

You have the following rights:

• Right of access – to request a copy of your personal data
• Right to rectification – to correct inaccurate or incomplete data
• Right to erasure – to request deletion where lawful
• Right to restrict processing – in specific circumstances
• Right to object – to processing based on legitimate interests
• Right to data portability – where processing is based on a contract and carried out by automated means

• Right to withdraw consent – but only where consent is the lawful basis (not applicable here)

To exercise your rights, contact:
contact@talktosam.co.uk

You can also contact the ICO at www.ico.org.uk.

16. How to Contact Us About Your Data

If you have questions, concerns or requests relating to your personal data, please contact:

Data Protection Team
Tees Valley Combined Authority
Teesside Airport Business Suite
Teesside International Airport
Darlington
DL2 1NJ

Contact: info@teesvalley-ca.gov.uk