Privacy Policy

Data controller: Paul Reeves - datacontroller@colasrail.com

The organisation collects and processes personal data relating to its employees, contractors and other third parties who use the CARL App. The organisation is committed to being transparent about how it collects and uses that data and to meeting its data protection obligations.

What information does the organisation collect?

The organisation collects and processes a range of information about you. This includes:

• your name,
• your email address,
• your phone number

The organisation collects this information from forms completed by you when you register for CARL.

Data is stored in our IT systems.

Why does the organisation process personal data?

The organisation needs to process data in order to operate the app.

Who has access to data?

Your information will be shared internally, including with members of the Safety team, managers in the business area in which any report may occur and IT staff if access to the data is necessary for performance of their roles.

Your data may be stored in the UK or Ireland at Microsoft Azure data centres. The reason being this is where the data centres used are located. All required safeguards are in place at these facilities for the security of the data.

How does the organisation protect data?

The organisation takes the security of your data seriously. The organisation has internal policies and controls in place to try to ensure that your data is not lost, accidentally destroyed, misused or disclosed, and is not accessed except by its employees in the performance of their duties.

For how long does the organisation keep data?

The organisation will hold your personal data in accordance with our document retention procedure and for as long as legally required or as long as reasonably necessary.

Your rights

As a data subject, you have a number of rights. You can:

• access and obtain a copy of your data on request;
• require the organisation to change incorrect or incomplete data;
• require the organisation to delete or stop processing your data, for example where the data is no longer necessary for the purposes of processing;
• object to the processing of your data where the organisation is relying on its legitimate interests as the legal ground for processing; and
• ask the organisation to stop processing data for a period if data is inaccurate or there is a dispute about whether your interests override the organisation's legitimate grounds for processing data.

If you would like to exercise any of these rights, please contact data.controller@colasrail.com

If you believe that the organisation has not complied with your data protection rights, you can complain to the Information Commissioner.