Privacy Policy

❮ Help

Privacy Policy

Concerning the Data Protection Act 2018, the ‘controller’ of the personal data which you provide is the West Yorkshire Combined Authority (“The Combined Authority”, “we”, “us”) of Wellington House, 40-50 Wellington St, Leeds LS1 2DE (tel: 0113 251 7272). The Combined Authority has registered with the Information Commissioner’s Office with registration number ZA051694. The Combined Authority is the responsible statutory body for the WY Metro brand.

What data do we collect

The following pieces of personal data are collected:

  • Email Address for the purpose of account creation and logging in.
  • Date of birth, if the user wishes to purchase products offered at a discounted rate based on the user’s age. Date of birth is only used for the determination of which products the user can purchase and at what price while using the app.
  • Student Status, if the user wishes to purchase products only offered to students, the user will need to provide us with information that can indicate that they are a student. This information is only used for the determination of which products that user can purchase and the price of these products while using the app.
  • Payment details bill address. This information is captured for the purposes of allowing for the payment of products. It is not retained or held by WYCA or Yorcard, however may be retained by Opayo / Sagepay for auditing, reporting and to ensure financial regulation obligations are met.

    All personal and sensitive data is held security, being encrypted during transit and at rest.

Who processes your data

The developer of this app and the primary processor of the personal data which you provide is Yorcard Ltd, whose registered office is 11, Broad Street West, Sheffield, S1 2BQ.

Yorcard is collecting this data and will process it and share it with the Combined Authority for the following purposes:

  • to deliver the MCard and Concessionary Travel Schemes,
  • statistical monitoring,
  • compliance with government-mandated obligations such as the National Fraud Initiative.

We would also like to keep you informed of updates and offers relating to the above schemes. We will only send you this information if you consent to receive it.

The following organisations will also process the data:

  • West Yorkshire Ticketing Company (owner of the MCard brand)
  • Opayo / SagePay (to process payments)

When we will share your data

The Combined Authority will not share your personal information with any other organisation or third party other than those named above. There may be other circumstances in which we may share or use certain information about you, which are:

  • if we have a legal obligation to do so or if we are required or requested to do so by a competent authority such as the police or a court;
  • if we need to use or disclose your information to obtain legal advice or in connection with legal proceedings;
  • if we need to share your information to protect your vital interests if you are unable to give us consent or it is unreasonable for us to ask for your consent in the circumstances (e.g. if you are injured).

When will we delete your data

We will remove any customer accounts which have had no transactions for 12 months; we will also delete or anonymise any associated records.

If a user has provided their person information but not completed the account sign-up process, this data will be removed after a period of 4 weeks.

If a user requests their account is deleted, all personal information is removed within 2 weeks of a successful request.

What are your rights

Information provided to the Combined Authority will be processed on the basis of the performance of a contract with individuals, to deliver goods and services requested, as per Article 6(1)(b) of the GDPR. We do not require separate consent to use such data for this purpose. However, as a data subject, you have many rights under the Data Protection Act. These include the right to access the information which we hold about you. In some cases, you may have a right to have your personal data rectified, erased or restricted, and to object to specific uses of your data. You have an absolute right to demand that you stop receiving marketing information.

You may also ask us to delete your information at any time by contacting us at the address provided. This request would not affect the legality of what we do with your personal data before you withdraw consent and would not stop us from continuing to use your data to the extent that we do not require your consent. The request would prevent us from further using data for purposes which require your consent (e.g. marketing).

More information

If you are unsatisfied with the way we collect or handle your personal data, you have a right to make a complaint to the Information Commissioner’s Office. ICO’s website (https://ico.org.uk) has information about how to make complaints.

For further information, or to contact us to make a request, please visit https://www.westyorks-ca.gov.uk/contact/

You can contact The Combined Authority’s Data Protection Officer at Rebecca.BrookesDPO@westyorks-ca.gov.uk