Bradford Clean Air Zone Privacy Notice

A Clean Air Zone (CAZ) is an area where targeted action is taken to improve air quality, in particular by discouraging the most polluting vehicles from entering the zone. No vehicle is banned in the zone, but those which do not have clean enough engines will have to pay a daily charge if they travel within the area.

Our core data protection obligations and commitments are set out in Bradford Council's primary privacy notice.

This supplemental notice explains how the Council processes and shares your personal data for the purposes of the CAZ as joint data controller with the Joint Air Quality Unit (JAQU). JAQU is a joint unit of Department of Transport (DfT) and the Department for Environment, Food and Rural Affairs (Defra) established to oversee the UK plan for tackling roadside nitrogen dioxide (NO₂) concentrations.

The Bradford Clean Air Zone privacy notice deals only with personal data where Bradford Council is Joint Controller with JAQU.  For information on how JAQU processes and shares your personal data with organisations other than the Council please refer to JAQU's own privacy notice.

To enable the Council to operate its CAZ, JAQU is delivering the CAZ Central Service, a digital service that allows the Council to: 

• determine whether a vehicle entering a CAZ is compliant with the CAZ Framework, and if the vehicle is not compliant, whether it is liable to be charged and, if so, how much: and
• provide a first point of contact for the resolution of queries and to support assisted digital users.

The CAZ Central Service also allows individual motorists and fleet operators to pay for entry into the CAZ.

Personal information we collect and use

Information collected by us

The Council's automatic number plate recognition (ANPR) cameras covering the CAZ to record your number plate ("vehicle registration mark").  Your number plate will also be collected if you use the vehicle checker ("Check if you'll be charged to drive in a Clean Air Zone") service.

The information we collect will be the minimum we need to deliver our service and will include the following personal data which will be shared by the Council and JAQU with CAZ Central Service customer contact centre through which you can make any enquiries concerning operation of the CAZ, and to enable resolution of any queries you may have

• Name
• Surname
• Phone number
• Email address
• Number plate ("vehicle registration mark")

How we use your personal information

We collect your personal information for the following purposes:

If your vehicle is liable to be charged and travels in the CAZ you will be able to pay using a credit or debit card, or by Direct Debit. When you enter your bank details to make payment, your payment data will be processed by the CAZ Central Service (using GOV.UK Pay and Go Cardless acting on behalf of JAQU, who will store the payment transaction). The payment date is exchanged with the CAZ Central Service but will not be stored.

An email address will be requested from you to allow a payment transaction receipt to be sent by GOV.UK Notify. The Council will be sent confirmation of the payment including the vehicle number plate that has been paid for. The payment information in the CAZ Central Service is matched with the ANPR feed from local authorities to exchange payment status.

How long your personal data will be kept

We will hold your personal information in line with Bradford Council’s retention schedule. At its expiry date the information will be reviewed, and only retained where there is an on going requirement to retain for a statutory or legal purpose. Following this your personal information will be securely destroyed.

JAQU will retain your payment transactions for a period of 7 years in the service. These include the number plate(s) against which the payment is made. Users will be able to view transaction payment history for up to 18 months of account creation or from when a payment is completed.

The email data is retained on the GOV.UK Notify platform for a period of 7 days and then deleted.

How long your personal data will be kept

We will hold your personal information in line with Bradford Council’s retention schedule. At its expiry date the information will be reviewed, and only retained where there is an on going requirement to retain for a statutory or legal purpose. Following this your personal information will be securely destroyed.

JAQU will retain your payment transactions for a period of 7 years in the service. These include the number plate(s) against which the payment is made. Users will be able to view transaction payment history for up to 18 months of account creation or from when a payment is completed.

The email data is retained on the GOV.UK Notify platform for a period of 7 days and then deleted.

Reasons we can collect and use your personal information

The legal basis for the processing of your personal data is that this is necessary for the performance of a task carried out in the public interest and in the exercise of official authority vested in:

• DfT and Defra, as partners in JAQU; and
• the Council as operator of the CAZ.

The lawful basis on which we collect and use your personal data is that

• Processing is necessary for compliance with a legal obligation
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6 (1) (e) of the UK GDPR)

We hold the information in line with the following legislation:

• Transport Act 2000
• The Road User Charging Schemes (Penalty Charges, Adjudication and Enforcement) (England) Regulations 2013

Who we share your personal information with

We may sometimes share the information that we have collected about you where it is necessary, lawful and fair to do so. We may share information with the following for these purposes:

NO2 Plan Evaluation data

In order to understand the extent to which the programme is meeting its stated aim of reducing nitrogen dioxide concentrations to within legal limits in the shortest possible time, a clear understanding of fleet composition (with reference to Euro Standards) before, during and after implementation of Local Plan measures, is needed.

We will be sharing VRM details with JAQU before the CAZ goes live, and then quarterly for the duration of the evaluation.  DfT will match this data with vehicle type and emissions data which will be anonymised, before being sent back to the local authority and 3rd parties (Ricardo Energy and Environment and Ipsos MORI) for further evaluation and reporting.

Website pixel (Breathe Better Bradford pages)

We have installed tracking code on all the Breathe Better Bradford pages of this website to help us learn more about users' interests in the site.

Bradford Council and our third-party vendors use cookies and similar technologies to deliver, maintain and improve our services and advertising. Our partners will collect data and use cookies for ad personalization and measurement. The aim is to make sure that any advertising we create is as relevant as is reasonably possible to our audience. The Pixel enables us to create 'custom audiences' adverts at groups of people who have visited certain pages. It also helps us to measure how effective our adverts are. We cannot identify individual visitors to our web pages by using this Pixel.

You can opt out of receiving these targeted adverts by visiting the Your Online Choices website.

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

JAQU has an access management process that controls who has access to all systems and audits user access on a regular basis to update access rights. Security arrangements are in place to ensure that only authorised personnel can access the data e.g. log in accounts for licensing authorities.

We also have procedures in place to deal with any suspected data security incidents and we will notify you and the appropriate regulator of any incident where we are legally required to do so.

When your data is sent to other countries?

We do not send any information we collect about you outside the United Kingdom.

Rights for individuals under UK GDPR

• Find out about the rights for individuals under UK GDPR

What are your rights?

Please contact the Corporate Information Governance Team at dpo@bradford.gov.uk to exercise any of your rights in relation to Bradford Council being joint data controller, or if you have a complaint about why your information has been collected, how it has been used or how long we have kept it for.

You can contact our Data Protection Officer at dpo@bradford.gov.uk or write to: Data Protection Officer, City Hall, Centenary Square, Bradford, BD1 1HY.

Under the arrangement agreed between the Council and JAQU, JAQU has been identified as the main point of contact.  You can raise any queries about the information provided by the vehicle checker service by using the web form available at contact.dvla.gov.uk/caz/.

If you have any questions about how your personal data is processed in relation to the CAZ Central Service, please contact:

Data Protection Manager for JAQU by email at data.protection@defra.gov.uk.

What is the arrangement between the Joint Controllers regarding other matters concerning my personal data?

The Joint Controllers have agreed the following arrangement to determine their respective obligations under the UK GDPR:

• They have jointly prepared this privacy notice.
• They will cooperate with each other in responding to any request each receives from data subjects exercising their rights under data protection legislation in relation to their personal data (a ‘Data Subject Request’). The party which receives the Data Subject Request will fulfil the obligations of the controller to respond to the request in accordance with data protection legislation.
• They will provide reasonable assistance to each other to enable a Data Subject Request to be dealt with in an expeditious and compliant manner.
• Each shall be responsible for fulfilling the controller’s responsibilities under data protection legislation as to security of personal data when that personal data is processed on systems controlled by that party.
• If one Joint Controller discovers a data breach, that party (the ‘Reporting party’) will be responsible for assessing whether the breach constitutes a personal data breach that is required to be notified to the Information Commissioner’s Office and (where applicable) to the data subjects under Articles 33 and 34 of the UK GDPR. The Reporting party shall fulfil the obligations of the controller to give such notice, if it is required, in accordance with data protection legislation.
• They have agreed to provide reasonable assistance to each other in order to facilitate the handling of any data breach in an expeditious and compliant manner.
• In the event of a dispute brought by a data subject or a data protection authority concerning the processing of personal data against either or both of them, the Joint Controllers will inform each other about any such disputes or claims, and will cooperate with a view to settling them amicably in a timely fashion.

Irrespective of the above arrangement, you can exercise your rights under the UK GDPR in respect of and against each of the Joint Controllers if you wish.

The UK GDPR also gives you the right to lodge a complaint with the Information Commissioner's Office who are the supervisory authority responsible to regulate and monitor the legislative obligations within the UK and can be contacted on 03031 231113.