For the purposes of the Data Protection Act 2018 and the General Data Protection Regulation, GDPR, the ‘controller’ of the personal data which you provide in the attached form is the West Yorkshire Combined Authority ("the Combined Authority"), “we”, “us”) of Wellington House, 40-50 Wellington St, Leeds LS1 2DE (tel: 0113 251 7272). The Combined Authority is registered with the Information Commissioner’s Office with registration number ZA051694. The Combined Authority is collecting this data and will process it for the purpose of delivering the M-Card and Concessionary Travel Schemes, statistical monitoring and to comply with government mandated obligations such as the National Fraud Initiative. We would also like to keep you informed of updates and offers relating to the above schemes. We will only send you this information if you consent to receive it. The data will also be processed by the following organisations: Local Councils (for the processing of Blind and Disabled Person’s travel passes only) Euclid (card printer) Dogma (who provide additional database management support) West Yorkshire Ticketing Company (owner of the M-Card brand) Your employer (for the processing of the Corporate Annual M-Card only) The Combined Authority will not share your personal information with any other organisation or third party other than those named above. There may be other circumstances in which we may share or use certain information about you, which are: 1. If we have a legal obligation to do so or if we are required or requested to do so by a competent authority such as the police or a court. 2. If we need to use or disclose your information to obtain legal advice or in connection with legal proceedings. 3. If we need to share your information to protect your vital interests if you are unable to give us consent or it is unreasonable for us to ask for your consent in the circumstances (e.g. if you are injured). We will retain your information for 366 days after either the expiry of the last registered card or, the date of the last transaction on an account whichever is shorter. Pink M-Cards customer information will remain on the system unless the customer requests that their information be deleted. Any incomplete customer records will be removed after 3 months. Information provided to the Combined Authority will be processed on the basis of the performance of a contract with individuals, to deliver goods and services requested. We do not require separate consent to use such data for this purpose. However, as a data subject you have a number of rights under the DPA. These include the right to access the information which we hold about you. In some cases you may have a right to have your personal data rectified, erased or restricted, and to object to certain use of your data. You have an absolute right to demand that you stop receiving marketing information. Please be aware that by registering a dependant’s details, you are responsible for ensuring the accuracy of their details as well as adherence to all associated terms and conditions, including our aforementioned privacy statement You may also withdraw your consent and ask us to delete your information at any time by contacting us at the address provided. This would not affect the legality of what we do with your personal data before you withdraw consent and would not stop us from continuing to use your data to the extent that we do not require your consent. It would stop us from further using data for purposes which require your consent (e.g. marketing). If you are unsatisfied with the manner in which we collect or handle your personal data you have a right to make a complaint to the Information Commissioner’s Office. Information about how to make complaints can be found on the ICO’s website at ico.org.uk