Modeshift STARSfor Privacy Policy

 

Modeshift is committed to preserving the privacy of all users of the STARSfor system.

By registering on the STARSfor system, you consent to the collection, use and transfer of your information, including data, under the terms of this policy. Please read the following Privacy Policy to understand how we use and protect the information that you provide to us.

Who is the Data Controller?

Modeshift is the Data Controller, STARSfor is owned and operated by Modeshift. If you have a query regarding STARSfor you can contact us via email at the following email address: stars@modeshift.org.uk.

Who are the Data Processors?

All registrants in the STARSfor system are Data Processors as they will submit, control and handle data for school sites relating to them. There are two types of registrant in the STARS system including Local Authority and School registrants.

Local authority level registrants may have access to single or multiple (Regional Administrator) local authorities and are the Data Processers with access to data within the authorities that they have permission to access. This includes all personal data regarding registrants such as login email addresses and school data for the schools within their authorities. These Data Processors will have access to individual and collaborative school data logged in the STARSfor system. In some instances, 3rd party organisations/consultancies may be commissioned by a local authority to deliver services on their behalf. STARSfor in this instance may authorise local authority level access rights to 3rd party organisations under the instruction of a local authority. Please contact your local authority for details regarding how they process and handle your data with 3rd party organisations as this will be subject to their contractual obligations and data protection policies.

School level registrants may be a Headteacher, member of school staff, Governor, consultant, parent or volunteer who has permission from the school and local authority to use the STARS system. They will only have access to data that is relevant to the site/sites that they have been given approval to access.

What Personal Data do we Collect?

We collect the following personal data directly: Name Email Address Telephone number Place of work such as Local Authority or School Login History We collect the following personal data to tailor and measure our service through the use of monitoring using tools such as Google Analytics:

Additional Personal Data we may indirectly collect in STARSfor:

Our system allows registrants to log information for the purpose of developing a Travel Plan and gaining STARSfor accreditation. Registrants may record additional personal data such as: Personal data may be uploaded by users as part of evidence of action plan delivery, this can comprise of images and documentation.

For What Purposes are Personal Data Being Process and What is the Legal Basis for this?

STARSfor Website

All personal information will be stored securely and will not be shared, sold or rented to any other organisations or individuals without your permission unless required to do so by law enforcement agencies.

We hold data that you submit to the STARSfor system as part of the Terms and Conditions of STARSfor. This is so users can access the system, generate a Travel Plan and work towards applying for STARSfor accreditation. This data is used to survey travel behaviours locally, regionally and nationally.

You can opt in to be contacted with additional marketing and communications to support system usage, share best practice and provide users with news from STARSfor and wider Modeshift Partner/Supporter organisations. We will not pass your data to any organisations. You can unsubscribe from these additional communications at any time using the opt out functionality at the bottom of our emails or contacting starscomms@modeshift.org.uk.

STARSfor Events

A STARSfor Event is deemed to be any event organised for STARS system promotion, support or training or such instances as the STARSfor Regional and National Awards.

We may collect personal information relating to such events including name, address, contact information, place of work and dietary and special access requirements. This information will be used in conjunction with our events in order to deliver our services in relation to the event. We may process event bookings through the Modeshift website. Data entered into the Modeshift website (www.modeshift.org.uk) will be kept in accordance with Modeshift’s Privacy Policy

We may also request for photo consent for our events using our specific photo consent form.

All of the above information relating to the STARSfor event will be held securely and in accordance with this Privacy Policy. You can request for copies of any information we hold in relation to yourself by contacting stars@modeshift.org.uk.

Who is the Personal Data going to be shared with?

Modeshift, MS Online, PWLC Projects LLP and Hubspoke Marketing Ltd help us deliver and operate our services. In order to do so data may be shared with these parties. There are three levels of access permissions to STARSfor, all levels below National access are identified as Data Processors and STARSfor is the Data Controller with National Access to the STARS system.

School Site Level Access - access to one or more school sites in STARSfor

School level users will be able to see data relating to that site(s).

Local Authority Level Access – access to numerous school sites and data generated for those sites.

STARSfor Export Functionality – Exporting a Travel Plan

STARSfor registrants can export Travel Plans relating to a given school site. All users have export capability for the sites they have access too. The Travel Plan holds data submitted by the users (Data Processors) relating to that site. Once exported out of the STARSfor system that document becomes subject to the data protection policies of the organisation that performed the export.

Anonymous data may be included in project reports which may be made available to the public.

Mailchimp - Use of 3rd party email management databases

We may use email management platforms to coordinate communications for additional marketing communications. We use a 3rd party called Mailchimp to coordinate and manage our mailing lists and email delivery. We may share your data with Mailchimp in order for us to deliver our email communications. We may store the following information on the Mailchimp Database platform:

Only Modeshift employees and Partners/Supporters of Modeshift that are managing the STARS scheme will have access to this information and individuals can personally manage their email subscription via this platform.

Mailchimp also collects analytics regarding open and click through rates and geographical data such as location. Mailchimp may also record IP addresses and other user behaviour within the emails we send.

Will my data be transferred out of the EU and if so will it be safe?

STARSfor is hosted outside of the EU on servers in California in the United States of America. See the hosting company’s statement of GDPR compliance at: https://my.justhost.com/hosting/help/gdpr

How long is my data going to be held?

Personal data will only be held for as long as necessary. STARSfor Initiatives with accompanying evidence are automatically deleted at the point of expiry which is 3 years and 1 day after the completion date of the initiative.

Inactive user accounts will be automatically deactivated and delete after 2 years of inactivity on that account.

Will I be subject to automatic decision making?

STARSfor does not use automated decision making in relation to personal data.

What rights do I have in respect of the personal data you hold about me?

You can request a record of all the personal data that STARSfor holds on you. Requests can be made with your local administrator or the central STARSfor team by email stars@modeshift.org.uk

What happens if I don’t provide my information? (where personal data is obtained from the individual)

In order to be able to access the STARSfor system you need to provide personal information such as your name, email address, place of work so we can enable system access and verify who you are. Only approved registrants can access the STARS system.

Who can I complain to if I feel my rights are being violated?

If you are concerned that your rights have been violated, you can complain to Modeshift by emailing stars@modeshift.org.uk. Or you can contact the Information Commissioner’s Office www.ico.org.uk.

I didn’t give you my personal data, so what is the source and what type of personal data are you processing?

School and Local Authority level users may log and record data on your behalf to use the STARSfor System. We will only use this data for recording and monitoring purposes. Personal information such as this may be submitted to generate and develop a STARSfor Travel Plan. This data is subject to our data protection policies and will not be passed on.

STARSfor may review such data entered by the data processors in order to quality assure our services. This may include instances such as verifying that information such as "evidence" logged in the STARSfor database fulfils the STARSfor Accreditation criteria in order for a school site to gain accreditation.

Any changes to our privacy and data protection policies in the future will be posted to the online application and, where appropriate, through e-mail notification