This charter sets out what you can expect from us when we ask for, or hold, your personal information. It also covers what we ask from you to help us keep your information up to date.
We know how important it is to protect your privacy and to comply with the General Data Protection Regulations (GDPR).
If we ask for your personal information we will:
- let you know why we need it;
- only ask for what we need, and not collect excessive or irrelevant information;
- make sure nobody has access to it who shouldn’t;
- let you know who we share your information with;
- tell you if we need to transfer your information overseas and what safeguards are in place;
- let you know whether we’re are asking because of a statutory or contractual obligation;
- be clear about the possible consequences, if any, of not providing the information;
- not share it with other organisations unless we have told you in advance, unless we are obliged to do so by law;
- only keep it for as long as we need to and tell you how long; and
- not make it available for commercial use, such as marketing.
In dealing with your personal information, we will also:
- value the personal information entrusted to us and make sure we respect that trust;
- abide by the law when it comes to handling personal information;
- consider the privacy risks when we are planning to use or hold personal information in new ways, such as introducing new systems or processes; and
- provide training to staff who handle personal information and respond appropriately if personal information is not used or protected properly.
In return, to help us keep your information accurate and up to date, we ask you to:
- give us accurate information; and
- tell us as soon as possible of any change of circumstance.
How to exercise your rights under the GDPR
You have a number of rights under the GDPR which you can exercise by contacting us at the details provided below.
You can find out what personal information, if any, we hold about you and if we do hold information about you we will:
- give you a description of it;
- tell you why we are holding it;
- tell you who it could be disclosed to; and
- let you have a copy of the information in an intelligible form.
It will help us locate any data we might hold about you if, in making your request, you could state what dealings we have had with you and why you expect us to hold information about you.
You are entitled to have HS2 correct information about you if it is incomplete or inaccurate.
You can ask us to remove or delete personal information we hold about you. Please note however, that this right is only applicable in certain circumstances. We will let you know whether information can be deleted when you make your request. You can ask us to restrict how we use your information. Again, this right is only applicable in certain circumstances and we will explain those to you when you make your request.
You can object to certain types of uses of your personal information. Specifically, processing based on:
- HS2’s legitimate interests
- Our performance of a task in the public interest or the exercise of official authority
- Scientific/historical research and statistics
You can find out more information about your rights under GDPR on the Information Commissioner’s website.
How to make a complaint
If you’re unhappy with the way we have handled your personal information and want to complain, please write to us.
We will acknowledge your complaint within 2 working days and let you have a full response within 20 working days. If it is not possible to respond fully within this timescale, we will write and let you know why and say when you should expect to receive a full response.
If you are not satisfied with our response you can complain to the Information Commissioner’s Office.