Data Collection and Data Protection
We take the privacy of our customers very seriously.
We have chosen a Flowly patented solution that is privacy friendly, and that guarantees the anonymity and protection of users’ personal data.
To ensure our approach to the collection of data is appropriate, we completed data protection impact assessments before we began collecting the data.
As part of this trail we are collecting and retaining the following personal data for the below purposes:
| Data | Purpose | Retention period |
|---|---|---|
| Mobile Access Control (MAC) address | Flowly Wi-Fi Data Collection trial | 3 hours |
| Log Data | Flowly Wi-Fi Data Collection trial | 24 hours |
| Opposed MAC address | To allow exercise of Art. 21 GDPR rights | For the duration of the trial |
| Cookies | To allow exercise of Art. 15 – 22 GDPR rights through dedicated Flowly website | Session duration |
| IP address | To allow Opposed MAC address execution | 3 months |
| Data relating to customer queries and opposition requests received via email | To allow exercise of Art. 15 – 22 GDPR rights through dedicated Flowly email. | 12 months |
Data Subjects are not subject to automated processing as defined in GDPR.
The legal basis for this processing is legitimate interest of the controller, which consists of testing a device for measuring the flow of passengers by developing aggregated and anonymous statistics to optimize public transport services.
Under certain circumstances, by law you have the right to:
- access personal data*
- request rectification of personal data*
- request erasure of personal data*
- request restriction of processing* of personal data concerning data subjects
- object to such processing*
* Prior to anonymisation of the data – up to 3 hours after collection of MAC address; however, post data anonymisation the data and associated GDPR rights are no longer available.
If you do not wish to participate in this trial, you can object to collection of your data through the dedicated third party (Flowly) website at: https://luas.flowly.re/
You will not have to pay a fee to access your personal information (or to exercise any of the other rights); however, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access the personal information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request in order to speed up our response.
We try to respond to all legitimate requests within one month of receiving them. Occasionally, it may take us longer than a month if your request is particularly complex or if you have made a number of requests. In this case, we will notify you and keep you updated about our timing for response.
Transfer of data: All data will remain within the European Union.
The Data Protection Officer considers and coordinates responses to any requests that relate to an individual’s rights under the GDPR and complaints from people whose personal data is processed as part of this trail. You can contact the Data Protection Officer by post to: Transdev Dublin Light Rail Limited, Luas Depot, Red Cow Roundabout, Clondalkin, Dublin 22, D22 C5P3 or email: [email protected]
If you have any issues about our handling of your personal information or about our data protection compliance, you have the right to make a complaint at any time to the Data Protection Commission (DPC), which is the Irish supervisory authority for data protection legislation (including under the GDPR).