Examples of the types of data held by the VCA

The following are some of the types of data held by the VCA. Note that this list is not exhaustive.

In all cases the VCA has explained the lawful basis for processing your information. Where there are other legislative requirements under which we will process your data, then these have also been cited.

Financial information

Account details are held on a secure server for seven years (see our retention policy). For single one-off payments where payments by credit or debit card is required, the VCA will destroy all card details immediately following completion of a transaction but retain other personal details for the purposes listed below.

We will not disclose any financial details, or any associated personal details provided other than to allow access by:

• Auditors, i.e. The Government Internal Audit Agency (GIAA); and the National Audit Office (NAO);
• Other areas of the UK Government engaged in pursuing investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and as part of any prosecution activity.

Please note that in each of these cases, the VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations state that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject.

Type approval applications (including Conformity of Production information)

As part of the process, you will have provided us with certain contact data that will allow us to keep you updated on the progress of your application.

Account details are held on a secure server so long as they had a live approval with us (see our retention policy).

Further processing: We may also use your contact details to give you the opportunity to comment on the service that has been provided and have the opportunity to provide feedback (note that all feedback is optional and provided anonymously).

Within the supporting document, there may also be personal information that may be shared with:

• Colleagues within other areas of the Department for Transport – to cross check information against applications under other approval schemes;
• Other European member states – as part of our European mutual recognition agreement.
• Other areas of the UK Government engaged in pursuing investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and as part of any prosecution activity.

Please note that in each of these cases, the VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations state that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject

GB Provisional Scheme Information

In order to process an application for the importation of a vehicle into the UK, the VCA requires certain personal data. The VCA will hold your personal information in line with our retention policy.

The VCA will only share your personal information with a third party where there is a justified and necessary reason for doing so and then only with the following types of organisation:

• Colleagues within other areas of the Department for Transport – to cross check information prior to registration;
• Other UK Government Departments –in order to pursue their own investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and if required in prosecution cases.

Please note that in each of these cases, the VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

The legislative framework under which Vehicle Importing tasks are carried out can be found under SI 2009 No 717 for M & N class vehicles. Ministers Approval Certificates are issued according to the requirements of Section 58 of the Road Traffic Act 1988.

Applications for employment

The VCA uses Oleeo as its recruitment system. It stores candidates’ applications online and they are retained securely for a period of two years. After this time Government Recruitment Service will complete a cleanse and remove any candidate data.

Electronic records of recruitment campaigns are stored in electronic folders which are only accessible to the Local HR team. Candidate interview notes are retained securely by HR in hard copy for a period of three months (as this is the cut off for appeals with the Civil Service Commissioners). Following this time, they are securely disposed of.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(a) of the General Data Protection Regulations states that:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

VCA staff contractual information and pay, pensions etc.

All relevant information can be found in the VCA Staff Handbook (SHB-A04).

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

Requests for information

Requests made under the Freedom of Information Act 2000; Environmental Information Regulations 2004; Data Protection Act 1998; General Data Protection Regulations 2016; or other general enquiries. Personal data is collected for the sole purpose of processing your request and retained in line with our retention policy.

The VCA will only share your personal information with a third party where there is a justified and necessary reason for doing so and then only with the following types of organisation:

• Colleagues within other areas of the Department for Transport – to cross check information prior to registration or to respond direct to your request;
• Other areas of the UK Government engaged in pursuing investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and as part of any prosecution activity.

Please note that in each of these cases, the VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject.

Dangerous Goods packaging and tanks certification

Personal data is collected for the sole purpose of processing your request and retained in line with our retention policy.

The VCA will only share your personal information with a third party where there is a justified and necessary reason for doing so and then only with the following types of organisation:

• Colleagues within other areas of the Department for Transport – to cross check information prior to registration or to respond direct to your request;
• Other areas of the UK Government engaged in pursuing investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and as part of any prosecution activity.

Please note that in each of these cases, the VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject.

Mailing lists for seminars and other events

Personal data is collected for the purpose of processing your request to attend the event and retained in line with our retention policy.

The VCA will not share your personal information with a third party.

Further processing: the VCA will retain your details for up to two years to enable it to notify you of other similar or repeat events managed by the VCA. See the main Privacy Notice and Information Charter which explains your rights in this area.

The VCA will not use a mailing list compiled for one purpose, such as The Dangerous Goods Seminar for example, to inform you of dissimilar events.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Vista and LegStat subscriptions

Personal information from subscribers is collected and stored in our Customer Relationship Management database. The information is used to provide services within agreed timeframes. At the end of the subscription period, the personal information is retained in line with our retention policy

The VCA will not process this data further nor share your personal information with a third party.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Point of Sale subscription service

Limited personal information (names and email addresses) of subscribing franchised dealerships is collected and stored within our Customer Relationship Management database. The information is used by the VCA to provide service updates and allow dealers to recover their access details. At the end of the subscription period, the personal information is retained in line with our retention policy

The VCA will not process this data further nor share personal information held within the PoS system with a third party.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Appeals and Complaints

The VCA will keep your personal details on file for as long as required to deal with your complaint and thereafter, in line with our retention policy

The VCA will only share your personal information with a third party where there is a justified and necessary reason for doing so and then only with the following types of organisation:

• Colleagues within other areas of the Department for Transport – where the complaint relates to practices or policies that is better addressed by the central Department;
• The Independent Complaints Assessor (ICA), or Parliamentary and Health Service Ombudsman (PHSO) – should your complaint need to be escalated

Please note that in each of these cases, the VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, the VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject.