Data processing
How we handle your data
Vayacare is registered with the ICO (ref: ZB472910). This page describes the personal data we process, our legal basis, and your rights. For our full privacy policy, see our GDPR page.
Data we process
We act as a data processor for local authorities (the data controller) in respect of child and carer data. For employee and contractor data, we are the data controller.
Child / young person
Legal basis
Legal obligation (SEND Code of Practice) · Contract performance
Retention
7 years after last journey
Data collected
Full name, date of birth, gender
Home address and collection point
Education, Health and Care Plan reference
School / placement name and address
Communication passport and medical information
Attendance and journey records
Welfare notes and incident records
Parent / carer
Legal basis
Contract performance · Legitimate interests
Retention
7 years after contract end
Data collected
Name, phone number, email address
Relationship to child
App account credentials (hashed)
Message and communication history
Satisfaction survey responses
Driver / passenger assistant
Legal basis
Legal obligation (safeguarding) · Employment contract
Retention
7 years after employment ends
Data collected
Name, address, date of birth
DBS certificate number and status
Training and certification records
Route assignment and journey logs
Incident and welfare reports authored
Vehicle usage records
LA portal users
Legal basis
Contract performance · Legitimate interests
Retention
Duration of contract + 3 years
Data collected
Name, job title, email address
Access credentials (hashed)
Audit trail of portal actions
Downloaded reports and exports
Your rights
Right of access
You can request a copy of personal data we hold about you (or a child in your care). We will respond within one calendar month.
Right to rectification
If data we hold is inaccurate, you can ask us to correct it. Corrections to child data require agreement from the commissioning LA.
Right to erasure
You can request deletion of personal data where we have no legal basis to retain it. Note: statutory retention obligations apply for journey and incident records.
Right to restrict processing
You can ask us to restrict processing while a dispute or complaint is outstanding.
Right to data portability
You can request your data in a machine-readable format. We provide CSV and JSON exports via the LA portal.
Right to object
Where processing is based on legitimate interests, you have the right to object. We will stop processing unless we have compelling legitimate grounds.
Data protection enquiries
Contact our Data Protection Officer at dpo@vayacare.co.uk. We aim to respond to all enquiries within 5 working days and to all Subject Access Requests within one calendar month.