Examples of the types of data held by VCA

The following are some of the type of data held by VCA where personal data may be held. Note that this list is not exhaustive.

In all cases VCA has explained the lawful basis for processing your information. Where there are other legislative requirements under which we will process your data, then these have also been cited.

Financial information

Account details are held on a secure server for seven years (see our retention policy).  For single one-off payments where payment by credit or debit card is required, VCA will destroy all card details immediately following completion of a transaction, but retain other personal details for the purposes listed below.

We will not disclose any financial details you provide to us other than to allow access by

• Auditors, i.e. The Government Internal Audit Agency (GIAA); and the National Audit Office (NAO);
• Other areas of the UK Government engaged in pursuing investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and as part of any prosecution activity.

Please note that in each of these cases, VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations state that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject.

Type approval applications (including Conformity of Production data)

As part of the process, you will have provided us with certain contact data that will allow us to keep you updated on the progress of your application.

Account details are held on a secure server so long as they had a live approval with us (see our retention policy).

Further processing: We may also use your contact details to give you the opportunity to comment on the service that has been provided and have the opportunity to provide feedback (note that all feedback is optional and provided anonymously).

Within the supporting document, there may also be personal information that may be shared with:

• Colleagues within other areas of the Department for Transport – to cross check information against applications under other approval schemes;
• Other European member states – as part of our European mutual recognition agreement.
• Other areas of the UK Government engaged in pursuing investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and as part of any prosecution activity.

Please note that in each of these cases, VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations state that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject

Mutual Recognition information

In order to process an application for the importation of a vehicle into the UK, VCA requires certain personal data. VCA will hold your personal information in line with our retention policy.

VCA will only share your personal information with a third party where there is a justified and necessary reason for doing so and then only with the following types of organisation:

• Colleagues within other areas of the Department for Transport – to cross check information prior to registration;
• Other UK Government Departments –in order to pursue their own investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and if required in prosecution cases.

Please note that in each of these cases, VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject;

The legislative framework under which Vehicle Importing tasks are carried out can be found under SI 2009 No 717 for M & N class vehicles. Ministers Approval Certificates are issued according to the requirements of Section 58 of the Road Traffic Act 1988.

Applications for employment

More information on this area will follow.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

VCA staff contractual information and pay, pensions etc.

All relevant information can be found in the VCA Staff Handbook (SHB-A04).

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose.

Requests for information

Requests made under the Freedom of Information Act 2000; Environmental Information Regulations 2004; Data Protection Act 1998; General Data Protection Regulations 2016; or other general enquiries. Personal data is collected for the sole purpose of processing your request and retained in line with our retention policy.

VCA will only share your personal information with a third party where there is a justified and necessary reason for doing so and then only with the following types of organisation:

• Colleagues within other areas of the Department for Transport – to cross check information prior to registration or to respond direct to your request;
• Other areas of the UK Government engaged in pursuing investigations concerning the protection or detection of crime; or to protect the misuse of public funds;
• Law enforcement agencies – to assist in their investigations concerning the protection or detection of crime and as part of any prosecution activity.

Please note that in each of these cases, VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject.

Dangerous Goods packaging and tanks certification

Personal data is collected for the sole purpose of processing your request and retained in line with our retention policy.

VCA will only share your personal information with a third party where there is a justified and necessary reason for doing so and then only with the following types of organisation:

• Colleagues within other areas of the Department for Transport – to cross check information prior to registration or to respond direct to your request;
• Other areas of the UK Government engaged in pursuing investigations concerning the protection or detection of crime; or to protect the misuse of public funds;

Please note that in each of these cases, VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject.

Mailing lists for seminars and other events

Personal data is collected for the purpose of processing your request to attend the event and retained in line with our retention policy.

VCA will not share your personal information with a third party.

Further processing: VCA will retain your details for up to two years to enable it to notify you of other similar or repeat events managed by VCA. See the main Privacy Notice and Information Charter which explains your rights in this area.

VCA will not use a mailing list compiled for one purpose, such as The Dangerous Goods Seminar for example, to inform you of dissimilar events.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Vista and LegStat subscriptions

Personal information from subscribers is collected and stored in our Customer Relationship Management database. The information is used to provide services within agreed timeframes. At the end of the subscription period, the personal information is retained in line with our retention policy

VCA will not process this data further nor share your personal information with a third party.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Point of Sale subscription service

Limited personal information (names and email addresses) of subscribing franchised dealerships is collected and stored within our Customer Relationship Management database. The information is used by VCA to provide service updates and allow dealers to recover their access details. At the end of the subscription period, the personal information is retained in line with our retention policy

VCA will not process this data further nor share personal information held within the PoS system with a third party.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Fuel Consumption booklet / CD-ROM mailing list

VCA keep a list of those individuals who have asked to receive copies of the annual Fuel Consumption and CO₂ CD-ROM. . You can unsubscribe from our annual mail-out at any time by sending an email to fuel@vca.gov.uk. Please add the word “unsubscribe” in the title and include your name and postal address in the main text.

VCA will not process this data further nor share your personal information with a third party.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(a) and (b) of the General Data Protection Regulations states that:

(a) Consent: the individual has given clear consent for you to process their personal data for a specific purpose; or

Appeals and Complaints

VCA will keep your personal details on file for as long as required to deal with your complaint and thereafter, in line with our retention policy

VCA will only share your personal information with a third party where there is a justified and necessary reason for doing so and then only with the following types of organisation:

• Colleagues within other areas of the Department for Transport – where the complaint relates to practices or policies that is better addressed by the central Department;
• The Independent Complaints Assessor (ICA), or Parliamentary and Health Service Ombudsman (PHSO) – should your complaint need to be escalated

Please note that in each of these cases, VCA will not seek your approval to share this information.

Lawfulness of processing

For these activities, VCA has a lawful base for processing the information in as much as paragraph 1(b) and (c) of the General Data Protection Regulations states that:

(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; or

(c) processing is necessary for compliance with a legal obligation to which the controller is subject.