Privacy Notice – User Research

Introduction

The Vehicle Certification Agency (VCA) is conducting user research as part of the Government Digital Service (GDS) assessment for Phase 2 of the eCoC project, which includes the new “find an eCoC” service. This research is being carried out to understand how users interact with the service, assess its usability and accessibility, and identify improvements before the service moves further through assurance and delivery.

What data we are collecting and how we will use it

We are processing the following personal data:

• Name
• Email address
• Age range
• Gender
• Ethnicity
• Disability status
• Information about accessibility needs or use of assistive technologies
• Research feedback provided during interviews, usability testing, or accessibility testing
• Audio or video recordings, where the participant has agreed to these

Personal data is required to contact participants, organise and deliver research sessions, ensure that research includes a diverse and representative range of users, and understand whether the service is usable and accessible for people with different needs and backgrounds.

Our lawful basis for collecting your data

Under data protection law, the lawful basis for processing your data is:

Article 6(1)(a) – consent

Participants have explicitly consented to the use of their personal data for the purposes of this activity.

As we are also processing your special category data, a further section of the UK GDPR applies:

Article 9(2)(a) – substantial public interest (with a basis in law)

Participants have explicitly consented to the use of their personal data for the purposes of this activity.

Article 9 data is collected only where participants choose to provide information such as ethnicity, disability status, or other accessibility-related information. This is used solely to support equality monitoring and to ensure that the research includes a diverse range of users and carefully considers accessibility.

Data sharing

Organisations who process personal data on our behalf:

• CEOX Services Ltd, acting as a processor on behalf of VCA, may access participant information and research data for the purpose of delivering user research activities for the Phase 2 eCoC GDS assessment. Data will remain stored on VCA systems and will not be removed from the VCA SharePoint environment.

Organisations we share your data with for their use:

• We do not share your personal data with other organisations for their own purposes as part of this user research activity.

International transfers of your personal data

We do not intend to transfer your personal data outside the UK. Research data will be stored on VCA systems.

How long we retain the data

The data collected when we invite you to take part will be held for the duration of the project (due to complete by the end of 2026). After this point, we will delete this but will keep a record of consent, your name, and the data gathered during the research session.

We will hold the data from research sessions, your name, and a record of consent for a maximum of 3 years.

Further information

For more information about your rights in relation to your personal data, how to complain or how to contact the DfT Data Protection Officer, view the Privacy Notice page.