Privacy Policy

Data Protection Statement

This page explains how Transport for London (TfL), its subsidiaries, and service providers use the personal information collected from you and held in connection with your use of our Have your say digital engagement platform. It also describes how long that information is kept and the circumstances in which we might disclose it to a third party.  If you respond to a Have your say project on behalf of an organisation, not all of this page applies to you.  Please see the section on ‘responding on behalf of an organisation’ below.

Please see How To Get Involved for more information on how Have your say works.

This website will contain links to other websites for which we hold no responsibility. Those links are provided to direct you to sources of further or supporting information and may not remain current or be maintained. This statement does not apply to those websites. You should check the relevant third-party website for more information and to access their privacy statement. This also applies if you use the social media share buttons on this website. You will be directed to an external website (e.g. Facebook, LinkedIn, X, etc). 

Personal information we hold 

As we work to plan and manage London’s roads and public transport network, it’s vital that we understand the communities and individuals we’re engaging with. That means keeping a reliable record of the interactions we’ve had with individuals, businesses, elected representatives and stakeholders and other interested groups, and any relevant information which may help us better understand how to deliver projects.

We hold three types of personal information in relation to you:

Registration profile information

In order to respond to projects on Have your say you must register with the site. When you register you need to provide a username, password, your email address and set your communication preferences. We also ask a number of additional questions, such as your name and postcode. These questions are voluntary to answer.

We collect your data to:

  • communicate information to you about engagement opportunities, events and other initiatives; 
  • respond to enquiries and otherwise engage with stakeholders; and
  • analyse and interpret your feedback to help meet our objectives and obligations.

We also ask a series of equality monitoring questions (e.g. age, ethnicity and sexual orientation) when you register.  Answering these questions is voluntary. We ask these equality monitoring questions to ensure that:

  • our Have your say activity reaches all sections of the community (in line with our public sector equality duty to do so) 
  • to understand possible differences in views between sections of the community (for example to consider if the level of support for a scheme varies between age groups) and
  • to improve the effectiveness of the way we communicate with all our customers

Engagement Information

The content you create as part of your interactions with the Have your say website can include responses to surveys, comments on discussion forums, or any of the other engagement opportunities available. This is to ensure that we can understand your views on our proposals and any ideas or contributions you would like to make.

Your responses may include additional personal information you have shared with us in response to specific questions asked in relation to a proposal, as well as your views.

Usage Information

We collect information about your usage of the site to help improve how the website functions and to understand how users interact with it, for example, enabling us to monitor which pages or features are accessed, if they are useful, what tools are used, etc. We do this using cookies. For more details on this and how we use cookies more generally see our cookies statement here. 

If you respond to a Have your say project via this platform, device information (such as IP address) and log data will be collected. This is used to optimise performance and improve overall user experience. 

Under data protection legislation, TfL is only allowed to use personal information if we have a proper reason or ‘legal basis’ to do so.  In the case of public engagement and consultation, we rely on the following ‘legal grounds’: 

  • Our statutory and public functions: 
  • to undertake activities to promote and encourage safe, integrated, efficient and economic transport facilities and services, and to deliver the Mayor’s Transport Strategy;
  • our legal obligation to consult with the public under the Greater London Authority Act 1999 and other relevant Acts
  • Where you have given your consent to TfL, for example: 
  • where you have opted to receive emails from us notifying you of new engagement activity

Sometimes we also need to collect or store information that is defined as ‘special category personal data’. In respect of Have your say, this relates to the equality monitoring questions asked during registration. For example, this could include (but not be limited to) information relating to your health, racial or ethnic origin, sexual orientation and religious beliefs.

As before TfL is only allowed to use this information if we have a proper reason or ‘legal basis’ to do so. In the case of public engagement and consultation, we rely on the following ‘legal grounds’:

  • Where we have your explicit consent to collect this information

Obtaining and using your information

The personal information we hold is provided by you when you register on Have your say and when you respond to a Have your say project.  Registration details and responses are held within our digital engagement portal – Have your say.  On occasion, information may be downloaded from the platform but steps will be taken to minimise the personal information included in these extracts. 

TfL has a contract with Granicus (previously Bang The Table) who provide us with a product called EngagementHQ – this is our Have your say platform. The Granicus privacy statement can be accessed here. 

We use your personal information to manage the registration process, administer Have your say projects, and to evaluate and analyse any responses received. 

When you register with Have your say you will receive an acknowledgment email. Subsequently, you will receive automatically generated emails when you submit any responses to the engagement tools for an individual project. We will also contact you with updates on the specific Have your say project you have responded to, such as progress updates, details of results, and future developments. These project update emails will contain instructions for how you can opt-out of receiving these in the future should you wish to. 

Where you have opted in during registration, we will send you emails informing you of new projects you might wish to respond to. These emails will contain instructions for how you can opt-out of receiving these in future should you wish to.

If you chose to email a response to us directly, instead of using Have your say, you will receive an automated acknowledgment of receipt.

Have your say will use a variety of up to eight different feedback tools to allow you to provide feedback on projects. Each project will use at least one, but sometimes a variety of these feedback tools. They are a mixture of open, closed and mixed environment tools. Further details are provided in the below table:

 

Open Environment 

Mixed Environment 

Closed Environment

Tools

Forums

Ideas

Places

Stories

Guest Book

Q and A

Quick Polls

Surveys

What happens to your data

Participants can engage with each other in these environments. Usernames, comments posted, ideas and images uploaded are visible to all visitors to the site. All personal information (ie data provided at registration) is only accessible to system administrators.   

Participants and visitors can see contributions along with usernames. However, there is no opportunity to engage directly with other participants. All personal information (ie data provided at registration) is only accessible to system administrators.

Contributions remain private. Participants or site visitors do not see each other’s contributions and cannot engage with each other. All contributions and personal information are only accessible to system administrators. 

 

The table above explains that the responses you provide to some tools in the open and mixed environments will be visible to others. Where your response is visible it would only ever be your chosen username and the content of your response that can be seen. All personal information held in relation to you would remain confidential. 

The Have your say platform is moderated to ensure participants and others using the platform are safe from malicious, inflammatory, and illegal materials. Moderation takes place in relation to chosen usernames and any public-facing contributions, including the removal of personal information. Moderation could result in changes being made to a username, removal of content, temporary suspension, or permanent blocking. Participants will receive an email notification if any of this action is taken. Further details on the moderation policy can be found here.

We will not pass your personal information on to any other organisation for marketing purposes. In addition, we do not sell or rent personal information to third parties for any purpose.

Responses to Have your say projects may be made publicly available, but any personal information will be kept confidential.  A summary of who has responded to each project and a summary of views expressed may be published, and full responses may also be published.  Publication may be on our digital engagement platform, elsewhere online, and/or in printed form at the end of the project/or particular stage of the project, for example at the end of any formal consultation process.

Information provided in response to a project may also be subject to publication or disclosure in accordance with requests made under the Freedom of Information Act 2000 and Environmental Information Regulations 2004.  Any personal information provided in a Have your say response will be removed prior to disclosure. 

Children and young people 

You shouldn’t take part in a Have your say project by yourself unless you are at least 13 years old and you will be asked to confirm your age at registration.  If you are under 13, then you should only take part if you have your parent or guardian’s agreement. 

If you respond to a Have your say project and there is anything you don’t understand or aren’t sure about on this page, talk to a trusted adult (such as your parent or guardian) and ask them to help.

Choosing not to provide personal information

If you choose not to register on Have your say, you will still be able to respond to a Have your say project.  However, you will need to do so in writing or via email.  

Please note that you can browse any publicly accessible sections of this website without registering.

Length of time we keep your information

TfL will retain personal information in line with its data retention policies. This means that we will not hold information for longer than is necessary for the purposes we obtained it for. Retention periods applied to information collected by Have your say includes:

  • Raw data gathered during projects is held in full for two years after the publication of a final project report.  If the project is about a policy or scheme which requires the granting of Royal Assent or approval by the Secretary of State (or equivalent), it will be held in full for two years after such approval. After the two-year period, any personal data held in responses will be removed.
  • Registration profiles will be deleted five years after you have last submitted a response to a Have your say project.

We keep your information for the following reasons: 

  • To deliver the Have your say engagement platform, including providing a space to capture external opinion on projects and proposals
  • To support analysis of responses, including assessing if our engagement activity reaches all sections of the community
  • To allow for processing of appeals and enquiries
  • To support response to any judicial reviews to which a project can be subjected to
  • To establish and defend any legal rights 


Keeping your information secure

We take the privacy of our customers very seriously and a range of robust policies, processes and technical measures are in place to control and safeguard access to, and use of, personal information associated with public engagement and consultation activities.

We also publish guidance on the steps you can take to protect your personal information.

Anyone with access to personal information held in TfL's systems is required to complete TfL's privacy and data protection training on an annual basis.  

Automated processing and profiling

Under data protection legislation we have to let you know when we use your personal information to do something ‘automatically’ using our computers or other systems or make an automated decision (without human intervention) that significantly affects you.  TfL does not make any decisions in regard to Have your say projects based solely on the use of automated systems, databases, or computer applications.

Sharing your information 

We share information only in limited circumstances. We share respondent’s personal information with our subsidiaries and service providers for the purposes of administering Have your say projects and assessing the responses. 

We sometimes deliver engagement activities for partner organisations (eg the Greater London Authority, London Boroughs, Network Rail and the Department for Transport), and data collected through Have your say may be shared with these organisations. Data collected will be analysed by either TfL staff or an external analysis agency. 

When data is shared with a partner organisation, all personal data (including any special category data) collected via closed questions is removed, with the exception of postcode data. When data is shared with an external analysis agency it will be necessary to include answers to special category questions, but we will remove names and email addresses, however postcode data will remain.

If a Have your say project is subject to a judicial review, we may be obliged to share full responses with the assigned court. 

In some circumstances we may disclose personal information in response to valid requests from the police. Before any such disclosure takes place, the police are required to demonstrate that the personal information concerned will assist them in the prevention or detection of a specific crime, or in the apprehension or prosecution of an offender. Each request from the police is dealt with on a strictly case-by-case basis to ensure that any such disclosure is lawful and in accordance with data protection legislation.

Overseas processing

TfL and its service providers may process your personal information in the UK and countries within the European Economic Area (EEA).  Any such processing will be carried out in strict accordance with UK and EU privacy legislation and the appropriate contractual safeguards which TfL has put in place. 

Some personal data processed on the Have your say digital engagement platform will be processed in countries outside of the EEA. This is under limited circumstances only and transfers are in accordance with the requirements of the UK GDPR.

Your information rights

Under data protection legislation you are entitled to ask to see any personal information that we hold about you. To request access to personal information held by TfL, please see our page on how to access your data.

You are able to unsubscribe from emails sent in relation to projects you have responded to, or informing you of new engagement opportunities, at any time. Instructions on how to do this are noted within the emails sent.

If you no longer have an email with the instructions, then please email your request to unsubscribe to haveyoursay@tfl.gov.uk

 You also have a number of other information rights which include: 

  • The right to question any information we have about you that you think is wrong or incomplete.
  • The right to object to how we use your information or to ask us to delete or restrict how we use it.
  • In some cases, the right to receive a copy of your information in a format that you can easily re-use.
  • The right to complain to the regulator – the Information Commissioner’s Office.

The TfL Privacy and Data Protection team considers and coordinates responses to requests and complaints from people whose personal data is processed by TfL and its subsidiary companies. You can contact the Data Protection Officer by email at dpo@tfl.gov.uk. 

Responding on behalf of an organisation

If you respond to a Have your say project on behalf of an organisation (e.g. interest groups, businesses, charities, trade bodies, etc) you will be asked to provide the name of the organisation you are representing during the registration process. 

If you respond on behalf of an organisation it should be in an official capacity. The name of the organisation may be published in final project reports and potentially associated with a response, but any personal information provided in relation to the individual respondent will not be publicly available, unless legal obligations apply.

Changes to this page

It's likely that we'll need to update this statement from time to time, so check back here regularly to find out more. This page was last updated in November 2023.