This Privacy Policy explains how QSX Transport Ltd collects, uses, shares and protects personal information in the course of its shuttle dispatch, route card planning, shelter rotation, driver roster and related professional and technical services. The policy is published by QSX Transit, the developer name used for the design and maintenance of this website and its dispatch records, and it applies to every visitor, client, driver, supplier and passenger whose information reaches the office at 66 Paul Street, London - EC2A 4NA, United Kingdom (GB).
1. Who We Are
The data controller for the information described in this policy is QSX Transport Ltd, a company operating from 66 Paul Street, London - EC2A 4NA, United Kingdom (GB). The company designs and maintains dispatch systems for shuttle operations, including route card planning, shelter rotation desks, driver roster cycles, timetable sheet checks, shelter maintenance windows and lost property logs. The office is the place where those records are created, reviewed and stored, and it is the point of contact for any question about personal information.
QSX Transit is the developer name that appears in the technical documentation for this website and the dispatch board. When this policy refers to the company, it refers to QSX Transport Ltd. When it refers to the developer, it refers to QSX Transit. Both names describe the same responsible organisation, and enquiries sent to either name are handled by the same desk.
The company is registered in the United Kingdom and is subject to the data protection laws that apply in England and Wales, including the United Kingdom General Data Protection Regulation where it applies. Where a client is based outside the United Kingdom, the company also considers the local expectations of that client and applies them through its contracts and internal routines.
2. Scope of This Policy
This policy covers personal information collected through this website, through email and telephone contact with the dispatch desk, through written contracts, and through the planning records that the company maintains for its clients. It also covers information about drivers and other staff who work with a client of the company, where that information reaches the office in the course of dispatch planning.
The policy does not cover the practices of third parties whose websites or services may be linked from this site. It also does not cover information held by a client of the company within the internal systems of that client, even where the company helped to design those systems. If a client uses its own platform to collect passenger data, the client is the controller of that data and its own privacy notice applies.
Where a service is delivered under a written contract that sets out different terms for personal data, the contract prevails for the data it describes. This policy remains the general statement of how the company handles information, and it should be read together with the contract rather than instead of it.
3. Information We Collect
The company collects only the information that is needed to plan, deliver and account for its services. The categories below describe the kinds of information that may be recorded. Not every category applies to every person, and the company does not seek information that a particular task does not require.
Identity and contact details
This includes a name, a job title, an organisation name, a postal address, an email address and a telephone number. It is the information used to open a client file, to send a route plan for review, or to contact a driver about a roster change.
Contract and billing details
This includes the terms of an engagement, the services ordered, the invoicing contact, the billing address and the payment records that accounting requires. Financial account numbers are held only where a client has agreed to a direct payment arrangement and only for as long as the arrangement remains active.
Dispatch and planning records
This includes route cards, stop tags, shelter rotation sheets, driver rosters, timetable check registers, maintenance window notes and lost property log entries. These records may contain a driver name or a passenger description, and they are handled with the care described later in this policy.
Correspondence
This includes emails, letters, telephone notes and messages sent through the contact form on this website. Correspondence is kept so that the desk can answer a question accurately and so that the history of a contract remains readable.
Technical information
This includes the internet protocol address that a browser presents, the type of browser and device, the page requested and the time of the request. Technical information is recorded by a hosting provider for the purpose of operating the site and protecting it from abuse. The company does not use technical information to build a profile of an individual visitor.
Sensitive information
The company does not ask for sensitive information such as health details, religious beliefs or political opinions. If a person chooses to include such details in a message, the company will keep the message as part of its correspondence record but will not use the sensitive content for any other purpose. A person should avoid sending sensitive details unless the desk has asked for them for a clear and lawful reason.
4. Sources of Information
Most information arrives directly from the person it concerns. A client provides contact details and planning information. A driver provides a name and a roster preference. A visitor sends a message through the contact form or by email. In each case the person knows that the information is being provided to the office.
Some information arrives from a client about its own team. For example, a client may send a list of drivers and their shift preferences so that the company can build a roster cycle. In that situation the client is responsible for telling its team that the information has been shared, and the company uses the information only for the planning task that the client has requested.
A small amount of technical information is created automatically by the hosting environment when a page is requested. This information is not collected from the person in a deliberate way. It is a by product of serving a page over the internet, and it is handled as described in the technical information section above.
The company does not buy personal information from data brokers, and it does not receive personal information from advertising networks. If that practice ever changes, this policy will be updated before any such information is used.
5. Purposes of Processing
The company processes personal information for a defined set of purposes. Each purpose is tied to a service that the company actually delivers, and the company does not use information for an unrelated purpose without a lawful basis.
- To answer an enquiry sent through the contact form, by email or by telephone.
- To prepare a quotation, a route card outline or a service proposal for a prospective client.
- To deliver the six dispatch services described on the services page, including the written records that each service produces.
- To maintain the shelter board at Paul Street and the digital copy that supports it.
- To administer a contract, including invoicing, accounting and the review of a service cycle.
- To keep a lost property log and to match an enquiry from an owner to an item that has been handed in.
- To protect the website and the office from fraud, abuse and unauthorised access.
- To comply with legal, tax and regulatory obligations that apply to the company.
- To improve the clarity of the company records, for example by reviewing whether a route card format is easy to read.
The company does not sell personal information. It does not rent a contact list. It does not use personal information to train an external artificial intelligence model, and it does not permit a third party to do so with information that the company holds. Where a client asks for a planning exercise that involves an automated tool, the company will describe the tool and the data it receives before the exercise begins.
6. Lawful Basis
Under the data protection laws that apply in the United Kingdom, the company must identify a lawful basis for each processing activity. The bases used by the company are set out below.
Contract
Where a person or organisation has entered a contract with the company, the company processes the information that is necessary to perform that contract. This covers route planning, roster work, invoicing and the routine communication that a contract requires.
Legitimate interests
The company relies on legitimate interests for activities such as answering a prospective client enquiry, protecting the website from abuse and improving the readability of its records. Before relying on this basis, the company considers whether the interests of the person outweigh the interest of the company, and it applies safeguards where the balance is close.
Legal obligation
The company processes information where the law requires it, for example to keep accounting records for a statutory period or to respond to a lawful request from a public authority.
Consent
Where the company asks for consent, it does so in a clear statement that explains what the person is agreeing to and how consent can be withdrawn. Consent is not a condition of using the website, and a person can withdraw consent at any time by writing to the address at the end of this policy.
7. Dispatch and Route Records
Dispatch records are the working material of the office. A route card names the stops and the intended pull away moments. A shelter rotation sheet names the hours of attention for a shelter. A timetable check register records which sheet was confirmed and by whom. These records are created for a client and are kept so that the service can be repeated and reviewed.
Where a name appears in a dispatch record, it is usually the name of a driver, a desk member or a client contact. The company does not include passenger names in route cards. A lost property entry may include a description that a passenger has supplied, and that description is handled under the lost property section of this policy.
Dispatch records are stored at the Paul Street office and in a digital board that the company maintains. Access is limited to members of the desk who need the record to do their work. A client may request a copy of the records that relate to its own contract, and the company will provide that copy in a readable format after confirming the identity of the person making the request.
The company treats the route card as the shared source of truth for a shuttle day. If a client holds its own copy of a route card, the two copies should agree. Where a difference is found, the desk records the difference and corrects whichever copy is out of date. This routine protects against the confusion that arises when two versions of a plan are in use at the same time.
8. Driver and Staff Information
The company receives information about drivers and other staff when a client asks the company to build a roster cycle or to plan a shelter rotation. The information usually includes a name, a contact number, a shift preference and, where relevant, a note about the training or licence that a driver holds. The company does not ask for a licence number unless a client requires it for a compliance record.
Roster information is used to arrange a fair cycle and to name cover in advance. It is not used to monitor a driver outside the working day, and the company does not ask a driver to install a tracking application on a personal device. Where a client uses a vehicle tracking system, that system is operated by the client or by a carrier, and the company receives only the summary that the client chooses to share.
A driver or staff member can ask what information the company holds about them by writing to the address at the end of this policy. The company will confirm whether it holds information, describe the information and explain how it is used. Where a correction is needed, the company will make the correction and tell the client that supplied the information, so that the client record also stays accurate.
Information about drivers and staff is retained for the length of the contract and for a short period afterwards, as described in the retention section. The company does not keep a roster for longer than it can explain. When a roster is retired, the company removes the personal details that are no longer needed and keeps only the summary that accounting or legal obligations require.
9. Lost Property Information
Lost property is logged as part of the dispatch service. An entry records the date, the route card, the shelter, a short description of the item and a reference mark. The description is written in neutral terms so that an owner can identify an item by describing it, and so that the log does not reveal the item to anyone who has not seen it.
An owner who contacts the desk will be asked to describe the item. The desk compares the description with the log and confirms a match only when the details agree. The company does not publish a list of found items on this website, and it does not share the log with a third party. The log is available to the desk and to a client contact who is handling a query on behalf of an owner.
Items are held at the Paul Street office and reviewed each week. An item that remains unclaimed after the review period may be disposed of in a lawful and responsible way. The company records the disposal so that the log is complete. Where an item appears to contain identity documents or financial cards, the company handles it with particular care and may return it to the issuing authority rather than hold it.
12. International Transfers
The company is based in the United Kingdom and normally processes information within the United Kingdom. Where a service provider stores data in another country, the company takes steps to ensure that the transfer is lawful and that the information remains protected.
Those steps may include a written agreement that incorporates the standard contractual clauses approved for the purpose, an assessment of the legal environment of the destination country, and a requirement that the provider applies technical measures such as encryption. The company reviews these arrangements when a provider changes a data location.
A client that is based outside the United Kingdom may ask the company to hold planning records in a particular region. The company will say whether that is possible and, if it is not, will explain the alternative. A client should not assume that a record is stored in a particular country unless the company has confirmed that in writing.
13. Retention Periods
The company keeps personal information only for as long as it needs it. The periods below describe the normal practice. A longer period may apply where a legal obligation, a dispute or a contract requires it, and a shorter period may apply where the information is no longer needed for any purpose.
- Contact enquiries that do not lead to a contract are kept for twelve months and then removed.
- Client contract records, including route cards and rotations, are kept for six years after the end of the contract, in line with accounting practice.
- Driver rosters are kept for the length of the contract and for twelve months afterwards, then reduced to a summary without personal details.
- Timetable check registers are kept for three years so that a question about a past sheet can be answered.
- Lost property log entries are kept for twelve months after the item is returned or disposed of.
- Server logs are kept for a short period set by the hosting provider, normally not more than ninety days.
- Accounting records are kept for six years from the end of the financial year to which they relate.
When a retention period ends, the company deletes the information or removes the details that make it personal. A record that must be kept for accounting may be reduced to an amount and a date, with the linked personal details removed. The company documents its retention decisions so that a member of the desk can explain why a record is still held.
14. Security Measures
The company protects personal information with a combination of organisational and technical measures. Access to the office and to the digital board is limited to people who need it. Devices used for planning are protected by a login and by current security updates. Paper records are kept in a locked cabinet when the desk is closed.
Digital records are backed up so that a loss can be recovered, and backups are protected in the same way as the live records. Where information is sent by email, the company uses the ordinary protections of the mail service and avoids sending sensitive details unless a person has asked for them. A person should be aware that email is not a fully secure channel and should avoid sending confidential documents unless the desk has suggested a safer method.
The company trains its desk members on the handling of personal information at the start of their work and refreshes that training each year. A member who becomes aware of a security incident reports it immediately to the responsible person in the office. The company then contains the incident, assesses its effect and notifies the relevant regulator and any affected person where the law requires it.
No system can guarantee absolute security. The company therefore focuses on reducing risk to a reasonable level, on detecting a problem quickly and on responding openly when something goes wrong. A client or visitor who notices a possible security issue is asked to contact the office at once using the details at the end of this policy.
15. Your Rights
A person whose information is held by the company has a set of rights under data protection law. The company will help a person to exercise those rights and will not charge a fee unless a request is manifestly unfounded or excessive, or unless the law allows a fee for a further copy.
Right of access
A person can ask whether the company holds information about them and can request a copy of that information. The company will also explain how the information is used and with whom it is shared. A request is normally answered within one month, and the company will tell the person if a longer period is needed.
Right to correction
A person can ask the company to correct information that is inaccurate or incomplete. The company will make the correction and, where the information came from a client, will tell the client so that the client record also stays accurate.
Right to erasure
A person can ask the company to delete information where there is no longer a lawful reason to hold it. The company will comply unless a legal obligation, a contract or a legitimate ground requires it to keep the information. Where a request is refused, the company will explain the reason.
Right to restriction
A person can ask the company to restrict the use of information while a question about its accuracy or its lawful basis is being resolved. During a restriction the company will store the information but will not use it for the ordinary service.
Right to object
A person can object to processing that relies on legitimate interests. The company will stop the processing unless it can show compelling grounds that outweigh the objection. A person can always object to direct marketing, and the company will stop immediately.
Right to portability
Where processing relies on consent or contract and is carried out by automated means, a person can ask for a copy of the information in a structured and commonly used format. The company will provide the copy in a readable file where that is practical.
Right to withdraw consent
Where a person has given consent, that person can withdraw it at any time. Withdrawal does not affect processing that took place before the withdrawal. The company will explain the effect of a withdrawal before it is completed, so that the person understands any consequence for a service.
To exercise a right, write to the address at the end of this policy and describe the request. The company may ask for proof of identity so that information is not disclosed to the wrong person. A request from an authorised representative is accepted where the authority is shown in writing.
16. Privacy for Children
The services of the company are intended for organisations and for adults who work with them. The company does not knowingly collect information from a child under the age of thirteen, and it does not direct marketing to a child. The website does not offer an account, a purchase or a message board that a child could use without an adult.
Where a client operates a shuttle service that carries school pupils, the company may receive aggregate planning information such as the number of pupils expected at a stop. The company does not receive the names of pupils for route planning. If a name is sent by mistake, the company will remove it and will remind the client that names are not needed for the plan.
A parent or guardian who believes that information about a child has reached the company can contact the office. The company will check its records, remove any information that should not have been collected and confirm the action in writing. The company treats such a request as a priority and aims to answer it within a few working days.
17. Marketing Communication
The company sends marketing communication only where a person has asked to receive it or where the law permits a soft opt in for an existing client. A person who receives a message from the company can ask to be removed from the mailing list by using the link in the message or by writing to the office.
Planning records are never used to build a marketing audience. A client contact who has been named on a route card is not added to a mailing list without a separate and clear permission. The company prefers to send a short and useful note to clients at the close of a service cycle rather than a frequent marketing message.
A person can change the contact details used for marketing at any time. The company records the change and applies it to the next message. Where a person asks for all contact to stop, the company keeps only the minimum record needed to honour that request.
18. Third Party Resources
This website may link to a third party resource such as a mapping service or a professional body. A link does not mean that the company controls the third party. When a person follows a link, the privacy notice of that third party applies to the information it collects.
The website does not embed a third party tracking script. It does not load an advertising network, a social media widget or a video player that sets a cookie before a person has chosen to use it. The company keeps the site light so that a visitor can read a page without being followed across other sites.
Where the company embeds a third party resource in a client report, the company will say so in the report and will choose a resource that offers a suitable level of privacy. A client who objects to a particular resource can ask for an alternative, and the company will provide one where that is practical.
19. Changes to This Policy
The company reviews this policy at least once a year and whenever a service changes in a way that affects personal information. A revised policy is published on this page with a new effective date, and the company keeps a short record of the changes so that a client can see what has changed.
Where a change is material, the company will take reasonable steps to bring it to the attention of clients, for example by a note in the next service review. The company will not apply a materially less protective policy to information that was collected under an earlier version without a lawful basis for doing so.
A person who continues to use the website or to work with the company after a revision is taken to have read the revised policy. A person who does not accept a revision can contact the office to discuss the effect on any active contract. The company aims to resolve such a question plainly and without pressure.
20. Complaints and Regulators
If a person believes that the company has not handled personal information correctly, that person should contact the office first. The company will investigate the concern, explain what it has found and describe the action it will take. The company aims to answer a complaint within ten working days and will give a fuller reply if an investigation takes longer.
In the United Kingdom, a person also has the right to complain to the Information Commissioner. The company will provide the details of the regulator on request and will not discourage a person from making a complaint. A complaint to the regulator and a complaint to the company can run at the same time, and the company will cooperate fully with the regulator.
A client based outside the United Kingdom may also have a right to complain to a local authority. The company will help a client to identify the appropriate authority where the company can, and it will supply the information that the authority requests where the law requires it.
21. How to Contact Us
Questions about this policy, a request to exercise a right, or a concern about the handling of personal information can be sent to the dispatch desk. Please include enough detail for the company to identify the records you are asking about, and please do not send identity documents unless the desk has asked for them.
Privacy contact
QSX Transport Ltd
66 Paul Street, London - EC2A 4NA, United Kingdom (GB)
Email: dispatch@qsxtransit.buzz
Phone: +13609977536
This policy is issued by QSX Transport Ltd and describes the practices of QSX Transit, the developer name used for this website and its dispatch records. It is written in plain English so that a reader can understand it without a glossary. Where a word has a technical meaning in data protection law, the company has tried to use it only where it is necessary and to explain it in the surrounding sentence.
Thank you for reading this policy. If anything is unclear, the desk would rather answer a question than leave a reader uncertain. Write to dispatch@qsxtransit.buzz or call +13609977536 during business hours, and a member of the team will respond.