IAM RoadSmart Privacy Notice
Who we are
IAM RoadSmart is the trading name of all businesses owned by The Institute of Advanced Motorists Limited.
The Institute of Advanced Motorists Limited is a registered charity in England & Wales, and separately in Scotland. Formed in 1956,
spending more than 60 years making our roads safer by improving driver and rider skills through coaching and education.
Here at IAM RoadSmart we are committed to protecting your privacy. We comply with the principles of the UK General
Data Protection Regulation (UK GDPR) and aim to maintain consistently high levels of best practice in our processing of personal data.
This privacy notice covers IAM RoadSmart in relation to the collection and use of the personal data processed
by or on behalf IAM RoadSmart.
If you have any questions about this notice or concerns relating to your personal data, please contact us using the details provided at the bottom of this notice.
A list of the companies within the IAM
RoadSmart Group can be obtained from us at the contact address below.
• Contact details, such as title, full name, postal address, email address, contact telephone numbers
• Your date of birth, gender and/or age
• Records of your contact and our communication with you such as phone calls and emails
• Information on the products and services, you have purchased from us, also products and Services you have shown an interested in
• Driving licence number
• Vehicle information, such as make and model
• Vehicle telematics and information about your driving behaviour and incident history (including risk assessment information) and driver training
history
• Information we obtained from third parties, including information about risk
• Information about your driving licence status, entitlements, and endorsements
• Criminal records information (driving offence codes)
• Medical conditions or your health if you have special requirements
• Financial details about you, such as salary; (for example, for employment)
• Information about your employment status, (for example, for employment)
• Technical information such as your address when you visit our website. we also collect and use your personal data via cookies
How we collect your data
• We'll collect personal data from the following sources:
• From you directly
• From our affiliated local groups
• From our partners who are a part of providing products and services to you on our behalf
•
From your employer, for example when instructed to provide products or services to you
• When you visit our website
• The driver and vehicle licensing agency (DVLA) and the driver and vehicle agency in Northern Ireland (DCA)
• Processing a service which you may have been offered by the police or by a magistrates’ court
Our legal basis for processing and using your personal data
IAM RoadSmart and affiliated local groups aim to be very clear when we collect your personal data and will not do anything you wouldn’t reasonably expect to provide the products and/or services that you request, to communicate with you, and to personalise
our information we send to you.
We will use your personal data in several ways which reflect the legal basis applying to the processing of your data.
Contract
We will process your personal data because it is necessary for the performance of a contract. which may include some or all the following:
• Providing you with products and services or information you have requested i.e., the purchase of a driving/riding
course or membership
• Mailing of membership magazines
• Maintaining and updating your record
• Providing you with products and services or information you have requested
• Sharing your personal data with partners
and service providers when you or your employer have requested training or other products or services
• Undertake an online driver risk assessment or driving licence checking services requested by your employer
• For
some of our safety-related driver profiling and risk assessments decision-making products
• All stages and activities relevant to providing safety advice or managing the products or services requested by you or your employer
Legitimate interests
We may process personal data because it is in our legitimate interests to do so, which may include some or all the following:
• To monitor and protect the health and safety of you, other customers, our staff and third parties
• To
monitor and protect the security (including network security) of the Company, of you, other customers, our staff, and others
• Contacting you by phone, email, or SMS in relation to services that are relevant to your enquiry
• Providing
you with products and services or information you have requested
• Managing any aspect of the enquiry you have made, the product or service you have purchased or are interested in
• To administer membership services, member
benefits and including processing membership fees
• Maintaining and updating your records
• To monitor and to keep records of our communications with you and our staff
• To provide communications to help us to offer you
relevant advice, training products and services which we think you may be of interest to you
• To notify you about new or existing IAM RoadSmart services, products, and special offers we think you'll find valuable
• To better understand
how people, interact with our websites
• Where the processing enables us to enhance, modify, personalise, or otherwise improve our services / communications for the benefit of our customers
• To develop or improve our advice, products,
and services and to review or improve current products and services.
• Quality and monitoring purposes such as your recorded voice calls for the purpose of ensuring that we continually improve the service that we offer and for our staff
training requirements
• We may ask for additional information from you to deliver the specific product or service purchased such as information about any medical conditions or your health, if you have special requirements, or if you are
a vulnerable customer to assist us in providing a service to you
• Undertaking a driving licence check or other driving compliance check on behalf of your employer
• Undertake an online driver risk assessment on behalf of your
employer to identify risks to your safety
• To verify the accuracy of data that we hold about you
• Meeting our legal, contractual, and regulatory obligations and requirements
Consent
IAM RoadSmart may wish to disclose personal data for a secondary purpose (i.e., a purpose not directly related to the primary purpose for which the information was collected). In such cases IAM RoadSmart will seek your consent before doing so.
IAM
RoadSmart relies on consent to share your personal data with Cornmarket Insurance Services Ltd, for the purpose of providing you with ‘IAM members-only’ insurance benefits. Cornmarket Insurance Services Ltd are the official insurance provider
for IAM RoadSmart.
Upon Cornmarket Insurance Services Ltd receiving your information to provide a quote, they may contact you via telephone, email, text, or post with details of exclusive ‘IAM members-only’ insurance services
they offer. Cornmarket Insurance Services Ltd will become the controller and shall comply with its obligations under the Data Protection Legislation. Your consent will also be used to verify your IAM RoadSmart Membership status with Cornmarket Insurance
Services Ltd should they require confirmation.
Legal obligation
We may process personal data because we have a legal obligation under the Rehabilitation Courses (Relevant Drink Offences) Regulations 2012 (as amended 2015), Road Traffic Offenders Act 1988 (under sections 34,34A, 34B, 34BA,34C) and the Road Safety Act
2006 (under section 35). To provide educational services which may be offered to you by the magistrates’ court.
We may also disclose your personal data if we are required to do so under any legal obligation and may use external data for
the purposes of fraud prevention and credit risk reduction, or were doing so would not infringe your rights, but is necessary and in the public interest.
How and when can you withdraw your consent?
Where we're relying upon your consent to process personal data, you can withdraw that consent at any time by contacting us as detailed below.
Disclosure of information to third parties
IAM RoadSmart will not share your details to third parties except:
a) Where we have your permission
b) Where we are required to deliver your product or service
c) Where we are required by law and by law enforcement agencies, judicial bodies, government entities, tax authorities or regulatory bodies around the world
Third parties may deliver some of our products to you or provide all or part of the service requested by you. In these instances, whilst the information you provide will be disclosed to them, it will be kept secure, it will only be used for the administration of the service provided and to maintain management information for business analysis. To deliver these products and services, IAM RoadSmart may utilise the following third parties:
| 3rd Part Services | Information shared and reason to doing so |
| Insurance Services | IAM RoadSmart may pass your contact details onto Cornmarket Insurance Services Ltd, who are a 3rd party so that they can contact you via telephone, email, text, or post with details of the exclusive ‘IAM members-only’ insurance
services they offer |
| Print & Mailing Services | IAM RoadSmart share your name and contact details to a 3rd party as they print and mail out all our membership renewal packs and reprinted membership cards |
| Merchandising Services | IAM RoadSmart may pass your name and contact details onto a 3rd party as they fulfil all our branded merchandise and clothing orders that you order from IAM RoadSmart |
| Print & Mailing Services | IAM RoadSmart may pass your contact details onto a 3rd party who print and mail all our course packs, certificate packs, reprinted membership cards, duplicate certificates, gift vouchers and any other printed materials relating to your IAM
membership |
| Publishing & Mailing Services | IAM RoadSmart may pass on your name and address to these companies so that they can post you the membership magazine three times a year |
| HMRC | If you have made a Gift Aid declaration, we may disclose the information you provided to HMRC for the purpose of reclaiming Gift Aid on your donation(s) |
| Affiliated Local Groups, Examiners & Trainers | IAM RoadSmart may share your details with affiliated local groups, examiners and trainers for identification checking purposes and so that they may deliver IAM RoadSmart products and services, such as IAM RoadSmart driving or riding courses
|
| Affiliated Local Groups, Examiners & Trainers | IAM RoadSmart may share your Test / Assessments / IMI Programme results and report with affiliated local groups, examiners, and trainers to managing any aspect of the product or service |
| Affiliated Local Groups, Examiners, Trainers & 3rd Party | IAM RoadSmart may share your details with affiliated local groups, examiners, trainers, or 3rd parties, to investigate and resolve any complaints you have raised directly with us |
| Affiliated Local Groups, Examiners, Trainers & 3rd Party | IAM RoadSmart may share your details with affiliated local groups, examiners, trainers, or 3rd parties, to investigate a data breach or where you have exercised one of your legal rights under the UK GDPR |
| The Institute of the Motor Industry (IMI) | IAM RoadSmart may share your details with The Institute of the Motor Industry (IMI) to administer the IAM’s IMI Accreditation scheme |
| Research Bodies | IAM RoadSmart may share the information you give us, with approved research bodies in an anonymised and/or pseudonymised format. You will not be personally identifiable from any such data. The research body will perform evaluations of our
products or conduct road safety related research on our behalf |
| Licence Checking and Risk Assessment Providers | IAM RoadSmart may pass your details to providers of services such as licence checking and online driver risk assessments, where this is necessary for the delivery of a driver risk management solutions |
| DVSA, DVLA or HM Courts | To compile statistical information, to confirm your attendance or non-attendance at the course, provide either a certificate of course completion or notice of non-completion through the Criminal Justice Secure Mail system |
| Joint Approval Unit of Periodic Training (JAUPT) | Your information may be shared with Joint Approval Unit of Periodic Training (JAUPT) for them to monitor and manage approved DDR providers for quality assurance and compliance reasons |
| Payment gateway provider | IAM RoadSmart uses a Payment gateway provider to enables us to accept card payments through a secure online payment page. The Payment gateway provider is accredited to the highest possible level of card data security, ensuring all transactions
are encrypted to the highest global standards |
| Other Organisations and Businesses | who provide services to us such as debt recovery agencies, back up and server hosting providers, IT software and maintenance providers |
If we provide information to a third party (either a provider of a product or service, or an external data processing agency such as a mailing house) we will exercise the strictest control over the third party contractually, requiring it and any of its agents and/or suppliers to:
• Maintain the security and confidentiality of the information and restrict access to those of its own employees
• Use the data for the agreed purpose only and prevent it being used for any other purpose by any other party
• Refrain
from communicating with you other than concerning the product in question
• Return the data to us at the conclusion of any contract term and destroy or delete any copies made of all or any part of the information unless copies are needed
to be kept complying with regulations
In addition, we will restrict the information disclosed to the absolute minimum necessary, for example, to provide the product or service.
Security
The security of your personal data is essential to us, we have appropriate security policies, physical, technical, and organisational measures in place to help protect your information.
We only store your personal data within the European Economic
Area (the “EEA”). The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein. This means that your personal data will be fully protected under the EU GDPR and/or to equivalent standards by law. Transfers of personal
data to the EEA from the UK are permitted without additional safeguards.
Your personal data is only accessible by appropriately trained staff, volunteers, and contractors, and stored on secure servers with features enacted to prevent unauthorised
access.
If you provide us with credit or debit card details to pay for a product or service, we use a third-party service to process the payment. The service provider is accredited to the highest possible level of card data security, ensuring
all transactions are encrypted to the highest global standards.
Marketing
Unless you have told us that you do not want to hear from us, we may send you relevant information (including details of other products or services provided by IAM RoadSmart which we believe may be of interest to you). If you change your mind about how
you would like us to contact you or you no longer wish to receive this information, you can tell us at any time by writing to, emailing, or calling us using the contact details below.
How we use cookies
"Cookies" are small pieces of information sent by a web server to a web browser, which enables the server to collect information from the browser.
The common Cookies IAM RoadSmart utilise are as follows:
| Cookie Name | Functionality |
fr, _fbp, wd, datr | Cookies created by Facebook that allow the tracking of users between Facebook and this website via a Facebook Pixel. Their primary use is to measure the results of Facebook advertising. |
.AspNet.Cookies and ASP.NET_SessionId | To track if a member is logged into the Sitefinity website |
SF-TokenId, sfExpPages, OpenIdConnect | Cookies created by Sitefinity to allow the website access to function correctly when logged in. |
sf_timezoneoffset | Is a Cookie created by Sitefinity that allows Sitefinity to work to UTC but display the appropriate time for the logged in user |
shoppingCartId | Utilised by the current users shopping cart, this is used to allow their cart to persist between visits to the website |
_ga, _gat, _gid | Cookies associated with Google Analytics; these cookies allow visibility of statistics of those browsing the site |
O2CAllowCookies | Is a cookie created by One2Create and is used on our commercial website to allow the website to store cookie opt in/out settings |
sf-tracking-consent, tracking-consent-categories | Cookies created when you opt to allow cookies on the website. This will mean your accepted cookie settings will be retained as you browse the website. |
You may refuse to accept cookies by activating the setting on your browser which allows you to block cookies. However, if you select this setting you may be unable to access certain parts of our site, including services and on-line shopping. Unless you
have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site or opt accept cookies on our site. Details of how to disable the Cookie function can be found at the help menu on your browser.
You may refuse to accept cookies by activating the setting on your browser which allows you to block cookies. However, if you select this setting you may be unable to access certain parts of our site, including services and on-line shopping. Unless
you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site. Details of how to disable the Cookie function can be found at the help menu on your browser.
How we use Google Analytics
When someone visits our website, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the volume and profile (age, gender, geographical
location etc.) of visitors to the various parts of the site. This information is only processed on a group basis and in a way, which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities
of those visiting our website.
How we use Facebook Pixel
When someone visits our website, we use a third-party service, Facebook Pixel, to collect standard internet log information and details of visitor behaviour patterns. This data is used to make sure that Facebook adverts are shown to the right people, to measure the results of Facebook adverts, and to drive more relevant users to the site. We do not use Facebook Pixel to collect the identifying information of individuals.
How we use Hotjar
We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf. For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.
How we use Wi-Fi
IAM RoadSmart provides our employees and visitors with access to Wi-Fi at our business location. We have several Wi-Fi networks available for use and only the device Mac Address is captured to ensure your device functions correctly while searching for and connected to our networks. IAM RoadSmart does not perform any monitoring of information.
How long do we keep your personal data?
We will not keep your personal data for any longer than is necessary for the purpose for which it was first collected, and for legitimate and essential business purposes, such as complying with our legal obligations.
We may retain information after your association with us has come to an end. Some information may be retained indefinitely for historical, statistical or research purposes.
Data records provided to us for provision of Magistrates Court referred training courses. We are legally required to hold this data, and data about your rehabilitation, to fulfil our statutory obligations for up to seven years from the set course completion date.
Your rights
You have several legal rights to control what IAM RoadSmart can do with your information. For example:
• The right to be informed about the collection and use of your personal data
• The right to access the information we hold
about you
• The right to correct or update information we hold about you
• The right to have the information we hold about you erased
• The right to restrict the processing of your personal data
• The right
to data portability, to transfer your personal data to another controller
• The right to object to the processing of their personal data in certain circumstances
Please note that:
In some cases, exercising these rights
may mean that we are no longer able to deliver the products and services you have requested.
Please also note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.
It is important that
your personal data is kept accurate and up to date. If any of the personal data we hold about you changes, please keep us informed.
If you have any cause for complaint about our use of your personal data, you can make a complaint to the Information
Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, so please contact us first, using the details below.
Changes to this Privacy Notice
We may change this privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.
Please check this privacy notice for changes whenever you visit
our website and each time you consider giving your personal data to us.
Contact us
Please contact us if you have any questions about our privacy notice or information, we hold about you:
• In writing to: The IAM RoadSmart Data Protection Coordinator at IAM RoadSmart, 1 Albany Place, Hyde Way, Welwyn Garden City AL7 3BT
• Via email to: data.protection@iam.org.uk
• Via telephone to: The IAM RoadSmart Data Protection Coordinator at 0300 303 1134
This Policy was last updated on 13/10/2021
The Institute of Advanced Motorists Limited, Reg. in England and Wales. CRN: 562530.
Charity no: 249002 (England and Wales) SCO41201 (Scotland).
IAM Drive & Survive Limited, Reg. in England and Wales. CRN: 2019635.
Professional Driver Services Limited, Reg. in England and Wales. CRN: 4498365.
Registered address for all the businesses listed above is: 1 Albany Place, Hyde Way, Welwyn Garden City, AL7 3BT
