Personal information we hold
If you are a registered Santander Cycles member, or Business Account holder, the information we hold about you may include:
- Email address
- Telephone/mobile number
- Password, security question and answer
- Billing preferences
- Payment card information or bank account and sort code
- Marketing and communication preferences
- Cycle Access Key reference number
- The location, date and time a cycle was hired and docked
- Enquiries, complaints or other correspondence from you
On occasion, TfL will ask you for the name and address details of additional users who you have authorised to use the bikes. This may be in connection with a claim made on the scheme's Public Liability Insurance or in relation to the terms and conditions or code of conduct.
Legal basis for using your information
Under data protection legislation, TfL is only allowed to use personal information if we have a proper reason or 'legal basis' to do so. In the case of Santander Cycles, there are a number of these legal grounds we rely on, which are:
- Our statutory and public functions:
- to undertake activities to promote and encourage safe, integrated, efficient and economic transport facilities and services, and to deliver the Mayor's Transport Strategy
- Where you have given your consent to TfL, for example where:
- you have opted in to receive marketing messages or in-app notifications from us
- you have asked the contact centre to resolve an issue or complaint for you
- you agree to enable location services or notifications within the Santander Cycles app
- For the 'performance of a contract', for example:
- in connection with the purchase of a cycle hire key, annual membership or short term hire
- where you have created an online account or downloaded the app so we can provide additional services to you
Obtaining and using your information
The personal information we hold is provided by you when you register to become a Santander Cycles member, either via our website or app. We also record information about your journey on each occasion you hire or dock a bike (ie where you start and finish your trip, together with the date and time).
We use your personal information to provide you with access to the cycle hire scheme, to process your payments and to provide you with customer services associated with being a member.
If you are a registered Santander Cycles member, we may send you information from time to time on issues relating to cycling in London via email. This might include:
- A series of Welcome emails when you first join - with information on how to use the scheme and other useful cycling information
- Important changes to the scheme such as availability of bikes, new docking stations, changes to fees
- Cycling safety
- Monthly and annual summaries of your scheme usage and cycling milestones
- New ways to pay for, or access, the scheme
- Consultations about TfL's plans for cycling in London
- Cycling routes, Cycle Super Highways or Cycle Quietways
You will be able to unsubscribe from any or all of these messages at any time.
We will only send you information about TfL's offers and promotions if you choose to receive it and you will be able to change your marketing preferences at any time.
We will not pass your personal information on to any other organisation for marketing purposes without your prior consent. In addition we do not sell or rent personal information to third parties for any purpose.
If you telephone TfL, your call may be recorded for training and quality purposes and if you contact us by email, we will check that your contact details are up to date and amend our records where necessary.
Some of our docking stations have CCTV cameras installed. This is for the purposes of preventing and detecting crime and antisocial behaviour.
Occasionally TfL may use aggregated or depersonalised Santander Cycles information to carry out research and analysis, for example, to assess the effectiveness of road or passenger safety initiatives. We may also use it to identify improvements we might need to make to the scheme. Individuals will not be identified using this information.
Choosing not to provide personal information
If you choose not to provide personal information to us, you will not be able to open an online account or become a registered Santander Cycles member. However, you can still make use of Santander Cycles as a casual user at any time
It may also delay or prevent us from offering other services to you such as the resolution of complaints or concerns.
Length of time we keep your information
TfL will retain personal information in line with its data retention policies. This means that we will not hold information for longer than is necessary for the purposes we obtained it for.
We will keep your personal information for as long as you're a customer or member of Santander Cycles.
After you stop being a customer or member we will keep your information for up to seven years. This is for the following reasons:
- To respond to correspondence, concerns or complaints
- To maintain records according to rules that apply to us (for example financial regulations)
- To establish and defend any legal rights
Call recordings made when you contact Customer Services are kept for 6 months.
Keeping your information secure
We take the privacy of our customers very seriously, and a range of robust policies, processes and technical measures are in place to control and safeguard access to, and use of, personal information associated with Santander Cycles. This includes payment card data which is handled in accordance with the Payment Card Industry Data Security Standard (PCI DSS).
We also publish guidance on the steps you can also take to protect your personal information.
Automated processing and profiling
Under data protection legislation we have to let you know when we use your personal information do something 'automatically' using our computers or other systems, or make an automated decision (without human intervention) that significantly affects you.
Any hire charges due are automatically calculated based on the times you undock and then return a cycle to a docking station. Payment is then automatically taken from your credit or debit card.
If you do not return your Santander Cycle or you damage it we may also automatically charge your credit or debit card with the relevant fee.
If you believe you have been incorrectly charged you can ask our contact centre to review those transactions.
If you're a registered member, we use your journey information to send you monthly and annual activity summaries and to send you service updates about Santander Cycles.
Sharing Santander Cycles information
We share information only in limited circumstances. We share users' personal information with our subsidiaries and service providers for the purposes of customer services and administration, payment processing, to provide travel-related information and for customer research and fraud prevention.
If you have a direct debit to pay Santander Cycles, we will share your information with the Direct Debit scheme.
In the event that you make a claim on the scheme's Public Liability Insurance for yourself or on behalf of an additional user we will, on request from the insurance provider, share relevant information with them or their agent for the purposes of verifying and processing your claim.
TfL will share your personal information with the scheme's sponsor for marketing purposes where you have explicitly agreed that we can do so. You can opt out from receiving marketing information from the Scheme Sponsor at any time by amending your marketing preferences via your online account or by telephone on 0343 222 6666.
We sometimes work with our local authority partners and other stakeholders on initiatives to encourage more active or sustainable travel. As part of this we may issue promo codes so that people can make use of Santander Cycles for free or at a reduced rate.
If you hire a bike in this way please then you should check the terms of your use with the body that provided you with your promo code. We may provide them with information relating to your usage of the code, including number of hires, average journey times and start and end points.
At our discretion, we may disclose personal information in response to valid requests from the police. Before we authorise any disclosure, the police have to demonstrate that the personal information concerned will assist them in the prevention or detection of a specific crime, or in the apprehension or prosecution of an offender. Each request from the police is dealt with on a strictly case-by-case basis to ensure that any such disclosure is lawful and in accordance with data protection legislation.
You, and any additional user authorised by you, are expected to adhere to the scheme's terms and conditions and code of conduct while using a hire bike. In the event that the police obtain information regarding non-compliance with these terms and conditions, any applicable laws and/or Santander Cycles code of conduct while you (or an additional user) are using a cycle, the police may provide TfL with details about this. Such information may be used by TfL to exclude or suspend you (or an additional user) from using Santander Cycles.
TfL may also receive or disclose personal information about customers in relation to certain emergency situations or other incidents that require an immediate response. Such events may include those involving public health, public safety or national security matters, when access to personal information is necessary to manage the incident. In some situations, we may also be required by law to disclose your personal data to the police or other enforcement, regulatory or Government body, upon a valid request to do so. These requests will be assessed on a case-by-case basis and take into account privacy considerations before a disclosure is made.
TfL and its service providers may process your personal information in the UK and countries within the European Economic Area (EEA). Any such processing will be carried out in strict accordance with UK and EU privacy legislation and the appropriate contractual safeguards which TfL has put in place.
Santander Cycles business accounts
If you use Santander Cycles via a pooled or individual business account provided by your employer (or other business or charity), then you should check the terms of your use with them directly.
We may provide your Business Account Holder (or their nominated representative) with information relating to your usage of Santander Cycles, under that account, including number of hires and average journey times.
If you have an individual business account, we may also share information about the start and expiry date of your membership, eg when you activated your promo code.
Using the Santander Cycles app
If you download and use the Santander Cycles mobile app, certain information may be collected automatically, such as the type of mobile device you are using and unique identifier such as the device name or ID, Internet Protocol (IP) address, Media Access Control (MAC) address, and IMEI number.
We also use analytics (similar to cookies on websites) which are small files that capture anonymous data to help us improve the app's performance. We use them to collect information about your use of the app, such as what app content you access most frequently, or if you receive an error message when using the app.
If you opt in, we will also send you notifications via the app, or use location services to provide you with relevant information about your use of the scheme. You can change your mind at any time by amending the settings within your device.
As of January 2020, TfL will be trialling the use of Global Positioning System (GPS) technology on a number of bikes in the Santander Cycles fleet. The trial will last up to 12 months and GPS enabled bikes will be deployed randomly at docking stations across the cycle hire network.
At the moment we know when a bike has been successfully returned back to a docking station. What we are currently unable to tell, in cases where bikes are not properly returned, is exactly where they are. We rely on reports from customers or them being spotted by our bike distribution teams, so we can locate and retrieve them.
The purpose of this trial is to establish whether GPS technology will help us find those lost and stolen bikes; it is hoped that using GPS to identify the last known location will provide us with the opportunity to retrieve abandoned or stolen bikes. This will avoid the cost of replacing them and ensure that the maximum number of cycles are available for our customers to use when they need them.
Before starting this trial, we undertook a Data Protection Impact Assessment; as a result, GPS data collected within this trial will only be used for the purpose of identifying the last known location of a bike that has not been successfully returned. It will not be used to track individual users or individual journeys made, and will not be combined or matched with any other data held about Cycle Hire members or casual users. There are controls in place to ensure that the GPS data collected is kept separate from all other customer data we hold about users of Santander Cycles.
We understand that there may be scenarios where the data could be useful to the police and other law enforcement bodies. As with current processes for other data held, when we get a request to disclose data, we require the police to demonstrate that the data concerned will help them to prevent or detect crime and/or prosecute offenders.
Alongside information on this page, we are placing stickers on the terminals at our docking stations, as well as on the bikes themselves. We will also be notifying our App users via a push notification and you may see updates on our social media feeds or local press.
At the end of the trial, we will evaluate the findings. Any remaining GPS data will be 'depersonalised' so it can no longer be attributed to an individual bike. If we decide to roll out the wider use of GPS technology across the whole cycle hire fleet, or make secondary use of the data collected, we will undertake further data protection impact assessments, inform our customers and update this privacy page further.
Your information rights
Under data protection legislation you are entitled to ask to see any personal information that we hold about you.
If you are a registered member, you can access and update your personal information via your online account.
For access to other personal information held by TfL please see our page on how to access your data.
If you would like to unsubscribe from service or marketing messages, please use the link we include at the end of every email. You can also update your contact preferences within your online account - or by emailing email@example.com at any time.
If you would like to close your online account please let us know by calling us on 0343 222 6666.
You also have a number of other information rights which include:
- The right to question any information we have about you that you think is wrong or incomplete
- The right to object to how we use your information or to ask us to delete or restrict how we use it
- In some cases, the right to receive a copy of your information in a format that you can easily re-use
- The right to complain to the regulator - the Information Commissioner's Office
The TfL Privacy and Data Protection team considers and coordinates responses to requests and complaints from people whose personal data is processed by TfL and its subsidiary companies.
You can contact the Data Protection Officer by email at firstname.lastname@example.org
Changes to this page
It's likely that we'll need to update this statement from time to time, so check back here regularly to find out more. Your continued use of the site will mean that you accept those revisions. This page was last updated in February 2020.