Thistle Assistance Privacy Notice
This privacy notice tells you what to expect SEStran to do with your personal information.
- Contact details
- What information we collect, use, and why
- Where we get personal information from
- How long we keep information
- Who we share information with
Contact details
The data that you provide is managed by the South East of Scotland Transport Partnership (SEStran). You can view our full privacy notice here: sestran.gov.uk/corporate/privacy-policy/ and contact us by email at reception@sestran.gov.uk.
What information we collect, use, and why
We collect or use the following information to provide you with a Thistle Assistance card by post:
- Name
- Full address
We collect or use the following information to fulfil our public duty to ensure ongoing equitable access to the scheme and its continued effectiveness:
- Name
- Email address
We collect or use the following information to fulfil our public duty to monitor equalities in service provision:
- Postcode
- Age
- Gender
We also collect or use the following special category information to fulfil our public duty to monitor equalities in service provision. This information is subject to additional protection due to its sensitive nature:
- Racial or ethnic origin
- Health information
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide the Thistle Assistance service and to ensure ongoing equitable access to the scheme and its continued effectiveness are:
- Consent – we have permission from you after we have given you all the relevant information (To be clear, you do have the right to withdraw your consent at any time), and
- Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours.
- Our lawful bases for collecting or using personal information to fulfil the public duty to monitor equalities in service provision are:
- Public task – we have to collect or use your information to carry out a task laid down in law, which the law intends to be performed by an organisation such as ours, and
- The processing is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment.
Where we get personal information from
Directly from you – either through you submitting an application for a Thistle Assistance card or completing a form on our Thistle Assistance app
How long we keep information
To ensure that we only keep the data that we need to fulfil the tasks and duties set out above, and to keep data fully anonymous where we can, we will store the data you provide us in 4 distinct datasets:
Name and address – we will store this information for 28 days after the Thistle Assistance card is posted to you
Name and email address – we will store this information for 3 years to allow us to get in touch to help improve Thistle Assistance and understand how it is used
Postcode – once gathered, this information will be separated from any personal identifiers and stored securely to allow for ongoing analysis
Equality monitoring data (health information, age, gender, race/ethnicity) – once gathered, this information will be separated from any personal identifiers and stored securely to allow for ongoing analysis
For more information on how long we store your personal information or the criteria we use to determine this please contact us using the details provided above.
Who we share information with
Data processors:
Mailer:
- Alliance Print Group – 13 Hill Street, Edinburgh, EH2 3JP
- This data processor does the following activities for us:
- Mails Thistle Assistance cards to those who have requested one
App developer:
- WheelHouse Software Ltd – 5 South Charlotte Street, Edinburgh, EH2 4AN
- This data processor does the following activities for us:
- Manages the Thistle Assistance app, including data provided via the website form, to ensure this is securely recorded and accessible in line with this privacy policy
Posthog
- This data processor does the following activities for us:
- Provides anonymised analytics to help build understanding about who is using the Thistle Assistance card and app.
Microsoft Azure
- This data processor does the following activities for us:
- Provides our hosting platform
Azure Communication Services (ACS)
- This data process does the following activities for us:
- Sends automated emails to people who have requested a Thistle Assistance card, to keep them updated about the progress of their order
Azure Key Vault
- This data process does the following activities for us:
- Provides secure storage of system credentials
Document Version Control
Date Author Version Status Reason for change
September 2025
Michael Melton
Draft Amendment of the section ‘Lawful bases and data protection rights’
October 2025
Michael Melton
1
Draft Amendment of the section ‘Who we share information with’
October 2025
Sarah Junik
2
FINAL
