IAM RoadSmart Privacy Notice

Who we are

IAM RoadSmart is the trading name of all businesses owned by The Institute of Advanced Motorists Limited. 
The Institute of Advanced Motorists Limited is a registered charity in England & Wales, and separately in Scotland. Formed in 1956, spending more than 60 years making our roads safer by improving driver and rider skills through coaching and education.  
Here at IAM RoadSmart we are committed to protecting your privacy. We comply with the principles of the UK General Data Protection Regulation (UK GDPR) and aim to maintain consistently high levels of best practice in our processing of personal data.
This privacy notice covers IAM RoadSmart in relation to the collection and use of the personal data processed by or on behalf IAM RoadSmart. 
If you have any questions about this notice or concerns relating to your personal data, please contact us using the details provided at the bottom of this notice.
A list of the companies within the IAM RoadSmart Group can be obtained from us at the contact address below.

Personal data we may collect:

• Contact details, such as title, full name, postal address, email address, contact telephone numbers
• Your date of birth, gender and/or age
• Records of your contact and our communication with you such as phone calls and emails
• Information on the products and services, you have purchased from us, also products and Services you have shown an interested in
• Driving licence number
• Vehicle information, such as make and model
• Vehicle telematics and information about your driving behaviour and incident history (including risk assessment information) and driver training history
• Information we obtained from third parties, including information about risk
• Information about your driving licence status, entitlements, and endorsements
• Criminal records information (driving offence codes)
• Medical conditions or your health if you have special requirements
• Financial details about you, such as salary; (for example, for employment)
• Information about your employment status, (for example, for employment)
• Technical information such as your address when you visit our website. we also collect and use your personal data via cookies

How we collect your data

• We'll collect personal data from the following sources:
• From you directly
• From our affiliated local groups
• From our partners who are a part of providing products and services to you on our behalf
• From your employer, for example when instructed to provide products or services to you
• When you visit our website
• The driver and vehicle licensing agency (DVLA) and the driver and vehicle agency in Northern Ireland (DCA)
• Processing a service which you may have been offered by the police or by a magistrates’ court

Our legal basis for processing and using your personal data

IAM RoadSmart and affiliated local groups aim to be very clear when we collect your personal data and will not do anything you wouldn’t reasonably expect to provide the products and/or services that you request, to communicate with you, and to personalise our information we send to you.
We will use your personal data in several ways which reflect the legal basis applying to the processing of your data.

Contract

We will process your personal data because it is necessary for the performance of a contract. which may include some or all the following:
• Providing you with products and services or information you have requested i.e., the purchase of a driving/riding course or membership
• Mailing of membership magazines
• Maintaining and updating your record
• Providing you with products and services or information you have requested
• Sharing your personal data with partners and service providers when you or your employer have requested training or other products or services
• Undertake an online driver risk assessment or driving licence checking services requested by your employer  
• For some of our safety-related driver profiling and risk assessments decision-making products
• All stages and activities relevant to providing safety advice or managing the products or services requested by you or your employer

Legitimate interests

We may process personal data because it is in our legitimate interests to do so, which may include some or all the following:
• To monitor and protect the health and safety of you, other customers, our staff and third parties
• To monitor and protect the security (including network security) of the Company, of you, other customers, our staff, and others
• Contacting you by phone, email, or SMS in relation to services that are relevant to your enquiry
• Providing you with products and services or information you have requested 
• Managing any aspect of the enquiry you have made, the product or service you have purchased or are interested in
• To administer membership services, member benefits and including processing membership fees
• Maintaining and updating your records
• To monitor and to keep records of our communications with you and our staff
• To provide communications to help us to offer you relevant advice, training products and services which we think you may be of interest to you
• To notify you about new or existing IAM RoadSmart services, products, and special offers we think you'll find valuable
• To better understand how people, interact with our websites
• Where the processing enables us to enhance, modify, personalise, or otherwise improve our services / communications for the benefit of our customers
• To develop or improve our advice, products, and services and to review or improve current products and services.
• Quality and monitoring purposes such as your recorded voice calls for the purpose of ensuring that we continually improve the service that we offer and for our staff training requirements
• We may ask for additional information from you to deliver the specific product or service purchased such as information about any medical conditions or your health, if you have special requirements, or if you are a vulnerable customer to assist us in providing a service to you
• Undertaking a driving licence check or other driving compliance check on behalf of your employer
• Undertake an online driver risk assessment on behalf of your employer to identify risks to your safety
• To verify the accuracy of data that we hold about you
• Meeting our legal, contractual, and regulatory obligations and requirements

Consent

IAM RoadSmart may wish to disclose personal data for a secondary purpose (i.e., a purpose not directly related to the primary purpose for which the information was collected). In such cases IAM RoadSmart will seek your consent before doing so.
IAM RoadSmart relies on consent to share your personal data with Cornmarket Insurance Services Ltd, for the purpose of providing you with ‘IAM members-only’ insurance benefits. Cornmarket Insurance Services Ltd are the official insurance provider for IAM RoadSmart. 
Upon Cornmarket Insurance Services Ltd receiving your information to provide a quote, they may contact you via telephone, email, text, or post with details of exclusive ‘IAM members-only’ insurance services they offer. Cornmarket Insurance Services Ltd will become the controller and shall comply with its obligations under the Data Protection Legislation. Your consent will also be used to verify your IAM RoadSmart Membership status with Cornmarket Insurance Services Ltd should they require confirmation.

Legal obligation

We may process personal data because we have a legal obligation under the Rehabilitation Courses (Relevant Drink Offences) Regulations 2012 (as amended 2015), Road Traffic Offenders Act 1988 (under sections 34,34A, 34B, 34BA,34C) and the Road Safety Act 2006 (under section 35). To provide educational services which may be offered to you by the magistrates’ court.
We may also disclose your personal data if we are required to do so under any legal obligation and may use external data for the purposes of fraud prevention and credit risk reduction, or were doing so would not infringe your rights, but is necessary and in the public interest.

How and when can you withdraw your consent?

Where we're relying upon your consent to process personal data, you can withdraw that consent at any time by contacting us as detailed below.

Disclosure of information to third parties

IAM RoadSmart will not share your details to third parties except:

a) Where we have your permission

b) Where we are required to deliver your product or service

c) Where we are required by law and by law enforcement agencies, judicial bodies, government entities, tax authorities or regulatory bodies around the world

Third parties may deliver some of our products to you or provide all or part of the service requested by you. In these instances, whilst the information you provide will be disclosed to them, it will be kept secure, it will only be used for the administration of the service provided and to maintain management information for business analysis. To deliver these products and services, IAM RoadSmart may utilise the following third parties:

3rd Part Services	Information shared and reason to doing so
Insurance Services	IAM RoadSmart may pass your contact details onto Cornmarket Insurance Services Ltd, who are a 3rd party so that they can contact you via telephone, email, text, or post with details of the exclusive ‘IAM members-only’ insurance services they offer
Print & Mailing Services	IAM RoadSmart share your name and contact details to a 3rd party as they print and mail out all our membership renewal packs and reprinted membership cards
Merchandising Services	IAM RoadSmart may pass your name and contact details onto a 3rd party as they fulfil all our branded merchandise and clothing orders that you order from IAM RoadSmart
Print & Mailing Services	IAM RoadSmart may pass your contact details onto a 3rd party who print and mail all our course packs, certificate packs, reprinted membership cards, duplicate certificates, gift vouchers and any other printed materials relating to your IAM membership
Publishing & Mailing Services	IAM RoadSmart may pass on your name and address to these companies so that they can post you the membership magazine three times a year
HMRC	If you have made a Gift Aid declaration, we may disclose the information you provided to HMRC for the purpose of reclaiming Gift Aid on your donation(s)
Affiliated Local Groups, Examiners & Trainers	IAM RoadSmart may share your details with affiliated local groups, examiners and trainers for identification checking purposes and so that they may deliver IAM RoadSmart products and services, such as IAM RoadSmart driving or riding courses
Affiliated Local Groups, Examiners & Trainers	IAM RoadSmart may share your Test / Assessments / IMI Programme results and report with affiliated local groups, examiners, and trainers to managing any aspect of the product or service
Affiliated Local Groups, Examiners, Trainers & 3rd Party	IAM RoadSmart may share your details with affiliated local groups, examiners, trainers, or 3rd parties, to investigate and resolve any complaints you have raised directly with us
Affiliated Local Groups, Examiners, Trainers & 3rd Party	IAM RoadSmart may share your details with affiliated local groups, examiners, trainers, or 3rd parties, to investigate a data breach or where you have exercised one of your legal rights under the UK GDPR
The Institute of the Motor Industry (IMI)	IAM RoadSmart may share your details with The Institute of the Motor Industry (IMI) to administer the IAM’s IMI Accreditation scheme
Research Bodies	IAM RoadSmart may share the information you give us, with approved research bodies in an anonymised and/or pseudonymised format. You will not be personally identifiable from any such data. The research body will perform evaluations of our products or conduct road safety related research on our behalf
Licence Checking and Risk Assessment Providers	IAM RoadSmart may pass your details to providers of services such as licence checking and online driver risk assessments, where this is necessary for the delivery of a driver risk management solutions
DVSA, DVLA or HM Courts	To compile statistical information, to confirm your attendance or non-attendance at the course, provide either a certificate of course completion or notice of non-completion through the Criminal Justice Secure Mail system
Joint Approval Unit of Periodic Training (JAUPT)	Your information may be shared with Joint Approval Unit of Periodic Training (JAUPT) for them to monitor and manage approved DDR providers for quality assurance and compliance reasons
Payment gateway provider	IAM RoadSmart uses a Payment gateway provider to enables us to accept card payments through a secure online payment page. The Payment gateway provider is accredited to the highest possible level of card data security, ensuring all transactions are encrypted to the highest global standards
Other Organisations and Businesses	who provide services to us such as debt recovery agencies, back up and server hosting providers, IT software and maintenance providers

 

If we provide information to a third party (either a provider of a product or service, or an external data processing agency such as a mailing house) we will exercise the strictest control over the third party contractually, requiring it and any of its agents and/or suppliers to:

• Maintain the security and confidentiality of the information and restrict access to those of its own employees
• Use the data for the agreed purpose only and prevent it being used for any other purpose by any other party
• Refrain from communicating with you other than concerning the product in question
• Return the data to us at the conclusion of any contract term and destroy or delete any copies made of all or any part of the information unless copies are needed to be kept complying with regulations
In addition, we will restrict the information disclosed to the absolute minimum necessary, for example, to provide the product or service.

Security

The security of your personal data is essential to us, we have appropriate security policies, physical, technical, and organisational measures in place to help protect your information.
We only store your personal data within the European Economic Area (the “EEA”). The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein. This means that your personal data will be fully protected under the EU GDPR and/or to equivalent standards by law. Transfers of personal data to the EEA from the UK are permitted without additional safeguards.
Your personal data is only accessible by appropriately trained staff, volunteers, and contractors, and stored on secure servers with features enacted to prevent unauthorised access.
If you provide us with credit or debit card details to pay for a product or service, we use a third-party service to process the payment. The service provider is accredited to the highest possible level of card data security, ensuring all transactions are encrypted to the highest global standards.

Marketing

Unless you have told us that you do not want to hear from us, we may send you relevant information (including details of other products or services provided by IAM RoadSmart which we believe may be of interest to you). If you change your mind about how you would like us to contact you or you no longer wish to receive this information, you can tell us at any time by writing to, emailing, or calling us using the contact details below.

How we use cookies

"Cookies" are small pieces of information sent by a web server to a web browser, which enables the server to collect information from the browser.
The common Cookies IAM RoadSmart utilise are as follows:

Cookie Name	Functionality
fr, _fbp, wd, datr	Cookies created by Facebook that allow the tracking of users between Facebook and this website via a Facebook Pixel. Their primary use is to measure the results of Facebook advertising.
.AspNet.Cookies and  ASP.NET_SessionId	To track if a member is logged into the Sitefinity website
SF-TokenId, sfExpPages, OpenIdConnect	Cookies created by Sitefinity to allow the website access to function correctly when logged in.
sf_timezoneoffset	Is a Cookie created by Sitefinity that allows Sitefinity to work to UTC but display the appropriate time for the logged in user
shoppingCartId	Utilised by the current users shopping cart, this is used to allow their cart to persist between visits to the website
_ga, _gat, _gid	Cookies associated with Google Analytics; these cookies allow visibility of statistics of those browsing the site
O2CAllowCookies	Is a cookie created by One2Create and is used on our commercial website to allow the website to store cookie opt in/out settings
sf-tracking-consent, tracking-consent-categories	Cookies created when you opt to allow cookies on the website. This will mean your accepted cookie settings will be retained as you browse the website.

 

You may refuse to accept cookies by activating the setting on your browser which allows you to block cookies. However, if you select this setting you may be unable to access certain parts of our site, including services and on-line shopping. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site or opt accept cookies on our site. Details of how to disable the Cookie function can be found at the help menu on your browser.
You may refuse to accept cookies by activating the setting on your browser which allows you to block cookies. However, if you select this setting you may be unable to access certain parts of our site, including services and on-line shopping. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site. Details of how to disable the Cookie function can be found at the help menu on your browser.

How we use Google Analytics

When someone visits our website, we use a third-party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the volume and profile (age, gender, geographical location etc.) of visitors to the various parts of the site. This information is only processed on a group basis and in a way, which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

How we use Facebook Pixel

When someone visits our website, we use a third-party service, Facebook Pixel, to collect standard internet log information and details of visitor behaviour patterns. This data is used to make sure that Facebook adverts are shown to the right people, to measure the results of Facebook adverts, and to drive more relevant users to the site. We do not use Facebook Pixel to collect the identifying information of individuals.

How we use Hotjar

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behaviour and their devices. This includes a device's IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf. For further details, please see the ‘about Hotjar’ section of Hotjar’s support site.

How we use Wi-Fi

IAM RoadSmart provides our employees and visitors with access to Wi-Fi at our business location. We have several Wi-Fi networks available for use and only the device Mac Address is captured to ensure your device functions correctly while searching for and connected to our networks. IAM RoadSmart does not perform any monitoring of information.

How long do we keep your personal data?

 

We will not keep your personal data for any longer than is necessary for the purpose for which it was first collected, and for legitimate and essential business purposes, such as complying with our legal obligations.

We may retain information after your association with us has come to an end. Some information may be retained indefinitely for historical, statistical or research purposes.

Data records provided to us for provision of Magistrates Court referred training courses. We are legally required to hold this data, and data about your rehabilitation, to fulfil our statutory obligations for up to seven years from the set course completion date.

 

Your rights

 

You have several legal rights to control what IAM RoadSmart can do with your information.  For example:
• The right to be informed about the collection and use of your personal data
• The right to access the information we hold about you
• The right to correct or update information we hold about you
• The right to have the information we hold about you erased
• The right to restrict the processing of your personal data
• The right to data portability, to transfer your personal data to another controller  
• The right to object to the processing of their personal data in certain circumstances
Please note that:
In some cases, exercising these rights may mean that we are no longer able to deliver the products and services you have requested.
Please also note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply.
It is important that your personal data is kept accurate and up to date. If any of the personal data we hold about you changes, please keep us informed.
If you have any cause for complaint about our use of your personal data, you can make a complaint to the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, so please contact us first, using the details below.

Changes to this Privacy Notice

We may change this privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.
Please check this privacy notice for changes whenever you visit our website and each time you consider giving your personal data to us.

Contact us

Please contact us if you have any questions about our privacy notice or information, we hold about you:
• In writing to: The IAM RoadSmart Data Protection Coordinator at IAM RoadSmart, 1 Albany Place, Hyde Way, Welwyn Garden City AL7 3BT
• Via email to: data.protection@iam.org.uk
• Via telephone to: The IAM RoadSmart Data Protection Coordinator at 0300 303 1134

This Policy was last updated on 13/10/2021

IAM RoadSmart is the trading name of all businesses owned by The Institute of Advanced Motorists Limited
The Institute of Advanced Motorists Limited, Reg. in England and Wales. CRN: 562530.
Charity no: 249002 (England and Wales) SCO41201 (Scotland).
IAM Drive & Survive Limited, Reg. in England and Wales. CRN: 2019635.
Professional Driver Services Limited, Reg. in England and Wales. CRN: 4498365.
Registered address for all the businesses listed above is: 1 Albany Place, Hyde Way, Welwyn Garden City, AL7 3BT