Privacy Notice

Applies to: All staff

Responsibility: Managing Director

Approving Body: Board of Trustees

Date reviewed: 10th December 2025

Next review: 10th December 2026

1. Introduction

Mendip Community Transport ("MCT") is committed to protecting the privacy and security of personal data. This Privacy Notice explains how we collect, use, and share personal information about customers and staff, and others, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who We Are

Mendip Community Transport Ltd, MCT House, Unit 10a, Quarry Way Business Park, Waterlip, Shepton Mallet BA4 4RN

Telephone: +44 (0)1749 880613

Email: office@mendipct.co.uk

Data Protection Officer: Managing Director / Kevan Riley kevan.riley@mendipct.co.uk

3. What Information We Collect

We collect personal data directly from individuals and sometimes from third parties. The information we collect may include:


a. Customers

  • Name, date of birth, gender
  • Contact details and address
  • Special educational needs
  • Medical information


b. Staff and Contractors

  • Contact details, employment history
  • Qualifications and training records
  • Payroll, pensions, and tax details
  • Disciplinary and performance information
  • DBS checks and references 

4. Why We Collect and Use Personal Data

We process personal data for the following purposes:


  • To comply with legal and regulatory duties
  • For employment and staff management
  • For MCT marketing and promotional materials (with consent where required) 

5. Legal Basis for Processing

Under UK GDPR, our legal bases for processing include:


  • Compliance with a legal obligation
  • Performance of a contract
  • Vital interests (e.g., in a medical emergency)
  • Legitimate interests (e.g., running the charity effectively)
  • Consent (where required, such as for using photos in marketing)

6. How We Store Personal Data

We take appropriate technical and organisational measures to protect personal data. Information is stored securely in physical and digital formats. We retain data only for as long as necessary, in line with our Data Retention Policy.

7. Sharing of Personal Data

We may share personal data with:


  • Somerset Council
  • Our legal and professional advisors
  • IT and cloud service providers
  • Law enforcement or safeguarding bodies (when legally required)


We do not sell or rent your personal data to third parties. 

8. Your Rights

Under data protection law, you have the right to:


  • Access your personal data
  • Request correction or erasure of your data
  • Object to or restrict processing
  • Withdraw consent (where applicable)
  • Data portability (in some cases)


To exercise your rights, please contact the Data Protection Officer.

9. Complaints

If you have a concern about how we handle your data, please contact us directly. You can also raise a complaint with the Information Commissioner’s Office (ICO): www.ico.org.uk | Tel: 0303 123 1113 11.

Updates to This Privacy Notice

We may update this notice from time to time. The latest version will be published on our website and available upon request.

Contact Us

If you have any questions about this privacy notice or how we handle your personal data, please contact: Managing Director/ Kevan Riley / kevan.riley@mendipct.co.uk