Privacy policy

This policy describes how the Sustained Travel Framework collects, uses, and retains personal data gathered in the course of an assessment. It applies to the organisation, its named contacts, and anyone whose information appears in the evidence submitted.

We collect organisation information, such as the operator’s legal name, registration details, and registered brands and websites. We collect named contact details for the people an operator designates — for example a primary contact, a sustainability lead, and the person submitting the assessment.

Where relevant to the practices being assessed, we collect employment and payroll records, safeguarding related records, and other operational evidence the operator chooses to submit in support of a question. What is collected depends entirely on which questions apply to the operator and what evidence they provide.

We use this data exclusively to conduct the assessment: to review the evidence, to arrive at a rating, and to maintain the confidential audit trail that shows how a rating was reached. We also use it to respond to legitimate complaints, appeals, and regulatory enquiries raised about a specific assessment.

We do not use this data for marketing, and we do not sell it. Nothing collected during an assessment is passed to a third party for their own commercial purposes.

Once a submission is locked, its record is retained for three years from the date a decision is made on it. At the end of that period, the record is either deleted or irreversibly anonymised, so that it can no longer be linked back to the organisation or the individuals named in it.

The public Quick Assessment collects the name, role, company name and work email address of the person completing it, the activity selections and answers they give, and the indicative summary produced from those answers. No evidence or documents are collected. We use these details to show the indicative summary and to contact the person about a full assessment. The retention period for Quick Assessment records is under review; until it is set, records are kept and are deleted on request.

Access to submitted data is limited to the personnel directly involved in that assessment — the assessor, reviewer, or administrator handling the case. A record of who accessed a submission, and when, is kept alongside it.

Anyone whose personal data appears in an assessment has the right to ask us to confirm what we hold about them, to ask us to correct it where it is inaccurate, and to ask us to delete it — subject to the retention obligations described above, which mean deletion may need to wait until the three-year period has run.

Requests of this kind should be directed to the Data Protection Officer, who is responsible for handling them and for this policy generally.

This document is pending solicitor review. It reflects the Sustained Travel Framework's operative policies as drafted.