Digitisation

If you currently use paper or simple systems, like Excel, you will capture consent using Link. If you use Clarity, CoOrdinate Sport software, or a bespoke internally developed system, we will develop an API. This means you can continue using these systems and data will be automatically transferred to Link. If you use a bespoke software, we will work with you individually to understand your needs and how to best integrate your system data into Link.

The consent form will ask for the following:

• Rider name
• Date of birth
• School year group (if applicable)
• Gender
• Cycling ability and frequency
• Confirm cycle and helmet check
• Medical information
• SEND information
• Parent(s) contact information
• Alternate emergency contact details (name, telephone, email) if parent(s) unavailable
• Consent to training
• Consent to photography and video
• Consent for training provider marketing
• Consent for Bikeability Trust marketing

You will be able to add optional questions into the form such as if a child needs to borrow a cycle. However, you will not be able to edit the core questions.

When you create a training event, you will be able to choose between school or non-school delivery. Non-school delivery, such as local community groups, will then follow the same consent process as schools. You will be able to add the organisation and contacts and collect parental consent in the same way.

Family and adult training is not part of the digitisation project. You will need to follow your existing consent process for these courses.

Yes! The consent form will include the option for parents and carers to opt in to your marketing. You will then be able to export a list of these email addresses from Link and add to your own mailing list.

You must ask for consent from a parent or carer before a child takes part in Bikeability. This will not change with digitisation. Therefore, you should manage this requirement as you currently do.

The Office of National Statistics states that 99% of adults aged 16 to 44 years in the UK have access to the internet. However, there will be a paper alternative available for the minority who are not able to complete the digital form.

No. It is not a legal requirement to arrange translations of documents or provide an interpreter for other languages, except where that language is Welsh. We expect you to manage this barrier as you currently do.

Yes. You will be able to choose when to send consent forms, and this can be before a training date is set.

Yes, the system is flexible enough to deal with last minute additions of instructors, riders or consents.

Firstly, it’s not technically an app! The instructor “app” is a web-based application, so you won’t need to download it from the app store. It will work with most smartphones, tablets and computers.

The app is designed to collect and send data when there is a mobile signal or WiFi. This doesn’t have to be during training – you can fill in information and this will be uploaded automatically later.

No, the app is extremely simple and therefore will not use lots of data. We do not expect the use of the app to impact your data allowance, and you can always wait until you connect to a WiFi network if you prefer.

From our research, we know that many instructors already use a smartphone to access and collect delivery information. For the minority of instructors who do not have access to a smartphone, a paper based route will be made available to record information required as part of digitisation.

Ultimately this information will need to be added to Link for riders and parents to receive their digital rider report. Therefore, if a phone cannot be used at the time of delivery, a PC or tablet can be used to access the app after the event. Training providers may need to adapt processes to support those instructors that do not have smart phones.

The Bikeability Trust will produce guidance for schools, which explains why instructors will carry a smart phone and that this will not impact the training experience. Mobile phones should already be permitted in case of emergency. Instructors may also choose to record the information on a tablet or computer off-site or in the staff room after training takes place.

No, we are not expecting instructors to use their mobile phones during delivery. We expect instructors to balance their instructing with recording information, as you do currently with recording rider outcomes and completing the certificates. We recommend instructors complete the required information at appropriate points during and after the course.

Children will still receive a physical certificate and badge.
Our certificates will be redesigned to be more engaging and fun.
Our badges will keep the same design, but we have improved the quality.
We will no longer provide handbooks. All information will be available via email and online instead.

Our research, and that of national bodies like Ofcom, shows that parents now engage with their children’s education by digital means.
A direct survey to parents showed that 57% read the handbook, but only 5% looked at it “in detail.”
An email campaign featuring the same content was opened by 95% of parents. 60% of them completed activities recommended in the emails.

No, riders will still receive a physical badge (or sticker for Balance and Learn to Ride courses).

Yes! As part of this project, we have secured a new supplier. Badges are higher quality and more environmentally friendly.

No, riders will still receive a physical certificate. However, these have been redesigned to be more fun and engaging, and the outcomes will be removed from the back of the certificate and communicated digitally.

We have also removed the requirement to add a date and instructor name, as these will be communicated in the digital rider report. Instructors will only need to handwrite the child’s name.

Certificates will be rolled out alongside digitisation. Therefore, you will be able to purchase new certificates as soon as you start using digitsation.

New award materials will be phased into use. We will not ask you to throw out or destroy current stock.

You will complete feedback on the instructor app. You will be able to select multiple riders at once and, using your professional judgement, assign them a rating (independently, with practice, with assistance or not attempted) against the relevant National Standard assessment criteria (i.e. identify and respond to hazards) with one click.

You can also add personal, individual feedback via a free text box on the app.

You will be able to download and print the rider report from Link for this minority.

Yes, you can also add personal, individual feedback via a free text box on the app. This can be sent to parents/carers immediately, so you may wish to use this function to communicate information such as feedback if a rider cannot progress to Level 2 on a Level 1 and 2 combined course.

There is a separate section to feedback information about cycles or kit. This will be communicated immediately to the parent or carer.

Yes, you can modify child feedback until the course is marked as complete.

We need evidence to prove to Active Travel England that cycle training makes an impact. A parent and carer survey will allow us to better understand the impact of Bikeability cycle training on a rider’s cycling habits. A hands up survey is used by many training providers and other behaviour change programmes to provide evidence of impact. Child feedback is a fantastic way to demonstrate the importance of Bikeability.

The survey has been devised by the Transport Research Laboratory’s monitoring and evaluation team and Sheffield Hallam University. It has been piloted by industry and approved by Active Travel England. Questions will not be changed.

Yes, you will be able to access automated downloads from Link. These downloads will be generated once a month to avoid server overload. Data will be collated and anonymised.

No, these surveys are not intended to gather information about individual instructors. All responses will be combined and anonymised to provide a national picture from riders and parents. This will give us better evidence to demonstrate our value to Active Travel England and secure future funding.

A full Data Protection Impact Assessment (DPIA) has been completed, with expert input from Hope and May and approved by Active Travel England.

All data will be encrypted and only training providers, instructors and schools/organisations associated with that training delivery will have access to the data pre-course. Once the course is complete, instructors will no longer have access to the information. GDPR statements included on the consent form detail how data will be used, and specific consent will be obtained for photography and further communication from The Bikeability Trust and training provider.

In addition to our DPIA, we have created and maintained a policy framework which governs our compliance with UK data protection law.

Our DPIA can be made available upon request by email to: contactus@bikeability.org.uk

1. Active Travel England has a signed agreement with The Bikeability Trust
2. A grant recipient can also be a training provider or have an agreement with an independent training provider
3. The training provider employs or contracts instructors, who must be registered with The Bikeability Trust
4. The training provider will book a training event with the school using Link to process associated data.
5. The school will request consent from the parent to train their child. The Bikeability Trust is a data processor.
6. The school, training provider and instructors will check/view consent information prior to commencement of training. Training providers can control when associated instructors are able to view consent data by adding the instructor names to the event closer to the event date. The Bikeability Trust is a data processor.
7. The school can provide anonymous rider characteristic data via school information system uploads which will be aggregated and available in Link for training providers to view. Alternatively, schools can share rider characteristic data with associated instructors on the event day who can record this via the instructor app, or characteristic data can be collected via the consent process and aggregated within Link. The Bikeability Trust is a data processor.
8. The instructor, on behalf of the training provider, will record training outcomes, responses to rider hands up survey* and provide qualitative feedback for each child and parent. The Bikeability Trust is a data processor.
9. The parent and child will be able to access the rider report on the Bikeability Club site and may provide anonymous feedback regarding training via a parent/carer survey*. The Bikeability Trust is a data processor.
10. The parent may choose to receive details of other promotions and offers direct from The Bikeability Trust by enrolling in the Bikeability Club. The Bikeability Trust is a data processor.
11. The training provider will be able to report to grant recipients with aggregated training delivery data.
12. The grant recipient will make a grant claim with The Bikeability Trust.
13. The Bikeability Trust will report aggregated claims data, rider characteristic data, rider outcome data and monitoring and evaluation data to Active Travel England.

*Rider hands up and parent/carer surveys are not intended to gather information about individual instructors. All responses will be combined to provide a national picture from riders and parents. This will give us better evidence to demonstrate our value to Active Travel England and secure future funding.

Note: Whilst we refer to schools as a part of the data flow, there may also be other organised settings where training takes places for which the processes will be the same.

The law specifically defines different parties and the role they play when personal data is gathered and processed for any given purpose. Broadly, there are two roles and a party (any organisation including a sole trader or partnership) must understand which it is before any personal data is processed.

A data controller is a party that determines why data is processed, what data may be gathered, the purpose for the processing activity, how long it may be retained and who it may be shared with. A controller of data must be registered with the Information Commissioner’s Office (ICO), have a policy and be responsible for all personal data it may use to achieve any given purpose it has identified.

A data processor is a party that processes data but only because it has been instructed to do so by another organisation acting as a data controller. It may only process the data in accordance with the instructions it has received. Typically, these instructions will be in an agreement. It does not need a data protection policy to guide it as the instruction provides the guidance. It may also be a data controller but for a different purpose. For example, The Bikeability Trust is a data controller for most of its activities, but for the purposes of providing access to the app, it is a data processor providing services to the training providers and instructors which include secure access to the personal data of children.

Further information about data sharing agreements and the roles of controllers and processors can be found on the ICO website.

The Bikeability Trust take data protection very seriously because we regularly process sensitive data and data that identifies children. The laws in the UK specify precisely how this should be undertaken. Whether you are a school, grant recipient, training provider or instructor, you are also bound by these laws, so it is important to understand your obligations. The following information is available so that you are informed and will help to ensure you handle personal data lawfully and ethnically.

When access to the app is permitted, the user will be the data controller of the personal data in accordance with the definition of the UK GDPR. This includes existing personal data already residing on the app as well as any personal data uploaded by the user to the app. The Bikeability Trust will provide access to the app and as such will be the data processor in accordance with the definition of the UK GDPR. UK data protection law requires the clauses in article 28 of the UK GDPR to be upheld.

Bikeability may process the data uploaded to the app in accordance with the terms of access. This will include the lawful basis decided upon by the controller. The processing activity will rely upon the consent of the individual. In other circumstances such as safeguarding and unless otherwise specified, the lawful basis for a local authority including a school may be UK GDPR article 6(e), in the public interest. For an organisation other than a local authority, the lawful condition may be UK GDPR article 6(f). In both circumstances a UK law may need to be identified. Those laws may be found in the data protection act 2018, schedules 1 and 2.

Each party acts as a data controller in accordance with the UK GDPR definition Art. 4(7) except where The Bikeability Trust may act as a data processor where other parties may access the electronic systems provided for by The Bikeability Trust via the instructor app or Link database. In such circumstances there will be a data processor agreement in force. This approach reduces the risk for each party and ensures the responsibility for processing activities lies with each respective party. Where each party is a controller they may process the data in accordance with their policy, the parties may also share such data with other controllers where it has established a clear purpose as defined in the flow diagram.

Each party must establish a lawful basis for processing the data. Such bases may be different depending upon the purpose that has been identified. There must also be a lawful basis to share the data with another party to the agreement. To this end, a data sharing agreement may be in force between the school and the training provider and The Bikeability Trust. Where The Bikeability Trust acts as a processor the UK GDPR Article 28 processor clauses will be included in the contractual agreement.

The Bikeability Trust has provided a Controller to Processor Agreement template which training providers can download, complete and upload to save to their Link profile. You can also use your own organisations agreement if preferred.

You will find screenshot guidance on how to upload the agreement to Link here. It is the responsibility of the training provider to ensure data sharing agreements are in place and saved to their profile.

Further information about data sharing agreements and the roles of controllers and processors can be found on the ICO website.

• Data sharing agreements
• What are ‘controllers’ and ‘processors’?

We have also provided a Controller-to-Controller data sharing agreement template which can be used to set up data sharing agreements with schools, or you can use your own organisations own agreements. The Trust do not require a copy of this to be saved to your Link profile, as this is purely for your own records.

Server security

All personal data relating to parents and children will be stored on a UK hosted server. All servers, holding Bikeability applications and sensitive data, are housed in secure datacentres within locked cages in monitored environments. No data will be transferred out of the country.

Link security

User access to Link is restricted by username and password and further restricted in terms of user role access. The data is further protected through use of Two Factor Authentication.

The data will be encrypted and can only be accessed using an authorised API so that any access to this data will not be accessible via the Internet, unauthorised apps, or other internal server infrastructure.

All electronic communication via the API and application will be using encrypted SSL (minimum 256-bit). Administrators, schools, and instructors that have access to view / update this data via the API will be restricted to using two factor authentication.

Instructor app

Two factor authentication will be required to access the instructor web app, and this will require renewing at two weekly intervals.  The instructor web app will also be secured with a PIN number. Instructors are also expected to protect their own device with additional security such as PIN or biometric security measures or where devices are provided by the training provider, to adhere to organisational device security policies. 

The instructor web app will be used to facilitate access to consent data and to record rider outcomes. This data will be encrypted for data transfer and will not be accessible to instructors once the training is complete. Data may be cached on personal devices in an encrypted file.  

Data will be shared between the school (or host organisation), training provider/grant recipient and The Bikeability Trust. Aggregated data will be shared with Active Travel England. Parental data will be shared with third parties where permission has been expressly given by the parent on the rider consent form.

Only the name of the instructor will be visible to parents when they receive the digital report at the end of the course as they currently do on certificates.

As an instructor you have agreed to provide practical cycling instruction services to students at various schools. When you are appointed by the training provider, you enter into a contractual agreement with them. UK data protection law allows for your personal data to therefore be used for this purpose. This would include sharing your contact details and other information with any relevant party which may include, the school (or host organisation), the training provider, other associated instructors and The Bikeability Trust. They will only share the personal data you provide to them. Instructor’s personal data may be shared with any third party where it is deemed necessary for the provision of the Bikeability programme. By providing your personal data as an instructor you acknowledge your acceptance. For further details about our privacy statement, please visit our webpage.

The regulator responsible for information rights in the UK is the Information Commissioner’s Office (ICO) provides guidance concerning the lawful basis for processing data.

The Instructor app is encrypted whilst stored on your device however we also ask instructors to agree to some basic terms and conditions to help keep that data secure.  These are outlined in our privacy statement.

Our code of practice is also guide to the standards required for the conduct and integrity of Bikeability instructors who are working for registered Bikeability training providers. The Bikeability Trust recognises many training providers have their own code of practice in place. Those training providers who do not have a code of practice in place for their instructors or wish to review or refresh their code of practice can use The Bikeability Trust model guidance document.

Instructors employed by training providers should adhere to the organisation’s own data protection policies. Self-employed instructors are responsible for handling data appropriately and in accordance with UK data protection law. The ICO provides a self-assessment checklist for sole traders.

With regards to device use and ownership, it is the training provider’s responsibility to reach an agreement with instructors and not a matter for the Trust.  

Organisational policies regarding data security would be in force for those training providers who provide devices to instructors. 

Training providers who require instructors to use their own personal device for delivering Bikeability should have a Bring Your Own Device policy (BYOD). A BYOD ensures organisations have appropriate security in place to prevent personal data being held on a personal device being accidently or deliberately compromised. This is relevant if personal data is being processed on devices which the organisation may not have direct control over.  Further guidance can be found on the ICO website. 

The app is extremely simple and therefore will not use lots of data. We do not expect the use of the app to significantly impact your data allowance, and you can always wait until you connect to a WiFi network if you prefer.  After a course is marked complete via the app, data will be transmitted from app as a small, encrypted text file and removed.  

The law requires those organisations that are responsible for processing personal data (data controllers) to have their own policy and to abide by their obligations to UK data protection law.  The ICO website provides information and guidance for organisations.

A data breach is classified as a breach of security that causes the accidental or unlawful destruction, loss, modification, unauthorised access, or unauthorised disclosure of personal data that is being held, transmitted, or processed. 

Data Controllers must notify the ICO within 72 hours of becoming aware of the breach.  

Data Processors must notify the Data Controller as soon as they become aware of the breach, but they have no other notification or reporting obligation under GDPR. 

Further information can be found on our website and on the ICO website.

Aggregated data held by the Bikeability Trust on behalf of Active Travel England will be deleted after 6 years. 

Anonymous rider characteristic data will be stored directly into The Bikeability Trust Link database and will be deleted after 6 years. 

We will only retain your personal information for as long as we need it unless we are required to keep it for longer to comply with our legal, accounting, or regulatory requirements.   

In some circumstances we may carefully anonymise your personal data so that it can no longer be associated with you, and we may use this anonymised information indefinitely without notifying you. We use this anonymised information to analyse our programmes and support other similar programmes around the world. 

Personally identifiable data regarding consent and rider outcomes will be retained for 2 years.  

Schools will be able to add a class list export from the school information systems and upload to Link (optional). Information shared will include the child’s name, year group and rider characteristics such as SEND, pupil premium, ethnicity, gender, and date of birth. Information relating to medical information will not be uploaded from the export but will be requested from parents via the consent form.  Teachers can also add notes for instructors about a child where this has not been provided by parents directly via the consent process.

Further guidance is available on the government website.