The Met's processing of personal data obtained from Rivus Fleet Solutions Ltd

Rivus Fleet Solutions Ltd (Rivus) previously delivered fleet servicing, maintenance, repair and inspection services (SMRI). On 21 June 2024, Rivus went into administration.

In order to continue critical vehicle SMRI activity, the Metropolitan Police Service (the Met) acquired that proportion of Rivus which delivered those services specific to maintain frontline police services. This included Rivus's sites, equipment, parts and spares as well as the transfer of key staff under Transfer of Undertakings (Protection of Employment) regulations (TUPE).

As part of the partial business acquisition, the Met also acquired data held within the Rivus systems. This included limited personal data related to service contracts delivered by Rivus to customers other than the Met. Specifically, the personal data comprised business contact information (including names and contact details) for representatives of those customers. We refer to this personal data as third party data.

The Met will be retaining only specific information (and personal data) relevant and pertinent to the SMRI activity of the Met's vehicles from 1 November 2023 to 31 August 2024. All other data (including third party data) will be erased and deleted, in a secure and controlled manner, from the Rivus IT infrastructure estate and that estate closed down. In effect, ceasing to exist with no access to any data or records from that date.

On 31 August 2024, the Rivus IT systems, servers and information (including third party data) will be erased.

Pending the deletion of the third party data, we have set out below some important information for the individuals to whom that data relates:

• The data controller for the third party data is the Commissioner of the Metropolitan Police Service.
• The Met's Data Protection Officer is Darren Curtis. You can email him, or write to him at: c/o MPS Data Office, PO Box 313, Sidcup DA15 0HH.
• The Met has no need to retain the third party data and, as noted above, this data will shortly be erased. The Met is only processing this data for a temporary period in order to determine which data and information it received from Rivus should be retained for the Met's purposes and which data and information should be erased. The Met processes this third party data for its legitimate interests.
• The third party data is stored on a system hosted by Microsoft. It is not shared by the Met with any other organisations. It has not been transferred outside the UK.
• You have certain rights in relation to your personal data comprised within the third party data, including a right of access, a right to correct or supplement inaccurate / incomplete data, a right to request the deletion of data, a right to request the suspension of the processing of the data, a data portability right and a right to object to the Met's processing of the data. These rights may only be available in certain circumstances and are subject to certain exemptions. For more information about your rights, please contact us using the details provided above.

You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner's Office.