Persons Involved in Incidents

This privacy notice applies to you if you are or were involved in an incident, whether as a passenger, pedestrian or other road user, that occurs on or in relation to any of our passenger transport services, and also if you were a witness to such an incident.

This privacy notice explains what personal data we collect about you and what we do with it. It also explains your rights in respect of that personal data and it informs you what to do if you have any questions or complaints about our use of your personal data.

If you are or were a passenger on one of our bus or coach services, you should also refer to our customer and passenger privacy notice on our website for information about what personal data we collect about you and what we do with it in your capacity as a customer and passenger. This privacy notice supplements that privacy notice for such passengers where such passengers are or were involved in an incident.

For clarity, we may not be the operator of certain of our coach and bus services as we may sub-contract the performance of some such services. Where this is the case, our sub-contractors may also collect personal data about you and be data controllers in respect of that personal data. Where that is the case, their privacy notices will apply regarding their collection and use of such data.

National Express Bus & Coach Services Limited is the controller of your personal data.

Our representative for the purposes of this privacy notice is the National Express Data Protection Officer, who can be contacted using the contact details set out at the end of this notice.

We may collect the following personal data about you in connection with an incident:

• your name,
• your contact details, including your home address, your email address and your home and/or personal mobile telephone numbers;
• your image and/or your voice where where they are captured by CCTV or other visual/audio recording equipment installed on our passenger carrying vehicles; and
• any other information you provide to us in connection the incident.

We collect this personal data in the following ways:

• by you providing to us, either directly to our staff or other representatives who were present at or attended the incident or who work in the customer contact centre;
• by our sub-contractors, who operated the bus or coach service involved in, or affected by, the incident, reporting it to us;
• by other persons who were involved in, or affected by, the incident reporting it to us;
• by the law enforcement authority or emergency services who responded to the incident reporting it to us;
• by us making visual or audio recordings on our passenger carrying vehicles; and
• by us recording telephone conversations to our customer contact centre.

We use your personal data to respond to, investigate, manage, keep records of and report incidents that occur on or affect our passenger transport services and to deal with any regulatory investigations and/or legal claims that arise in connection with such incidents.

We process your personal data for the following purposes:

Business necessity: to respond to, investigate, manage, keep records of and report on incidents that occur on or affect our passenger transport services.
Legal and regulatory compliance: to ensure compliance with applicable laws and regulations to which we are subject, including those which require us to report incidents.
Health & safety and security purposes: to seek to ensure the health and safety and security of our customers/passengers, other road users and other members of the public.
Evidential purposes: to facilitate the conduct of any investigation into incidents, whether by us or any law enforcement or regulatory authorities and/or to enable the conduct of any legal claims by or against us in relation to incidents.
Legal purposes: to enforce and defend our legal rights.
We may process your personal data because we have a legal obligation to do so, for example under road transport and licensing laws, under health & safety laws or pursuant to court rules and orders. Where we process your personal data because we have a legal obligation to do so, there is no right to object to that processing.

In all other cases, we process your personal data on the basis of our legitimate interest. Where we process your personal data on the basis of our legitimate interest, you have the right to object to our use of your personal data. However, we do not have to stop processing personal data where we have compelling grounds that override your interests, or where we need to process your data in order to establish, exercise or defend legal claims. If you have any objections please contact the National Express Data Protection Officer (see details below).

If we process your personal data on the basis that we have obtained your consent to do so (which is likely to be for a purpose that is not described in this privacy notice) you may withdraw that consent at any time and we will give you further information at the time of obtaining your consent on how to withdraw consent.

If you are directly involved as a driver or other road user in the incident, we may be under an obligation to collect information from you in relation to the incident. You would have a corresponding legal obligation to provide information to us.

Otherwise, we have no obligation to collect, and you have no obligation to provide, your personal data but, if you do not provide us with certain personal data, we may not be able to respond to or investigate an incident and/or communicate with you about it.

We may share your personal data with:

• other companies in the National Express group of companies;
• our sub-contractors where they operated the relevant bus or coach service on or in relation to which the incident occurred or who are otherwise affected by the incident;
• our suppliers and contractors who help us respond to, investigate and mange incidents;
• our legal and professional advisors;
• our claims handlers, insurance brokers and insurers;
• government bodies and regulatory authorities, including law enforcement agencies and the emergency services;
• the courts and parties to legal proceedings before the courts; and
• other companies that take on any part of our business as a result of a restructure, merger or transfer of that part of our business.

There may be occasions where it is necessary for us to transfer your personal data to a country outside of the European Economic Area (“EEA”), including where our suppliers or subcontractors who process your personal data on our behalf are based in such a country. It is possible that the country concerned may not be deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the EEA. Where that is the case, we have entered into appropriate contracts with such data processors, based on the standard contractual clauses approved by the European Commission, a copy of which can be found here, such that your personal data should be afforded the same level of protection as when it is processed in the EEA.

We will process your personal data for as long as necessary to respond to, manage and investigate the incident. We will also retain your personal data for at least six (6) years from the date of the incident, or if later, the date on which all regulatory investigations and legal claims or potential legal claims relating to the incident have been fully and finally concluded, having regard to the nature of any potential claims and the limitation of liability periods that apply to them.

We may retain your personal data for longer if we cannot destroy it for legal or regulatory reasons.

You have a number of rights in relation to your personal data. These include the right, subject to exceptions, to:

• access your personal data;
• request the rectification or erasure of your personal data;
• request restrictions on the processing of your personal data; and
• object to our processing of your personal data.

Please contact the National Express Data Protection Officer if you wish to exercise any of these rights. In the case of incidents, we reserve the right to continue to use your personal data on the grounds of compelling legitimate grounds for this.

You also have the right in some circumstances to receive a copy of your personal data in a portable format. This right is limited to personal data that you have provided to us and is processed on the basis of your consent or any contract with us. It does not cover personal data that we process on the grounds of our legal duty or our legitimate interest and so, as these are the bases on which we will process your personal data we collect for the purposes of this privacy notice, this right will not apply.

If you have any questions or complaints about how we process your personal data, you should contact the National Express UK Data Protection Officer at:

• address: Data Protection Officer, National Express, National Express House, Birmingham Coach Station, Mill Lane, Digbeth, Birmingham B5 6DD
• email address: data.protection@nationalexpress.com.

You may also contact our customer contact centre by telephone on 01 903 9508 to report any incidents and the contact centre should be able to refer any questions you have regarding our use of your personal data in connection with incidents to the National Express Data Protection Officer.

You also have the right to complain about our use of your personal data to the Irish Data Protection Commission. You can do this by contacting them on their helpline: +353 761 104 800 or website at www.dataprotection.ie.