Express yourself

This privacy notice applies to personal data submitted in connection with the prize draw. This privacy notice applies to you and to any other person whose image you submit in connection with the prize draw (“Person”). References to “you” and “your” in this privacy notice shall be references to you and (where applicable) each Person.

This privacy notice explains:

• who is the controller of your personal data;
• what personal data we collect about you;
• what we do with your personal data and on what legal basis;
• your rights in respect of your personal data; and
• what to do if you have any questions or complaints about our use of your personal data.

We take your privacy very seriously and are committed to abiding by the Data Protection Laws which protect your privacy.

It is your responsibility to read this privacy notice and to make each Person aware of this privacy notice.

If you provide images of a Person under the age of 18 in connection with the prize draw then by doing so you are agreeing that you are the parent or guardian of that Person, or that you have the appropriate authority to provide such images.

National Express Limited, trading as National Express, is the controller of your personal data.

We may collect the following types of personal data about you in connection with the prize draw:

• your name;
• your image;
• your social media handle; and
• any other personal data that you provide to us when you visit our website or when you communicate with us.

In addition, if you are a winner of the prize draw, we will collect your surname and the name of the county you reside in, when you claim your prize.

In addition, each time you visit our website we may automatically collect the following information:

• technical data, including:
  • IP address;
  • browser type and version;
  • time zone setting and location; and
  • operating system and platform;
• information about your time on the site, including:
  • the full Uniform Resource Locators (URLs) clickstream to, through and from our website (including date and time); and
  • time on page, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page.

We use your personal data for the following purposes and describe below the legal basis on which we process your personal data:

We do not process your personal data on the basis of your consent except in relation to the use of cookies.

Where you have consented to the use of cookies, you may withdraw that consent at any time by changing your cookie settings as explained in our cookie policy.

We have no legal obligation to collect personal data about you, but we need to collect personal data in order to enter you into the prize draw and to administer the prize draw in accordance with the prize draw terms and conditions.

You have no legal obligation to provide us with any personal data. However, if you do not provide the information we need, we may not be able to enter you into the prize draw or award your prize if you are a winner.

We may share your personal data with:

• other National Express Group companies;
• social media companies, including Facebook, Instagram and/or Twitter;
• if you are a winner, members of the public who request winners’ surnames and counties of residence (unless you object in accordance with the prize draw terms and conditions);
• our suppliers, sub-contractors and business partners who supply services to us and/or on our behalf;
• our legal and professional advisors;
• government bodies and regulatory authorities and bodies, including the Advertising Standards Authority;
• the courts and other dispute resolution arbitrators and mediators, other parties to legal proceedings; and
• other companies that take on any part of our business as a result of a restructure, merger or transfer of that part of our business.

Please note that your social media providers will process the images you post to your social media accounts. Such third parties will process your personal data as separate data controllers in their own right and will have published their own respective privacy policies.

We do not accept any responsibility or liability for these notices or policies or the social media providers’ handling of your personal data. Please check the relevant social media providers’ privacy notice before you submit any personal data to their respective websites.

We will process the personal data for as long as the prize draw is open and for so long thereafter as is necessary for us to manage the outcome of the prize draw.

Typically, we will retain information about you if you are a winner of the prize draw for up to 18 months after the close of the prize draw or if you are an unsuccessful prize draw entrant, for up to 6 months after the close of the prize draw.

We may also need to retain information about you for longer where any complaints are made or claims arise in relation to the prize draw, or your participation in the prize draw, or otherwise where we are required by law, regulation or the rules or orders of courts to retain information for longer.

We may also retain your personal data for longer if we cannot delete it for legal, regulatory or technical reasons.

There may be occasions where it is necessary to transfer your personal data to a country outside of the United Kingdom (“UK”). It is possible that the country concerned may not be deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the UK.

Where we transfer your personal data to other National Express Group companies and/or third parties who process your personal data on our behalf in countries outside the UK, we ensure a similar degree of protection is afforded to it by implementing one of the following safeguards:

• we transfer to a country that has been deemed to provide an adequate level of protection for personal data; or
• where the country has not been deemed to provide an adequate level of protection for personal data, we will have entered into contracts approved for use in the UK which give personal data the same protection as it has in the UK.

Please contact the National Express UK Data Protection Officer if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

You have a number of rights under Data Protection Laws in relation to your personal data. These include the right, subject to exceptions, to:

• access your personal data;
• request rectification or erasure of your personal data;
• request restrictions on the processing of your personal data; and
• object to our processing of your personal data.

If you wish to exercise any of these rights please contact the National Express UK Data Protection Officer.

You also have the right in some circumstances to receive a copy of your personal data in a portable format. This right is limited to personal data that you have provided to us and is processed on the basis of your consent or any contract with us. It does not cover personal data that we process on the grounds of legitimate interest.

If you have any questions or complaints about how we process your personal data, or otherwise about the matters set out in this privacy notice, please contact the National Express UK Data Protection Officer at:

• Address: Data Protection Officer, National Express, National Express House, Birmingham Coach Station, Mill Lane, Digbeth, Birmingham B5 6DD

or

• Email address: data.protection@nationalexpress.com

You also have the right to complain at any time to the UK Information Commissioner's Office about how we use your personal data and can contact them on their helpline: 0303 123 1113 or website at https://ico.org.uk/.