Business Contacts

This privacy notice applies to you if you are an individual who works for a third party organisation which has or has had a business relationship or business dealings with any of the National Express group companies which are established in any part of the United Kingdom.

This privacy notice explains what personal data we collect about you and what we do with it. It also explains your rights in respect of your personal data and it informs you what to do if you have any questions or complaints about our use of your personal data.

The controller(s) of your personal data is/are each of the National Express group companies you deal with or dealt with when you act or acted on behalf of the organisation that has entered into a contract with or otherwise has or had a business relationship with them.

This will be that one or more of the following named National Express group companies, according to the relevant contract or business relationship:

National Express Group PLC
National Express Limited
West Midlands Travel Limited
The Kings Ferry Limited
E. Clarke & Son (Coaches) Limited
Tayside Public Transport Company Limited
National Express UK Limited
National Express International Limited
Stewarts Coaches Limited

The data controller’s or controllers’ representative for the purposes of this privacy notice is the National Express UK Data Protection Officer, who can be contacted using the contact details set out at the end of this notice.

We collect certain information about you, as follows:

• your name and your role or position in your organisation;
• your professional qualifications and/or your work experience;
• your membership of professional societies and/or trade organisations or associations, and any personal identifiers which denote your membership of the same;
• your contact details at your organisation, including any work email address and telephone numbers;
• if you provide us with a business card, any other personal data contained on that business card;
• your image, where this is captured by CCTV or other visual recording equipment on our owned or managed premises and/or on our passenger carrying vehicles; and
• your voice, where this is captured by CCTV or any other audio recording equipment, including where captured in the form of recorded telephone conversations with us.

We collect this information in a variety of ways, including:

• by you, or your organisation, providing it to us, either voluntarily or at our request;
• from your work colleagues and managers at your organisation who who may provide us with information about you and your qualifications, experience and aptitudes;
• from third parties who may provide us with information about you and their experiences of you and your organisation;
• from our customers and/or other business partners who come into contact with you during the course of our business dealings with you; and
• by making visual and audio recordings at our owned or managed premises, including at our offices, coach stations and bus depots, and on our passenger carrying vehicles, and by making recordings of certain of our telephone, video and online communications and conferences.

We process personal data about you for the following purposes:

• Managing our business relationship with the organisation that you represent: including communicating with your organisation and negotiating, concluding and performing business transactions with your organisation, such as procuring products and/or services from your organisation, selling products and/or services to your organisation, partnering with your organisation or appointing your organisation as our agent or your organisation appointing us their agent.
• Managing our own business arrangements: including to assess and report on the effectiveness of our business relationship with your organisation.
• Legal and regulatory compliance: to ensure compliance with applicable laws and regulations to which we are subject, including those which require us to keep records of business transactions with your organisation.
• Contractual compliance: to ensure compliance with contractual obligations which we have assumed to your organisation, including those which require us to notify your organisation of matters.
• Evidential purposes: including for the purpose of conducting any audit or investigation into our business dealings with your organisation, responding to any regulatory investigations commenced (or likely to be commenced) into a National Express group company in relation to such business dealings or managing any legal claims brought (or likely to be brought) by or against a National Express group company in relation to such business dealings.

Save where we process your personal data to to comply with a legal duty, we process your personal data on the basis of our legitimate interests. Our legitimate interests are to achieve all those purposes above that do not relate to complying with a legal duty.

Where we process your personal data only on the basis of our legitimate interest, you have the right to object to our use of your personal data. However, we do not have to stop processing personal data where we have compelling grounds that override your interests, or where we need to process your data in order to establish, exercise or defend legal claims. If you have any objections please contact the National Express UK Data Protection Officer (see details below).

Where we process your personal data because we have a legal obligation to do so, there is no right to object.

As previously noted, we process your personal data to comply with our legal obligations and on the basis of our legitimate interests.

If we obtain your consent for any use of your personal data (which is likely to be for a purpose that is not described in this privacy notice), you may withdraw that consent at any time and we will give you further information in any consent form by which we obtain your consent on how to withdraw your consent.

We are not obliged to collect personal data about you but, where we do so, we may be obliged to retain that data, for example where it appears in certain of our business records.

You are not obliged to provide us with your personal data but, if you do not do so, we may not be able to manage our business relationship with your organisation through you.

We will share your personal data with third parties where we are legally obliged to do so, for example to government bodies and regulatory authorities and to the courts and parties to legal proceedings pursuant to court rules and orders.

We may share your personal data with other companies in the National Express group, for example where another National Express group company also has, or may have, business dealings with your organisation or where products and services we may buy from your organisation may be of interest to them or the products and services that they sell may be of interest to your organisation.

We may also share your personal data with third parties who provide services to us or other National Express group companies, for example professional advisors and other third parties who are used by us to perform processing activities, such as network hosting or software management services and payment services.

We may also need to share information about you with other companies that take on or intend to take on any part of our business as a result of a restructure, merger or transfer of that part of our business.

These other National Express Group companies and/or third parties who process your personal data on our behalf may do so in countries outside the European Economic Area (EEA) that are not deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the EEA. Where this is the case we have entered into appropriate contracts with such National Express Group companies and third parties based on the standard contractual clauses approved by the European Commission, a copy of which can be found here, such that your personal data should be afforded the same level of protection as when it is processed in the EEA.

We will process your personal data for as long as your organisation is, or is likely to be, in a business relationship with us, which will depend entirely on the nature and length of that business relationship, and for so long after the cessation of that business relationship as is necessary to deal with any outstanding business or legal matters, which will also depend entirely on what those outstanding matters are and whether any legal issues arise.

We may also retain your personal data where it is comprised in documents which evidence our business dealings with your organisation, such as in emails sent to or from you when acting on behalf of your organisation or where your name or other information about you appears in business records or reports, for as long as we need to keep that evidence for our business purposes, which is likely to be at least six (6) years from creation of that evidence or longer where there are legal requirements to hold such evidence or where any regulatory investigations or legal claims arise or could arise.

You have a number of rights in relation to your personal data. These include the right, subject to exceptions, to:

• access your personal data;
• request the rectification or erasure of your personal data;
• request restrictions on the processing of your personal data; and
• object to our processing of your personal data.

Please contact the National Express UK Data Protection Officer if you wish to exercise any of these rights.

You also have the right in some circumstances to receive a copy of your personal data in a portable format. This right is limited to personal data that you have provided to us and is processed on the basis of your consent. It does not cover personal data that we process on other grounds.

Please contact the National Express UK Data Protection Officer to request a portable copy of the data that you have provided and is processed on this basis.

If you have any questions or complaints about how we process your personal data, you should contact the National Express UK Data Protection Officer at: data.protection@nationalexpress.com.

You also have the right to complain to the UK Information Commissioner's Office about how we process your personal data. You can do this by contacting them on their helpline: 0303 123 1113.