Visitors to Sites

This privacy notice applies to you if you are a visitor to any site in the UK that is exclusively occupied or otherwise managed by a National Express group company, such as its corporate offices, its owned or managed coach stations, its owned or managed bus depots, its managed coach or bus stations or interchanges at airports and its travel shops. 

This privacy notice explains:

• what personal data we collect about you;
• what we do with your personal data;
• your rights in respect of your personal data; and
• what to do if you have any questions or complaints about our use of your personal data.

We take your privacy very seriously and are committed to abiding by the Data Protection Laws which protect your privacy.

This privacy notice may change from time to time and the most up-to-date version will always be available on our website or at the reception desk/main building entrance of the site you are visiting. It is your responsibility to read this privacy notice and check our website for the current version.

For clarity, visitors to our managed coach and bus stations who then become passengers on our coach or bus services and visitors to our travel shops who purchase tickets for travel on our bus or coach services should also refer to our customer and passenger privacy notice for information about what we do with those persons’ personal data in those capacities.

For the purposes of this privacy notice, we shall mean the relevant National Express Group plc company established in the United Kingdom that occupies or manages the site that you are visiting is the controller of your personal data:

You can ask at the reception area, information desk or sales desk at the relevant site you visit which National Express group company is the data controller for that site.

The data controller’s representative for the purposes of this privacy notice is the National Express UK Data Protection Officer, who can be contacted using the contact details set out at the end of this notice.

We collect information about you that we need from you as a visitor to our sites, which may include:

• your name and title;
• the organisation you work for and your position or role in that organisation;
• if you drive to our site and we provide parking at the site, your vehicle registration number;
• if you have an accident or there is an incident while visiting our site, details about that accident or incident and its impact on you; and
• your image and/or your voice, where where they are captured by CCTV or other visual/audio recording equipment used at our sites.

Please note that CCTV and other audio/visual recordings could also capture certain other personal data about you, such as your racial or ethnic origin, health information and the commission of criminal offences.

We collect this information in the following ways: 

• by you providing information to us during your visit to our site;
• by us making observations about you during your visit to our site; and
• by us making visual and audio recordings at our owned or occupied sites.

 You should note that we currently use CCTV at all of our exclusively occupied or managed sites.

We will record visitor information, such as names, organisation/role and any vehicle registration number, in the visitor log books that we maintain at our sites.

If you have an accident or health incident at one of our sites, we will also collect details about that accident or incident in an accident book.

If you are a regular visitor to one of our bus depots, you will also be issued with a ‘Health & Safety Site Passport’ in which you can record your name and organisation/role, as well as details of your line manager at your organisation and your next of kin and their respective contact details. You will retain this booklet with you while on site and take it with you when you leave, but if there is an accident or emergency while you are on site, we may need to access and use this booklet and the information contained therein to manage the accident or incident and inform your relevant contacts about it.

We process your personal data for the following purposes: 

• Business necessity: to keep records of visitors attending our sites. 

• Due diligence: to check the identity and credentials of visitors to our sites. 

• Legal and regulatory compliance: to ensure compliance with appplicable laws and regulations to which we are subject, including those which require us to ensure health & safety at work by keeping records of and responding to accidents or incidents at work. 

• Preservation and promotion of health and safety and security: to seek to ensure the health & safety and the security of our visitors, staff, contractors, customers/passengers and other members of the public. 

• Prevention and detection of crime (including trespass and criminal damage), anti-social behaviour and other wrongdoings: to facilitate the prevention, detection and reporting of crime and anti-social behaviour by or which affects our visitors, staff, contractors, customers/passengers and other members of the public. 

• Evidential purposes: to facilitate the conduct of any investigation into any matter relating to or occuring on our sites or otherwise relating to our visitors, staff, contractors and customers/passengers, whether by us or any law enforcement or regulatory authorities, and/or to enable the conduct of any legal claim by or against us in relation to any matter concerning or occuring on our sites or otherwise relating to our visitors, staff, contractors and customers/passengers. 

• Legal protection purposes: to enforce and defend our legal rights.

Where we have a legal duty to ensure health & safety at our sites, we process your personal data captured by CCTV or other visual/audio recording equipment and/or recorded in relation to accidents or incidents at our sites in order to fulfil that duty. We otherwise process your personal data on the basis of our legitimate interests, which are to achieve all those other purposes specified above. 

You have the right to object to our use of your personal data where we do this only on the basis of our legitimate interest.  However, we do not have to stop processing personal data where we have compelling grounds that override your interests, or where we need to process your data in order to establish, exercise or defend legal claims.  If you have any objections please contact the National Express UK Data Protection Officer (details below). Where we use your personal data because we have a legal duty to do so, there is no right to object.

If we process your personal data on the basis that we have obtained your consent to do so (which is likely to be for a purpose that is not described in this privacy notice) you may withdraw that consent at any time and we will give you further information at the time of obtaining your consent on how to withdraw consent.

We may have a legal duty to process your personal data, for example to seek to ensure your health and safety, and the health and safety of others, at our sites.

You have no obligation to provide us with any personal data. However, we ask you for your personal data as a condition of visiting our sites. If you do not provide us with the information needed we may refuse you entry to our sites.

We may share your personal data with: 

• other companies in the National Express group of companies, including those you are intending to visit and those who manage our CCTV recordings;
• our suppliers and sub-contractors who help us manage our sites or manage our CCTV recordings;
• our legal and professional advisors, if necessary;
• government bodies and regulatory authorities, including the Police and other crime prevention and detection agencies and the UK Information Commissioner’s Office;
• the courts and parties to legal proceedings before the courts; and
• other companies that take on any part of our business as a result of a restructure, merger or transfer of that part of our business.

There may be occasions where it is necessary for us to transfer your personal data to a country outside of the European Economic Area (“EEA”), including where our suppliers or subcontractors who process your personal data on our behalf are based in such a country.  It is possible that the country concerned may not be deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the EEA. Where that is the case, we have entered into appropriate contracts with such data processors, based on the standard contractual clauses approved by the European Commission, a copy of which can be found here: http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32010D0087, such that your personal data should be afforded the same level of protection as when it is processed in the EEA.

We will process your personal data for as long as necessary to ascertain who visited our sites and/ to deal with any legal issues that may arise concerning our sites or incidents at our sites or otherwise concerning your visit to our site or others’ visits to our site at around the same time as your visit.

We retain visitor log books for at least three (3) years after they are created and CCTV or other visual/audio recordings for at least six (6) months after they are captured, or longer to deal with the legal issues noted above unless/until those legal issues are resolved.

You have a number of rights in relation to your personal data. These include the right, subject to exceptions, to: 

• access your personal data;
• request the rectification or erasure of your personal data;
• request restrictions on the processing of your personal data; and
• object to our processing of your personal data.

Please contact the National Express UK Data Protection Officer if you wish to exercise any of these rights.

You also have the right in some circumstances to receive a copy of your personal data in a portable format. This right is limited to personal data that you have provided to us and is processed on the basis of your consent or any contract with us. It does not cover personal data that we process on the grounds of legitimate interest.

If you have any questions or complaints about how we process your personal data, you should contact the National Express UK Data Protection Officer : 

• address: Data Protection Officer, National Express, National Express House, Birmingham Coach Station, Mill Lane, Digbeth, Birmingham B5 6DD

 or 

• email address: data.protection@nationalexpress.com

You also have the right to complain to the UK Information Commissioner's Office about how we process your personal data. You can do this by contacting them on their helpline: 0303 123 1113.