Data brokering

This privacy notice applies to you if you are or were a customer of our coach or bus passenger services.

It explains how we will process certain limited categories of your personal data for informing how we will conduct our marketing campaigns and how we will advertise our services, and to enable us to plan and develop our bus and coach services for our customers better. We have a separate Customer and Privacy notice which explains what personal data we collect and process about you in the course of the actual delivery of our services and the actual running of our marketing campaigns (click here to view).

We share certain limited categories of your personal data with a “data broker” who, as our data processor, will match that personal data with any other personal data they process about you in their capacity as a data controller. This “combined” data is then processed by us, as a data controller, to inform how we conduct our marketing campaigns and how we advertise our services, and to enable us to better plan and develop our bus and coach services. Our separate Customer and Privacy notice (click here to view) explains when and how we process your personal data for marketing purposes.

The third-party data broker is Sagacity Data Limited (Company Register Number 2959244) whose registered office address is at 120 Holborn, London, EC1N 2TB (“Sagacity”).

National Express Limited or another member of its group of companies in the UK division is the controller of your personal data that is or was processed for the purposes explained in this privacy notice.

This will be one of the following named National Express UK divisional group companies:

We collect the following categories of personal data about you which will be processed for in the way described above:

• your name and title;
• your home address, including postcode;
• your email address; and
• the unique customer reference code we ascribe to you.

We collect your personal data in a variety of ways, which is set out in our Customer and Passenger privacy notice (click here to view).

The additional personal data that we will obtain from Sagacity which, when combined with your personal data above, comprises the “combined” data, is:

• your age band, (for example 18-24 years of age);
• your gender, (for example male or female);
• your household composition, (for example two-person household, single, cohabiting couple, true or false children in household);
• your household size, (for example 1, 2, 3 or adults);
• your household income bracket, (for example £10,000 - £19,999 total household income);
• your occupation category, (for example homemaker, unemployed, retired, student);
• your estimated affluence, (based on indicators such as post code, region demographics and accommodation type);
• your type of residence, (for example a terraced house);
• the newspapers you read,
• your holiday preferences, (for example whether you like to travel in EU, USA etc);
• your leisure, food and fitness interests;
• whether you order products by mail order, (for example indicator buys online);
• your general profile, (for example city centre dweller, self-sufficient spender);
• whether you own a car, mileage, and what type/age;

We use the “combined” personal data for the following purposes and on the following legal basis:

We have no legal obligation to collect personal data about you in the way described in this privacy notice, but it is useful to process your personal data in this way in order to inform our marketing and advertising campaigns and plan and develop our products and services.

You have no legal obligation to provide your personal data to us for the purposes described in this privacy notice.

We will share your personal data that we process as described in this privacy notice with:

• other National Express Group companies;
• our suppliers, sub-contractors, business partners and our brand ambassadors who help us to provide our products and services;
• our legal and professional advisors;
• government bodies and regulatory authorities, including the Police and other crime prevention and detection agencies and the UK Information Commissioner’s Office;
• the courts and other dispute resolution arbitrators and mediators, other parties to legal proceedings; and
• other companies that take on any part of our business as a result of a restructure, merger or transfer of that part of our business.

Your data will not be transferred outside the EEA unless there is a mechanism in place to ensure that it will be processed to the same standards as are expected within the United Kingdom. This mechanism may be the acceptance of the UK and EU data transfer agreements and applicable model clauses which govern data transfer to countries outside the EEA or if the transfer is to the United States of America, then will be governed by Standard Contractual Clauses (SCCs). 

Where we transfer your personal data to other National Express Group companies and/or third parties who process your personal data on our behalf in countries outside the UK that are not deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the UK, we have entered into appropriate contracts with those National Express Group companies and/or third parties approved for use in the UK which give personal data the same protection as it has in the UK. Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for.

As we process your personal data in the way described in this privacy notice on the basis of our legitimate interest, we will process such personal data for as long as necessary to achieve that legitimate interest.

We will delete that part of your personal data which we obtain from Sagacity if our contract with them ends, as we have contractually agreed to do so. We will also retain your personal data, including that part of it we have obtained from Sagacity, for longer if we cannot delete it for legal or regulatory reasons.

You have a number of rights under the data protection laws in relation to your personal data. These include the right, subject to exceptions, to:

• request access to your personal data;
• request rectification or erasure of your personal data;
• request restrictions on the processing of your personal data; and
• object to our processing of your personal data.

You also have the right in some circumstances to receive a copy of your personal data in a portable format. This right is limited to personal data you have provided to us and is processed on the basis of your contract with us and/or your consent. It does not cover personal data that we process on other grounds.

If you wish to exercise any of these rights and/or request a portable copy of the data that you have provided and is processed on these bases, please contact the National Express UK Data Protection Officer.

If you have any questions or complaints about how we process your personal data, or otherwise about the matters set out in this privacy notice, please contact the National Express UK Data Protection Officer at:

• Address: Data Protection Officer, National Express, National Express House, Birmingham Coach Station, Mill Lane, Digbeth, Birmingham B5 6DD

or

• Email address: data.protection@nationalexpress.com.

You also have the right to complain at any time to the UK Information Commissioner's Office about how we use your personal data and can contact them on their helpline: 0303 123 1113 or website at https://ico.org.uk/.