PRIVACY NOTICE – ‘#WinDough’ Campaign and competition

1. Who does this privacy notice apply to, and what is it about?

This privacy notice applies to you if you have taken part in our marketing campaign “#WinDough” or submitted any personal data to us as a result of this campaign

This privacy notice explains:

• who is the controller of your personal data
• what personal data we collect about you;
• what we do with your personal data and legal basis?
• your rights in respect of your personal data; and
• what to do if you have any questions or complaints about our use of your personal data.

We take your privacy very seriously and are committed to abiding by the Data Protection Laws which protect your privacy.

It is your responsibility to read this privacy.

National Express requests that you do not share any images to our social media channels of any children. If however you share a Photograph of yourself and a passenger who is 18 years and over travelling with you, we expect you to inform them of this notice. You can contact our Data Protection Offcer at any time quoting the competition and details of the image to request this to be deleted from our photography library bank. 

2. Who is the controller of your personal data?

National Express Limited, trading as National Express, is the controller of your personal data. National Express Limited, will process your personal data fairly, lawfully and in a transparent manner we will ensure your personal data is:

• Only obtained and processed for the specified, explicit and lawful purposes and not further processed in a manner that is not compatible;
• Adequate, relevant and limited to what is necessary in relation to the purpose;
• Accurate and, where necessary, kept up to date;
• Kept in a form which permits the identification of the individual, (data subject) to whom the personal data relates to and is kept no longer than is necessary;
• Processed in line with our security controls; and
• Have clear accountable controls to ensure compliance with this privacy notice and processing operations.

3. What personal data do we collect about you, and how?

By taking part in this campaign, we may collect the following types of personal data about you:

• your name
• your image, (Photograph), where it is captured by you and submitted to us;
• your social media handle; and
• your email address, if you are chosen as the winner

In addition, each time you visit our website we may automatically collect the following information:

• technical data, including:
  • IP address;
  • browser type and version;
  • time zone setting and location; and
  • operating system and platform;
• transaction data, including:
  • the full Uniform Resource Locators (URLs) clickstream to, through and from our website (including date and time); and
  • time on page, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page.

We collect your personal data for this campaign by you:

• submitting your image to a social media site and by tagging us in the photo using @nationalexpress or by using any of the advertised social media tags such as #WinDough;

4. What do we do with your personal data and on what legal basis?

We use your personal data for the following purposes and describe below the legal basis on which we process your personal data:

National Express relies on Article 6 (1) (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; as the lawful basis for processing personal data in images sent to us in this campaign.

The categories of personal data that will be captured are as follows:

• Photographic image

5. What if we have obtained your consent to use your personal data?

By submitting your images to us, and therefore entering our competition (using one of the social media tags that allow us to see your image) you are providing National Express your consent to process your personal data and any other passenger travelling with you when you have obtained and confirmed their acceptance to be party to the Photograph You, they may withdraw that consent for the purpose of processing the personal data at any time by contacting us using the details at the bottom of this privacy notice.

Marketing

We have opted you into marketing on the basis of Soft-Opt In this means by supplying your information and/or by browsing to make a transaction for any services we can contact you with like for like products and services. Where you have provided positive consent for us to send you marketing communications will we use this information for our marketing purposes.

You may withdraw that consent at any time, either by updating your marketing preferences in your account with us (if you have one) or by clicking on the “unsubscribe” link in any marketing communications we send you.

Where you have consented to the use of cookies, you may withdraw that consent at any time by changing your cookie settings as explained in our cookie policy.

6. Who will we share your personal data with?

We may share your personal data with:

• other National Express Group companies;
• With our competition regulators;
• social media companies, including Facebook, Instagram and/or X;
• our suppliers, sub-contractors, business partners and our brand ambassadors who help us to provide our products and services to you;
• suppliers who provide us with analytics, customer insights and market research
• other business partners in connection with the provision of their products and services to you;
• our legal and professional advisors;
• analytics and search engine providers that assist us in the improvement and optimisation of our websites; and
• other companies that take on any part of our business as a result of a restructure, merger or transfer of that part of our business.

Please note that by submitting your photos via your social media account to the National Express social media sites, listed below, your data is also governed by these social media organisations who act as data controller in their own right and will have published their respective privacy policies. To understand how these companies use your data please see:

X: https://x.com/en/privacy

Facebook/Instagram: https://www.facebook.com/privacy/policy

We do not accept any responsibility or liability for these notices or policies or the third parties’ handling of your personal data. Please check the relevant third party’s privacy notice before you submit any personal data to their respective websites.

7. Do we transfer your personal data outside of the UK?

As part of our own National Express social media accounts, we have signed up to the relevant social media company terms and conditions. By you tagging us in the photo you are in control of the personal data you are sharing from your social media account to our social media account. Therefore, some of this personal data may be processed outside of the UK. You can prevent this transfer from happening by not sharing the data with the social media company.  Where we transfer personal data outside the UK, we ensure all safeguards are in place in line with the Data Protection Act 2018.

10. For how long will we process your personal data?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal or accounting or  in respect of our relationship with you.

Where we process your personal data based on:

• your consent we will process such personal data for a period of 1 month after the competition closes or until you withdraw that consent. Please bear in mind that it may take a short time to process any withdrawal of your consent.  We aim to do this within 72 hours of receipt of your request.

Any images posted to social media channels will also be subject to the retention periods as outlined in the relevant social media privacy notices outlined in the social media links in Section 7.

10. What rights do you have in relation to your personal data?

You have a number of rights under Data Protection Laws in relation to your personal data.  These include the right, subject to exceptions, to:

• request access your personal data;
• request rectification or erasure of your personal data;
• right to object to the automated processing of your personal data;
• request restrictions on the processing of your personal data; and
• object to our processing of your personal data.

You also have the right in some circumstances to receive a copy of your personal data in a portable format.  This right is limited to personal data you have provided to us and is processed on the basis of your contract with us and/or your consent. 

If you wish to exercise any of these rights and/or request a portable copy of the data that you have provided and is processed on these bases, please contact the National Express UK Data Protection Officer.

You should be aware that any images that are shared with us on our social media channels, and subsequently re-shared by us, may not be able to be easily removed or deleted. National Express will make every effort to delete them from our social media pages but you should refer to the relevant privacy notice of each social media provider for how to request deletion from their systems.

11. What should you do if you have any questions or complaints?

If you have any questions or complaints about how we process your personal data, or otherwise about the matters set out in this privacy notice, please contact the National Express UK Data Protection Officer at:

• Address: Data Protection Officer, National Express, National Express House, Birmingham Coach Station, Mill Lane, Digbeth, Birmingham B5 6DD

or

• Email address: protection@nationalexpress.com

You also have the right to complain at any time to the UK Information Commissioner's Office about how we use your personal data and can contact them on their helpline: 0303 123 1113 or website at https://ico.org.uk/