National Express

Privacy Notice

Customers and passengers - West Midlands Accessible Transport Limited

About your data

Here at National Express Accessible Transport, we are committed to making sure that your personal information is safe and secure.

When you use our National Express Accessible Transport services, including visiting our website, you trust us with your personal information and we will collect and store that securely. We need to collect your personal information for a number of different reasons including our statutory functions and to be able to provide you with the full range of National Express Accessible Transport services.

Who does this privacy notice apply to, and what is it about?

This privacy notice applies to you if you are or were:

  • a customer of West Midlands Accessible Transport Limited trading as National Express Accessible Transport (“NEAT” or “us” or “we” as applicable); and/or
  • a passenger on services operated by or on behalf of NEAT; and/or
  • involved in an incident, whether as a passenger, pedestrian or other road user, that occurs on or in relation to a service operated by or on behalf of NEAT; and/or
  • a witness to such an incident.

In addition, we may process and store your personal data if you have made an inquiry, booking or application through a third party to use services operated by or on behalf of NEAT.

This privacy notice explains:

  • what personal data we collect about you;
  • what we do with your personal data;
  • your rights in respect of your personal data; and
  • what to do if you have any questions or complaints about our use of your personal data.

We take your privacy very seriously and are committed to abiding by the Data Protection Laws which protect your privacy.

This privacy notice may change from time to time and the most up-to-date version will always be available on our website.  It is your responsibility to read this privacy notice and check our website for the current version.

Who is controller of your personal data?

For most purposes, the Controller of your personal data will be the entity which collects it from you and that entity’s privacy policy should explain how your personal data is being processed.

However, for the ring and ride services which NEAT operates on behalf of West Midlands Combined Authority (“WMCA”), NEAT collects your personal data through the ring and ride booking process as a processor of WMCA and, save where set out in this privacy notice in the paragraph below, WMCA will be the Controller of such personal data. Please refer to WMCA’s privacy notice at https://www.tfwm.org.uk/privacy-cookie-policy/ for further information on how WMCA are processing your personal data.

NEAT will be the Controller of any personal data which it receives from third parties or which it collects on behalf of third parties (including, without limit, WMCA) where such personal data is being used for the purposes set out in section 4 of this privacy notice. NEAT will also be the Controller of any personal data which it collects from any equipment which it has installed on any vehicles it uses to perform the services or on any of its premises, such as CCTV.

NEAT’s representative for the purposes of this privacy notice is the National Express UK Data Protection Officer, who can be contacted using the contact details provided at the end of this notice.

What personal data do we collect about you, and how?

We collect the following types of personal data about you: 

  • your name and title;
  • your contact details, including your home address, your email address and your home and/or personal mobile telephone numbers;
  • if you are disabled or have special needs or you have any medical issues, information about your disability, special needs, mobility requirements or medical issues, or where you are arranging transport for someone else information about their disability, special needs, mobility requirements or medical issues;
  • your image and/or voice, where this is captured by CCTV or any other audio recording equipment on the passenger carrying vehicles used to provide our passenger travel services or any of our premises; and
  • any other personal data that you provide to us or which is provided to us by a third party.

 We collect this personal data in the following ways:

  • by you creating an account with us or otherwise inquirying or booking or arranging services to be provided by us or on our behalf;
  • by you providing to us, either directly to our staff or other representatives who were present at or attended any accident or incident or who work in the customer contact centre;
  • by us making visual or audio recordings on passenger carrying vehicles operated by us or on our behalf or on our premises and by us recording telephone conversations to our customer contact centre;
  • by other persons who were involved in, or affected by, the incident reporting it to us; or
  • by the police or emergency services who responded to the incident reporting it to us.

What do we do with your personal data and on what basis?

We process your personal data for the following purposes:

  • Business necessity: to respond to, investigate, manage, keep records of and report on incidents that occur on or affect passenger transport services operated by us or on our behalf.
  • Legal and regulatory compliance: to ensure compliance with applicable laws and regulations to which we are subject, including those which require us to report incidents.
  • Health & safety and security purposes: to seek to ensure the health and safety and security of our customers/passengers, other road users and other members of the public.
  • Evidential purposes: to facilitate the conduct of any investigation into incidents, whether by us or any law enforcement or regulatory authorities, and/or to enable the conduct of any complaints and/or legal claims by or against us in relation to incidents.
  • Legal purposes: to enforce and defend our legal rights.

We may process special category personal data for the purposes of establishing, exercising or defending legal claims.

We may process your personal data because we have a legal obligation to do so, for example under road transport and licensing laws, under health & safety laws or pursuant to court rules and orders. Where we process your personal data because we have a legal obligation to do so, there is no right to object to that processing.

In all other cases, we process your personal data on the basis of our legitimate interest. Where we process your personal data on the basis of our legitimate interest, you have the right to object to our use of your personal data.  However, we do not have to stop processing personal data where we have compelling grounds that override your interests, or where we need to process your data in order to establish, exercise or defend legal claims.  If you have any objections please contact the National Express UK Data Protection Officer (see details below).

What if we have obtained your consent to use your personal data?

If we process your personal data on the basis that we have obtained your consent to do so (which is likely to be for a purpose that is not described in this privacy notice) you may withdraw that consent at any time and we will give you further information at the time of obtaining your consent on how to withdraw consent.

What are our obligations to collect, and your obligations to provide, personal data?

If you are directly involved as a driver or other road user in the incident, we may be under an obligation to collect information from you in relation to the incident.  You would have a corresponding legal obligation to provide information to us.

Otherwise, we have no obligation to collect, and you have no obligation to provide, your personal data but, if you do not provide us with certain personal data, we may not be able to respond to or investigate an incident and/or communicate with you about it.

Who will we share your personal data with?

We may share your personal data with:

  • other National Express Group companies;
  • any funders of the services operated by us or on our behalf, including WMCA and Birmingham City Council;
  • our suppliers, sub-contractors, business partners and our brand ambassadors who help us to provide our products and services to you;
  • our suppliers and contractors who help us respond to, investigate and mange incidents;
  • our legal and professional advisors;
  • our claims handlers, insurance brokers and insurers;
  • government bodies and regulatory authorities, including the Driver and Vehicle Standards Agency, the Police and other crime prevention and detection agencies, the UK Border Agency and other immigration authorities and the UK Information Commissioner’s Office;
  • the Traffic Commissioners, the courts and other dispute resolution arbitrators and mediators, other parties to legal proceedings and passenger transport watchdogs;
  • the courts and parties to legal proceedings before the courts; and
  • other companies that take on any part of our business as a result of a restructure, merger or transfer of that part of our business.

Where we share your personal data with subcontractors or business partners for the purpose of them providing products and services to you, it may be essential to do this to fulfil a contract with you or as necessary in relation to any incidents relating to such services. Such parties will either receive such personal data as our processor (in which case we remain liable for that processor’s actions) or in some instances as a controller in their own right (in which case you should refer to their privacy notice). 

We do not accept any responsibility or liability for third parties controllers or their handling of your personal data. Please check the relevant third party controller’s privacy notice.

Do we make international transfers of personal data?

There may be occasions where it is necessary for us to transfer your personal data to a country outside of the European Economic Area (“EEA”) including where our suppliers or subcontractors who process your personal data on our behalf are based in such a country.  It is possible that the country concerned may not be deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the EEA.

Where we transfer your personal data to other National Express Group companies and/or third parties who process your personal data on our behalf in countries outside the EEA that are not deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the EEA, we have entered into appropriate contracts with those National Express Group companies and/or third parties based on the standard contractual clauses approved by the European Commission, a copy of which can be found here: http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32010D0087

For how long will we process your personal data?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, or reporting requirements in respect of our relationship with you.

Where we process your personal data to fulfil:

  • a legal obligation, we will process such personal data for so long as necessary to fulfil that obligation; or
  • a contract with you, we will process such personal data until we fulfil that contract and for so long thereafter as may be necessary to keep a record of that contract, which will typically be for 6 years, and to deal with any complaints or claims relating to that contract, which will be until the final resolution of such complaints or claims (having regard to the nature of any potential claims and the limitation of liability periods that apply to them).

Where we process your personal data based on:

  • our legitimate interest, we will process such personal data for so long as necessary to achieve that legitimate interest, which will typically be for 6 years after we collect your personal data or the last time we use your personal data (or longer in relation to any legal claims that might arise having regard to the nature of any potential claims and the limitation of liability periods that apply to them)
  • We will also process your personal data for as long as necessary to respond to, manage and investigate any incident. We will also retain your personal data for at least six (6) years from the date of the incident, or if later, the date on which all regulatory investigations and legal claims or potential legal claims relating to the incident have been fully and finally concluded, having regard to the nature of any potential claims and the limitation of liability periods that apply to them

We may also retain your personal data for longer if we cannot delete it for legal, regulatory or technical reasons.

What rights do you have in relation to your personal data?

You have a number of rights under the Data Protection Law in relation to your personal data.  These include the right, subject to exceptions, to:

  • request access your personal data;
  • request rectification or erasure of your personal data;
  • request restrictions on the processing of your personal data; and
  • object to our processing of your personal data.

Please contact the National Express UK Data Protection Officer if you wish to exercise any of these rights. In the case of incidents, we reserve the right to continue to use your personal data on the grounds of compelling legitimate grounds for this.

You also have the right in some circumstances to receive a copy of your personal data in a portable format.  This right is limited to personal data you have provided to us and is processed on the basis of your contract with us and/or your consent. It does not cover personal data that we process on the grounds of our legal duty or our legitimate interest and so, as these are the bases on which we will process your personal data we collect for the purposes of this privacy notice, this right will not apply.  

If you wish to exercise any of these rights and/or request a portable copy of the data that you have provided and is processed on these bases, please contact the National Express UK Data Protection Officer.

What should you do if you have any questions or complaints?

If you have any questions or complaints about how we process your personal data, or otherwise about the matters set out in this privacy notice, please contact the National Express UK Data Protection Officer at:

  • Address: Data Protection Officer, National Express, National Express House, Birmingham Coach Station, Mill Lane, Digbeth, Birmingham B5 6DD

or

You also have the right to complain at any time to the UK Information Commissioner's Office about how we use your personal data and can contact them on their helpline: 0303 123 1113 or website at https://ico.org.uk/

  Cookie Policy

Our website uses cookies to distinguish you from other users of our website.

Back to top

© Copyright National Express Ltd 2021