Our persons involved in incidents notice lets you know what data will be collected and how it will be used and processed if you are to be involved with an incident concerning National Express services.
This privacy notice applies to you if you are or were involved in an incident, whether as a passenger, pedestrian or other road user, that occurs on or in relation to any of our passenger transport services, and also if you were a witness to such an incident.
This privacy notice explains what personal data we collect about you and what we do with it. It also explains your rights in respect of that personal data and it informs you what to do if you have any questions or complaints about our use of your personal data.
If you are or were a passenger on one of our bus or coach services, you should also refer to our customer and passenger privacy notice on our website for information about what personal data we collect about you and what we do with it in your capacity as a customer and passenger. This privacy notice supplements that privacy notice for such passengers where such passengers are or were involved in an incident.
For clarity, we may not be the operator of certain of our coach and bus services as we may sub-contract the performance of some such services. Where this is the case, our sub-contractors may also collect personal data about you and be data controllers in respect of that personal data. Where that is the case, their privacy notices will apply regarding their collection and use of such data.
National Express Bus & Coach Services Limited is the controller of your personal data.
Our representative for the purposes of this privacy notice is the National Express Data Protection Officer, who can be contacted using the contact details set out at the end of this notice.
We may collect the following personal data about you in connection with an incident:
We collect this personal data in the following ways:
We use your personal data to respond to, investigate, manage, keep records of and report incidents that occur on or affect our passenger transport services and to deal with any regulatory investigations and/or legal claims that arise in connection with such incidents.
We process your personal data for the following purposes:
Business necessity: to respond to, investigate, manage, keep records of and report on incidents that occur on or affect our passenger transport services.
Legal and regulatory compliance: to ensure compliance with applicable laws and regulations to which we are subject, including those which require us to report incidents.
Health & safety and security purposes: to seek to ensure the health and safety and security of our customers/passengers, other road users and other members of the public.
Evidential purposes: to facilitate the conduct of any investigation into incidents, whether by us or any law enforcement or regulatory authorities and/or to enable the conduct of any legal claims by or against us in relation to incidents.
Legal purposes: to enforce and defend our legal rights.
We may process your personal data because we have a legal obligation to do so, for example under road transport and licensing laws, under health & safety laws or pursuant to court rules and orders. Where we process your personal data because we have a legal obligation to do so, there is no right to object to that processing.
In all other cases, we process your personal data on the basis of our legitimate interest. Where we process your personal data on the basis of our legitimate interest, you have the right to object to our use of your personal data. However, we do not have to stop processing personal data where we have compelling grounds that override your interests, or where we need to process your data in order to establish, exercise or defend legal claims. If you have any objections please contact the National Express Data Protection Officer (see details below).
If we process your personal data on the basis that we have obtained your consent to do so (which is likely to be for a purpose that is not described in this privacy notice) you may withdraw that consent at any time and we will give you further information at the time of obtaining your consent on how to withdraw consent.
If you are directly involved as a driver or other road user in the incident, we may be under an obligation to collect information from you in relation to the incident. You would have a corresponding legal obligation to provide information to us.
Otherwise, we have no obligation to collect, and you have no obligation to provide, your personal data but, if you do not provide us with certain personal data, we may not be able to respond to or investigate an incident and/or communicate with you about it.
We may share your personal data with:
There may be occasions where it is necessary for us to transfer your personal data to a country outside of the European Economic Area (“EEA”), including where our suppliers or subcontractors who process your personal data on our behalf are based in such a country. It is possible that the country concerned may not be deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the EEA. Where that is the case, we have entered into appropriate contracts with such data processors, based on the standard contractual clauses approved by the European Commission, a copy of which can be found here, such that your personal data should be afforded the same level of protection as when it is processed in the EEA.
We will process your personal data for as long as necessary to respond to, manage and investigate the incident. We will also retain your personal data for at least six (6) years from the date of the incident, or if later, the date on which all regulatory investigations and legal claims or potential legal claims relating to the incident have been fully and finally concluded, having regard to the nature of any potential claims and the limitation of liability periods that apply to them.
We may retain your personal data for longer if we cannot destroy it for legal or regulatory reasons.
You have a number of rights in relation to your personal data. These include the right, subject to exceptions, to:
Please contact the National Express Data Protection Officer if you wish to exercise any of these rights. In the case of incidents, we reserve the right to continue to use your personal data on the grounds of compelling legitimate grounds for this.
You also have the right in some circumstances to receive a copy of your personal data in a portable format. This right is limited to personal data that you have provided to us and is processed on the basis of your consent or any contract with us. It does not cover personal data that we process on the grounds of our legal duty or our legitimate interest and so, as these are the bases on which we will process your personal data we collect for the purposes of this privacy notice, this right will not apply.
If you have any questions or complaints about how we process your personal data, you should contact the National Express UK Data Protection Officer at:
You may also contact our customer contact centre by telephone on 01 903 9508 to report any incidents and the contact centre should be able to refer any questions you have regarding our use of your personal data in connection with incidents to the National Express Data Protection Officer.
You also have the right to complain about our use of your personal data to the Irish Data Protection Commission. You can do this by contacting them on their helpline: +353 761 104 800 or website at www.dataprotection.ie.
Back to top