Last updated: 16th January 2023
Arriva UK Bus (”We”) are committed to protecting and respecting your privacy.
This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.
Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.
General Data Protection Regulation (GDPR)
For the purpose of the General Data Protection Regulation (the “Act”), the data controller is Arriva UK Bus Ltd of 1 Admiral Way, Doxford International Business Park, Sunderland SR3 3XP.
What personal data do we collect?
You may give us information about you by filling in forms on our site arrivabus.co.uk or by corresponding with us by phone, e-mail or otherwise.
This includes information you provide when you:
- register to use our website
- download and use our app
- subscribe to our services
- purchase tickets
- register to receive email updates
- register with us to use our on-bus Wi-Fi service
- enter a competition and/or prize draw
- agree to judge a competition that we are running
- participate in a promotion or survey
- report a problem with our site or app
- make a complaint
- file a lost property report
The information you give us may include your:
- e-mail address
- phone number
- financial and credit card information
- personal description and photograph
- geographical location
- IP or MAC address
- details regarding your use of your mobile device or PC (specifically when you register to use our on-bus Wi-Fi service)
When you use our services, we may also collect:
- technical information including:
- the Internet protocol (IP) address used to connect your computer to the Internet
- your login information
- browser type and version
- time zone setting
- browser plug-in types and versions
- operating system and platform
- information about your visit including:
- the full Uniform Resource Locators (URL) click-stream to, through and from our sites (including date and time)
- products you viewed or searched for
- page response times
- download errors
- length of visits to certain pages
- page interaction information (such as scrolling, clicks, and mouse-overs)
- methods used to browse away from the page and any
- phone number used to call our customer service number
- Anonymously analyse popular trip plan requests, tickets purchased and use of app features along with analysing depersonalised data.
We apply appropriate administrative, technical and organisational security measures to protect your personal data that is under our control from unauthorised access, collection, use, disclosure, copying, modification or disposal.
We utilise CCTV on our buses and in our depots and garages in order to:
- prevent, deter and detect crime
- apprehend and prosecute offenders, and provide evidence to take action in the courts
- help provide a safer environment for our staff
- protect public safety
- monitor operational and safety-related incidents
- assist with the verification of claims.
You have the right to make a request for access to CCTV images of yourself and to ask for a copy of them. We reserve the right to withhold information where permissible by the applicable data protection laws, and we will only retain CCTV images in line with our retention periods, or for longer as is required by law or to protect our own legitimate interests.
In certain circumstances, we may need to disclose CCTV images to law enforcement agencies. This will only be done where there is a legal basis to do so, and there is a statutory requirement for the organisation that has received the images to adhere to the relevant data protection laws.
Information we receive from other sources
We may receive information about you if you use any of the other websites we operate or the other services we provide, for example, Arriva Click, Green Line Coaches or Arriva Trains.
We are also working closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them.
Sensitive personal data
We will not intentionally or systematically seek to collect, store or otherwise use information about you classed as ‘special categories of data' or 'sensitive data' (for example, information relating to any religion, ethnic origin or health).
How do we use your personal data and what is the legal basis for such processing?
The collection of the personal data is usually mandatory and allows us to provide the information, products, and services to you. Where the collection of any personal data is not mandatory, we will inform you of this, as well as what this means for you if you do provide the relevant personal data.
Our legal basis for collecting and using the personal information will depend on the personal information concerned and the specific context in which we collect it - however, we will normally process your personal information only:
- where we have your consent to do so;
- where the processing is necessary to perform our contract with you; or
- where the processing is in our legitimate interests or those of a third party and such interests are not overridden by your data protection interests or fundamental rights and freedoms; and
- where we have a legal obligation to process your personal information.
Information provided by you
|Channel||Purpose of processing||Legal basis of processing|
|Email marketing||Opting in to receive email marketing communications||Consent|
|Prize draw / giveaways / competition forms||In order to fulfil prizes gifts to prize draw/giveaways/competition winners etc||Consent|
|Arriva UK Bus Account||To enable you to track your services along with website and app ticket purchases||Consent|
|Arriva UK Bus Website||Account creation to make purchasing a bus ticket via the website easier and to facilitate postal fulfilment||Contract|
|Arriva UK Bus App||Account creation to register for and use the mobile ticketing application||Contract|
|Image usage||In order to gain consent for image use for both Arriva employees and customers - for example, the use of images/video across our website, app or social media channels. If there are images of children, we will obtain parental/guardian consent.||Consent|
|On-bus ticketing transactions in relation to a multi-operator ticket capping scheme.||To authorise and issue customer refunds and resolve customer queries and/or complaints||Performance of a contract|
|Prize draws and competitions||When you enter a prize draw and/or a competition run by us we are required by The UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (the “CAP Code”) to either publish or make available on request the surname and county of major prize winners and, if applicable, their winning entries. This is to help ensure that a valid award takes place. At or before the time of entry, you will have the right to object to your information being published or made available, or to reduce the amount of information published or made available however in such circumstances, we must still provide your information and winning entry to the Advertising Standards Agency if challenged.||Legal obligation to ensure compliance with the CAP Code|
|Competitions||If you agree to act as a judge for any competition that we are running the CAP Code requires that the full names of competition judges are made available on request.||Legal obligation to ensure compliance with the CAP Code and consent|
Information we collect about you
|Channel||Purpose of processing||Legal basis of processing|
|Arriva UK Bus Account||Opting in to receive email marketing communications||Consent|
|Wi-Fi||To provide you with a WiFi service on board our services||Performance of a contract|
|Google Analytics||To anonymously analyse the effectiveness of our digital communications and website.||Consent|
|Arriva UK Bus App||To create and fulfil mobile tickets purchased via the m-ticket app||Performance of a contract|
|Arriva UK Bus Website||To fulfil tickets purchased via the website for postal delivery, print-at-home ticket or delivered to the m-ticket app||Performance of a contract|
|Research and Surveys||To gauge the experience and use feedback for service improvements||Informed Consent to participate in any research will be sought prior to starting any study. All insight will be conducted under Market Research Society’s Code of Conduct.|
|On-bus ticket machine||Anonymously analyse journey patterns||To support our goal of providing a punctual, desirable and efficient, operational bus service.|
|On-bus ticketing transactions covered by a multi-operator ticket capping scheme.||To authorise and issue customer refunds and resolve customer queries and/or complaints||Performance of a contract|
We may share your information with selected third parties including:
- Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you. This may also include prize fulfilment, image usage or payment refunds
- Companies within the Arriva group for the performance of any contract we enter into with them or you.
- Analytics and search engine providers that assist us in the improvement and optimisation of our sites.
- Other bus operators. We are currently participating in a multi-operator ticket capping scheme with First Midland Red Buses Limited and Centrebus Limited, therefore we may share data with these parties (such as your journey information and an anonymised account ID) in order to authorise and issue customer refunds and resolve customer queries. We will only share information in this way where there is a formal data sharing agreement in place.
We may disclose your personal information to third parties:
- In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
- If Arriva UK Bus Limited or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
- We may also disclose your personal data to law enforcement bodies, regulator, government agency or other third party where we believe disclosure is necessary
- (i) as a matter of applicable law or regulation
- (ii) to exercise, establish or defend or legal rights; or
- (iii) to protect your vital interests or those of any other person
We will not retain your personal data for longer than is necessary to fulfil the purposes for which we collected that personal information, unless the law permits or requires that we retain it for longer.
The table below explains in more detail how long Arriva UK Bus Limited will store different types of customer information for:
|Passenger Information||For a period of 6 years following the end of the year in which the passenger last purchased the Customer's services|
|Passenger details (e.g., name, address of customer etc)|
(i) Prospective passengers
(ii) Current passengers
(iii) Lapsed passengers
|(i) 13 months|
(ii) For the duration of the passenger's registration with the Customer and then for the period specified for lapsed passengers
(iii) For a period of 6 years following the end of the year in which the passenger last purchased the Customer's services
|Passenger data||For the duration of the passenger's registration with the Customer and then for a period of 6 years following the end of the year in which the passenger last purchased the Customer's services|
|Passenger consents to Customer terms and conditions||For the duration of the processing of the Personal Data and up to 6 years thereafter|
|Passenger service enquiries||3 years|
|Statistical reports/marketing data||Six (6) years|
|Register of complaints||Review after 2 years|
|Correspondence and papers including emails||Review after 6 years (or 10 years if the documents relate to a complaint or investigation)|
|Photography consent||Indefinitely or until image destruction|
|CCTV||Bus onboard CCTV is retained for a maximum of 14 days (however in some cases a maximum of 10 days). Depot and Garage CCTV is retained for a maximum of 30 days.|
|The surname and county of any winners of major prize draws and/or competitions and where applicable, winning entries.||For the duration of the processing.|
|Full names of individuals appointed as competition judges||For the duration of the processing.|
All information you provide to us is stored on secure servers. We are part of the Arriva plc Group, which trains its employees regarding our data privacy policies and procedures and permit authorised employees to access personal data on a need to know basis, as required for their role. We also take steps to ensure that any service provider that we engage to process personal data on our behalf takes appropriate technical and organisational measures to safeguard such personal data.
Transferring Information Internationally
Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.
This means that, when we collect your personal information, it may be processed in these countries. However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Notice. For example, we work with the following companies who process data in the following locations:
|We use Facebook to run our Facebook business pages and for marketing purposes - any information they collect is stored, but not limited to, USA and Sweden|
|We use Google to run paid advertising for marketing purposes and any information they collect is stored, but not limited to, USA, Chile, Ireland, Netherlands, Denmark, Finland, Belgium, Taiwan, Singapore|
|Nagarro||We use Nagarro for development of new features and dealing with any technical problems, issues and updates we have with our website & mobile apps. The activities Nagarro are contracted to undertake will be done so from India, these activities will see Nagarro provided with access to some personally identifiable data.|
Updates to this Privacy Notice
We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.
You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.
Your Data Protection Rights
You may have certain rights in relation to your information. The availability of these rights and the ways in which you can use them are set out below.
- Access: you are entitled to ask us if we are processing your information and, if we are, you can request access to your personal information. This enables you to receive a copy of the personal information we hold about you
- Correction: you are entitled to request that any incomplete or inaccurate personal information we hold about you is corrected.
- Erasure: you are entitled to ask us to delete or remove personal information in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims.
- Objection: where we are processing your personal information based on a legitimate interest (or those of a third party) you may challenge this. However, we may be entitled to continue processing your information based on our legitimate interests or where this is relevant to legal claims. You can object to marketing by contacting us to add you onto the suppression list and you can opt out of certain cookies such as tracking cookies.
- Lodge a complaint with the Information Commissioner’s Officer: You have a right to lodge a complaint with the Supervisory Authority should you feel that we have not handled your information in line with legislative and regulatory requirements. This is the Information Commissioner’s Office (ICO) in the UK: https://ico.org.uk/global/contact-us/
If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us via our contact page - www.arrivabus.co.uk/help/contact-us
or by post to the following address:
Arriva Customer Services
If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
If you have any question, concerns or complaints about this Privacy notice or our handling of your personal data, you can contact us through our customer service centre, or by post to the following address:
Arriva Customer Services
If you are unsatisfied with the response, you can contact Arriva plc's Data Protection Officer at [email protected].
You have the right to complain to a data protection authority about our collection and use of your personal information. If you are based in the European Economic Area, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries are available on the EU Commission's website via the following link: http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm)
The controller of your personal data is:
Arriva UK Bus Limited of 1 Admiral Way
Doxford International Business Park
Sunderland SR3 3XP