Go South Coast Limited Privacy Policy

Privacy policy

Introduction

Go South Coast Ltd, trading as Bluestar / Unilink / Damory / more bus / Unibus / Purbeck Breezer / the New Forest Tour / Southern Vectis / Vectis Blue / Island Breezer / Tourist Coaches / Salisbury Reds / the Stonehenge Tour / Excelsior Coaches / Thamesdown Swindon’s Bus Company / Hants & Dorset Trim is committed to protecting and respecting your privacy when you use our services.

This Privacy Policy explains:

• What personal data we collect from you when you use our websites, smartcards, apps, visit our bus stations, contact us or use our services, or WiFi;
• How we will collect and use that information;
• How we keep information secure; and
• How you can contact us if you wish to exercise any of your rights in relation to the information or make a complaint.

• Information we may collect from you
• How we use your information
• Sharing or disclosure of your information
• When we collect information
  • Website visits and purchases
  • CCTV
  • Travel Shop purchases
  • Revenue Protection and Penalty Fares
  • Customer Service database
• Where we store your personal information
• Information Security
• Your rights

The data controller is:

Go South Coast Limited of 3rd Floor, 41-51 Grey Street, Newcastle Upon Tyne, NE1 6EE, Registered in England No 1671355

Our Data Protection Manager is:

Ben Murray, Finance Director, Towngate House, 2-8 Parkstone Road, Poole, Dorset, BH15 2PR or ben.murray@gosouthcoast.co.uk

You can contact the Group Data Protection Officer as follows:

In writing to, The Go-Ahead Group plc, 4 Matthew Parker Street, London, SW1H 9HQ or by email to data.protection@go-ahead.com.

More information about the Data Protection Act can be found on the Information Commissioners Website https://ico.org.uk/

How we use your information

We will only use the information you provide as permitted by the Data Protection Law. Depending on how you contact us, use our services, the consent you have given, our legitimate interests, or legal obligations we may have, this will include:

• To provide you with the service (Things like carrying out our obligations arising from any contracts- selling tickets, making and taking payments. We mostly rely on the legal ground of contractual performance to process your data, but sometimes the data is also used for our legitimate interests of customer service, health and safety, improving our services and other legal obligations, like providing information to our regulators)
• To provide you with details of our services and information about travelling, and customer service (this is based on our legitimate interests, to run bus and associated services. Sometimes it is part of our contract or our other legal obligations)
• To provide you with details of promotions and offers which we feel may interest you; (this is based on our legitimate interests to try and sell more bus tickets when you have given consent for us to contact you and you have an absolute right to ask us to stop sending marketing emails/SMS). If you use on of our apps, information about app notifications is contained within the App and push notifications can be controlled via the App and your mobile device. We use information such as the type of tickets you buy and bus stops you use to send relevant communications.
• To run our services and improve them (We believe in investing in our services, not just to benefit passengers but also the wider community, environment, and economy. There are lots of activities we do to achieve this, some are administrative and we also do things like monitoring passenger numbers, and popular bus stops, improving technology to help plan journeys- make money, run our services safely and be a good employer- we call these our legitimate interests. Some of these things are also covered in our legal obligations, not just to customers, but under Local Authority contracts, the Department for Transport or Regulators.  Some data is also shared in order to run interoperable services for more than one bus company.  
• For your safety and security.
• For fraud and crime prevention.
• To enhance your experience of our website, as described in our cookie policy.
• To run competitions

We are part of a Group of Companies and share administrative services and support. Your data may therefore be shared with them.  We may also be required to pass certain customer data to a successor business, local authority or Department of Transport.   

Our Legitimate Interests

Running our business and Group businesses, (in a safe and socially and environmentally responsible manner, efficiently, to provide sustainable and high quality, locally focused passenger transport services, improve and expand our services, be a leading employer in the transport sector, investing in and developing our colleagues, operating with financial discipline to provide shareholder value, provide and improve customer services)

Sharing or disclosure of your information

We will only share or disclose your information as set out in this Policy or in accordance with Data Protection Law and will obtain your consent where we are required to do so. We will only use third parties to process information where we are satisfied that they comply with these standards and can keep your data secure. We may share or disclose information for the following reasons:

• We use data processors to provide or assist with some of our services. Where we do so, they must agree to strict contractual terms and to keep your data secure.
• Where we share data across our Group Companies, this is only in accordance with a written data sharing agreement.
• To operate interoperable services- this includes use of some shared systems and processors.
• To respond to your complaints or administer requests you have made, either to us or another regulatory body, ADR or appeals service, or local authorities and contract partners;
• To process payment card transactions;
• To comply with requests from the police or other law enforcement agencies for the purposes of crime prevention or detection. These are dealt with on a case-by-case basis
• To comply with other legal obligations for example, relating to crime and taxation purposes or regulatory activity;
• To protect our legitimate business interests, for example, for fraud prevention or revenue protection; and
• If you have agreed to receive information for competition, promotion, survey or research purposes, we may share your contact details with a limited number of parties, but only for the reasons you have agreed to in the terms and conditions of the purpose.
• Where you have consented, to share with other members of the Go-Ahead Group PLC (registered in England, company number 02100855) (“Go Ahead”), of which we are a member, where Go-Ahead has any services, promotions and offers which we feel may interest you. Details of other members of Go-Ahead can be found here.
• We have a policy in place for one off sharing of data, such as a request from an insurance company.

CCTV

Camera systems we operate

Our CCTV is used to capture, record and monitor sound and images of what takes place at our bus depots and on the inside and outside of our buses in real time.

Depending on the type of camera, images are recorded on video tape (analogue) or as digital information. Cameras can be fixed or set to scan an area. In some circumstances, they can be operated remotely by controllers.

Why we operate CCTV cameras

We operate CCTV for the following purposes:

• Health and safety of employees, passengers and other members of the public;
• Crowd management; and
• Prevention and detection of crime and anti-social behaviour
• Improve the customer service we provide

Camera locations

We operate cameras at the depots we manage and on most of the buses that we run.

Length of time CCTV footage is kept

CCTV footage at bus stations and on bus is generally held for a maximum of 31 days from the time of recording. Buses- the CCTV footage on busses is recorded over on a continual basis and therefore footage is retained for an average of 7-21 days before it is overwritten.

How to access your CCTV personal data

You can request copies of images or footage of yourself by making a subject access request. The Subject Access Request section on this site explains the information you will need to provide

Disclosing personal data to the police

At our discretion, we may disclose personal data in response to valid requests from the police and other statutory law enforcement agencies.

Before we authorise any disclosure, the police have to demonstrate that the personal data is necessary to assist them in the prevention or detection of a specific crime, or in the apprehension or prosecution of an offender.

Requests from the police are dealt with on a case-by-case basis to ensure that any such disclosure is lawful in accordance with the Data Protection Law.

Sharing CCTV footage with other third parties

We may also disclose personal data to third parties, if required to by law or it is necessary for a legitimate purpose such as defending or bringing legal action. Where we operate specific school, services subsidised by schools or local government, we share CCTV with the relevant school for the health and safety of students and our employees as well as prevention and management of anti-social behaviour. Data Protection Law allows us to do this where the request is supported by:

• evidence of the relevant legislation; or
• a court order
• Satisfactory evidence and assurances of the legitimate interest.

Legitimate interest would include requests such as defending or making a legal claim, such as to insurers following a vehicle collision.  When we are not required to provide CCTV, we will take into account the circumstances and any potential harm to individuals, we may also charge an administration fee and seek indemnity for any use beyond which it is requested.

External guidelines and best practice

This section shows the information we collect when you use our website. Before providing us with your details, please read the following important information regarding:

• Collection of visitor information;
• Hyperlinks;
• Cookies

Collection of visitor information

We will only use the information that we collect about you lawfully, in accordance with the Data Protection Law.

The details you provide about yourself and any other information which identifies you (‘Personal Information’) is held by on this website (the "Site") for operational purposes, for example member registration or processing payments. We may also use your Personal Information to personalise your experience on the Site by informing you of new products or services that we may think are of interest to you.

Go South Coast Limited gathers general information about users, for example, what services users access the most and which areas of the site are most frequently visited. Such data is used in the aggregate to help us to understand how the site and apps are used. We gather this information so that we can continue to improve and develop our services to benefit of our users. We may make this aggregated information available to users of the site and also to auditors. These statistics are anonymous.

When you register with set up a travel alert, enter a competition, or buy a ticket, we ask for personal information such as your name, contact details, and other details. Once you register with and accept our Terms & Conditions, you are not anonymous to us. We may use information that you provide to alert you to our own products and services. We may contact you regarding site changes or changes to the products or services that you use.

If you buy a ticket online with, we will record your personal details and send you a confirmation email. Your personal data will be used principally to communicate with you with reference to your request.

You may opt-in to receive newsletters, exclusive discounts, special offers and other marketing emails from. You may unsubscribe at any time by logging in to your account and updating your preferences. Please note changes to your subscription preferences can take up to 14 days to take effect.

Alternatively write to Customer Services Team at Go South Coast, 2-8 Parkstone Road, Poole, Dorset, BH15 2PR

Hyperlinks

We may provide hyperlinks from the Site to websites of third parties. No liability is accepted for the contents of any site operated by a third party which may be accessed via links from the Site. These links are provided for your convenience only and do not imply that or recommends the content of such sites. We encourage our users to be aware when they leave our site to read the privacy statements of each and every website that collects personally identifiable information. This Privacy Policy applies solely to information collected by Go South Coast Ltd.

Cookies

A cookie is a small piece of information that is sent to your browser when you access a website. Cookies contain information about your visits to that website and the purpose of cookies is to enable our websites to remember you, and your browsing habits, when you visit it again in the future.

With most Internet browsers you can configure your browser so that it refuses new cookies, prompts you to accept cookies or disables cookies altogether. Exactly how this is done is dependent on the browser you use. To find out more about the cookies we use please visit our cookie policy.

Personal details we hold

When you buy annual passes/season ticket valid for one week or more, we keep a record of this on a database. We keep the following details:

• Name, address and photo card number (if applicable) and date of birth;
• Phone number and email if you provide them;
• The product type, zone, start and end date of annual tickets you have purchased, along with any duplicate, replacement or refund of these; and
• The method of payment used, but not any payment card details.
• We may collect additional details when you register an account with us, download an app or use a smartcard, for example IMEI on your mobile phone, or your location data for billing on a smartcard.

How we use your personal data

We use this information for Contractual obligations, Customer Service and administration, customer research, marketing and fraud prevention.

We will only send you information about offers and promotions if you chose to receive it and you can change your marketing preferences at any time. We will not pass your personal information to any other organisation outside of our Group of Companies (and Successor business or Secretary of State for Transport) for marketing purposes without your prior consent.

Sharing data with third parties

Personal details we hold

We may collect a range of personal detail during the course of revenue protection activity. This may include name, address, proof of ID, journey details, payment details, personal descriptions and other information you provide to support an appeal. This data is processed by

How we use your personal data

We only use this information for the administration of the Penalty Fares scheme, collection of unpaid fares, fraud prevention and the prosecution of travel offences.

Sharing data with third parties

We may share your correspondence with:

• British Transport Police under a data sharing agreement to prevent and detect crime.
• To operate a penalty fares scheme

We collect your information and comments when you contact us by letter, email, web form, phone or social media.

Personal details we hold

We may hold your name, address, email address, phone number, social media name, ticket details, our correspondence with you, the compensation claims you have made and payment made by us, proof of journey or other supporting information you may provide.

To ensure that we carry have an accurate record of dealings between us (and for training purposes) we may, in certain circumstances, record or monitor telephone calls, however you will always be told when this happens.

How we use your personal data

This information is used for administration of correspondence or processing claims you have made, such as delay repay as well as for fraud prevention purposes. We also use it to respond to complaints.

Sharing data with third parties

OBJECT TO DIRECT MARKETING

To prevent marketing to you, you have the right to ask us not to process your personal information for marketing purposes. We will usually inform you before collecting your information if we intend to use or disclose it for such purposes. If you do not want us to use your information for marketing purposes either:

• Indicate this by NOT ticking the box to be sent marketing emails (or offers)
• If you have an account with us, by logging in and changing your contact preferences;
• Click the unsubscribe link on direct marketing emails or
• Or contact us

It is possible that you may receive a pre-scheduled communication whilst your request is being processed as this can take several days.

If you have any other objections to how we are using your personal data please contact our data protection manager.

ASK FOR A COPY OF YOUR PERSONAL DATA

You are entitled to request a copy of the personal information we hold about you.

Please contact Please contact Customer Services at 01202 338421 or customer.services@gosouthcoast.co.uk.

We may need to ask for some further information, such as checking who you are.  Our Customer Services team and email you a form, which will help us deal with your request more efficiently.

Please let us know if you want to receive the information electronically.

We aim to get the information to you without undue delay and within 30 days.  If we have any trouble with this timeframe we will let you know within 30 days and explain what the problem is.  Sometimes we may hold information that we don’t have to provide, for example it would prejudice a police investigation or contains someone else’s personal data.

In most cases we provide the copy of your data to you for free.  We have set out some information about when it might not be free, or provided below.

RECTIFICATION /RESTRICTION

If you believe the information we hold about you is inaccurate or incomplete you can contact us and ask us to correct it.  You may also request any data processing we are carrying out on your data is halted whilst a request for rectification or objection or a dispute over the lawfulness of processing is being considered.

We will provide a response confirming the action we have taken or disagree with taking within 30 days, or provide a response within 30 days if the matter is complex and a further time is needed.

DELETION  

This is also known as the “Right to be forgotten”, you can request deletion or removal of personal information in some circumstances, such as where there is no compelling reason for its continued processing.