This privacy policy applies to you if you:

·       are or were a member of the NX Rewards Programme operated by National Express Limited;

·       visit the NX Rewards website;

·       use our other NX Rewards channels; and/or

·       otherwise communicate with us in respect of the NX Rewards Programme.

This privacy policy, together with our adjoined cookie policy, explains what personal data we collect about you and what we do with it.  This privacy policy also explains your rights in respect of your personal data and it informs you about what to do if you have any questions or complaints about our use of your personal data.

We take your privacy seriously and are committed to abiding by this privacy policy and relevant data protection laws which protect your privacy.

This privacy policy may change from time to time and, if it does, the most up-to-date version will always be available on our NX Rewards website. It is your responsibility to read this privacy policy and check our website for the current version.

WL is the data controller for this Website.

WL has appointed, in accordance with Article 27 UK GDPR, its affiliate company Webloyalty International Limited as its representative within the United Kingdom. Webloyalty International Limited is located and registered at Charter Court, 50 Windsor Road, Slough, Berkshire, SL1 2EJ and registered at Companies House with registration number 05922626 - dpo@webloyalty.co.uk. Please address any questions or requests to the customer service address at customerservice@nxrewards.com or to the Data Protection Officer. You will receive a response within a maximum of 30 days.

National Express Limited of National Express House, Birmingham Coach Station, Mill Lane, Digbeth, Birmingham B5 6DD is the controller of your personal data that is processed for the purposes explained in this privacy policy.

The controller’s representative for the purposes of this privacy policy is the National Express UK Data Protection Officer, who can be contacted using the contact details set out at the end of this policy.

We collect the following types of personal data about you:

·       your name, title and date of birth;

·       your home address including postcode and country of residence;

·       your contact information, including telephone number and email address;

·       your transaction/payment information including bank account number and sort code (please note that full debit card and credit card information is not processed by us as it is passed through to a PCI-DSS compliant third party payment provider in accordance good industry practice);

·       your voice where captured in recorded telephone conversations with you; and

·       any other personal data that you provide to us when you communicate with us.

In addition, each time you visit our NX Rewards website we may automatically collect the following information:

·       technical information including web usage information (e.g. IP address), browser type and version, time zone setting, operating system and platform; and

·       information about your visit, including the full Uniform Resource Locators (URLs) clickstream to, through and from our NX Rewards website (including date and time); tickets and/or journeys you viewed or searched for; time on page, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs) and methods used to browse away from the page.

Please see our cookie policy which is available on our NX Rewards website for more information about how we use cookies.

We collect this personal data about you in a variety of ways, including:

·       by you creating an account with us;

·       by you using the NX Rewards website or through our other channels, including mobile apps;

·       by you submitting information via our NX Rewards website, for example via the ‘Contact Us’ page;

·       by you providing information to us when communicating with us in any manner, for example when you contact us by letter, email telephone call or on social media, such as when you telephone our customer contact centre;

·       by you entering one of our competitions or participating in post journey, market research and other surveys that we organise or conduct; and

·       by us recording telephone conversations with our customer contact centre representatives.

We use your personal data for the following purposes and reasons and, where those reasons are our legitimate interest, we inform you about what that legitimate interest is:

What we use your information for	Our reasons	Our legitimate interests
·       To provide you the NX Rewards Membership Service and benefits that you request. ·       To provide information and guidance about the NX Rewards Membership Service ·       To manage our relationship with you, including to respond to any questions you ask and deal with any complaints you make ·       To meet research and product/service development needs and to improve the website and the NX Rewards Membership Service ·       To detect and if necessary withhold you from re-enrolling into the NX Rewards Programme where your membership was terminated due to a breach of terms and conditions such as misuse of the NX Rewards Programme or fraudulent activity. ·       To seek to enforce and defend our legal rights ·       To comply with the laws and regulations that apply to us ·       To develop new or better ways to meet our customers’ needs, including by carrying out market research and consulting with you ·       To develop our strategy, operational processes and marketing activities	·       Fulfilling our legal duty ·       Fulfilling our contracts with you Our legitimate interest	·       Being efficient about how we fulfil our legal and contractual duties and manage our relationship with you ·       Keeping our business records up to date ·       Developing and improving our business ·       To improve our products and services for your continued enjoyment and to assist in the development of product and service enhancements and new products and services based on feedback received through customer communications to us Preserving our legal position
·       To ensure the proper functioning of the website ·       To ensure that the content of the NX Rewards website content is presented in the most efficient manner for customers by analysing behaviour and purchase history For data analysis, research statistical and survey purposes to improve customer experience	·       Our legitimate interest Consent (to our use of cookies)	• Providing an efficient means for customers to get information about the NX Rewards Programme.

Where we process any of your personal data on the basis of your consent you may withdraw that consent at any time.

Where you have consented to the use of cookies when visiting our NX Rewards website, you may withdraw your consent at any time by changing your cookie setting as explained in our cookie policy.

We have no legal obligation to collect personal data about you, but we need to collect some personal data in order to provide you with the NX Rewards Membership Services, collect payment for such services and deal with any questions or complaints you have about them.

You have no legal obligation to provide your personal data to us, but we may not be able to provide you with the NX Rewards Membership Services or deal with your questions or complaints if you do not provide us with your personal data.

We may share your personal data with:

·       our suppliers, sub-contractors and business partners who help us to provide benefits for the NX Rewards Membership Services to you, including our benefit suppliers, third parties who process payments to or from you on behalf of us, hosting companies, content providers and software and/or hardware vendors;

·       our legal and professional advisors;

·       government bodies and regulatory authorities, including the Police and other crime prevention and detection agencies, and the UK Information Commissioner’s Office;

·       the courts and other dispute resolution arbitrators and mediators and other parties to legal proceedings;

·       analytics providers that assist us in the improvement and optimisation of our NX Rewards website; and

·       other companies that take on any part of our business as a result of a restructure, merger or transfer of that part of our business.

When you follow a link to any of the websites of advertisers and affiliates that are on our NX Rewards website, these third party websites may have their own privacy notices or policies, and we do not accept any responsibility or liability for these notices or policies or the third parties’ handling of your personal data. Please check these notices or policies before you submit any personal data to these websites.

There may be occasions where it is necessary for us to transfer your personal data to a country outside of the European Economic Area (“EEA”).  It is possible that the country concerned may not be deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the EEA.

For the purposes stated below, we will transfer your personal data to:

·       Switzerland for the purposes of providing product management and support;

·       the United States of America for the purposes of, application maintenance and systems support and for the purposes of transaction and cashback tracking; and

·       the Philippines for the purpose of providing customer services in respect of NX Rewards.

Where we transfer your personal data to third parties who process your personal data on our behalf in countries outside the EEA that are not deemed to provide a similar level of protection for individuals’ rights in relation to their personal data as in the EEA, we have entered into appropriate contracts with those third parties based on the standard contractual clauses approved by the European Commission, a copy of which can be found here: http://eur-lex.europa.eu/legal-content/en/TXT/?uri=CELEX%3A32010D0087 or require the third party to process the personal data in accordance with that party’s Privacy Shield certification.  After transfer of your personal data outside the EEA, we ensure that third parties we contract with, are obliged to ensure that any other third party that receives your personal data either provides contractual guarantees in relation to your personal data, and/or has certified to an approved transfer mechanism.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements in respect of our relationship with you.

Where we process your personal data to fulfil:

·       a legal obligation, we will process such personal data for so long as necessary to fulfil that obligation; or

·       a contract with you, we will process such personal data until we fulfil that contract and for so long thereafter as may be necessary to keep a record of that contract, which will typically be for 6 years, and to deal with any complaints or claims relating to that contract, which will be until the final resolution of such complaints or claims (having regard to the nature of any potential claims and the limitation of liability periods that apply to them).

Where we process your personal data based on:

·       our legitimate interest, we will process such personal data for so long as necessary to achieve that legitimate interest, which will typically be for 6 years after we collect your personal data or the last time we use your personal data (or longer in relation to any legal claims that might arise having regard to the nature of any potential claims and the limitation of liability periods that apply to them); or

·       your consent in relation to:

.      cookies, we will process your personal data for the period stipulated in our cookie policy or, if earlier, until you withdraw that consent by changing your cookie settings or if we obtain your consent for any other use of your personal data (which is likely to be for a purpose that is not described in the policy above) we will give you further information in the consent form on how to withdraw and manage your consent.

We may also retain your personal data for longer if we cannot delete it for legal, regulatory or technical reasons.

You have a number of rights under the Data Protection Law in relation to your personal data.  These include the right, subject to exceptions, to:

·       request access your personal data;

·       request rectification or erasure of your personal data;

·       request restrictions on the processing of your personal data; and

·       object to our processing of your personal data.

You also have the right in some circumstances to receive a copy of your personal data in a portable format. This right is limited to personal data you have provided to us and is processed on the basis of your contract with us or your consent.  It does not cover personal data that we process on other grounds.

If you wish to exercise any of these rights and/or request a portable copy of the data that you have provided and is processed on these bases, please contact the National Express UK Data Protection Officer.

If you have any questions or complaints about how we process your personal data or otherwise about the matters set out in this privacy policy, please contact the National Express UK Data Protection Officer at:

●               Address: Data Protection Officer, National Express, National Express House, Birmingham Coach Station, Mill Lane, Digbeth, Birmingham B5 6DD

or

●               Email address: data.protection@nationalexpress.com

You also have the right to complain at any time to the UK Information Commissioner's Office about how we use your personal data by contacting them on their helpline: 0303 123 1113 or website.

Cookies are text files containing small amounts of information, which are downloaded by your internet browser and stored on your computer or other device when you visit the NX Rewards website if you agree.

The use of cookies on the NX Rewards website allows us to optimise your browsing experience. We are able to personalise offers that we provide to you and use measurement techniques on the NX Rewards website to understand what pages have been viewed, the type of activity users engage in on a specific webpage and how often they visit a certain webpage. The use of cookies also allows us to easily provide you with your cashback rewards.

We use the following cookies:

1. Striclty necessary cookies. These are cookies that are required for the operation of the NX Rewards website. They include, for example, cookies that enable you to log into secures areas of the NX Rewards website, automatically see your Cashback Rewards and take advantage of the main features of the NX Rewards Programme. Without these cookies, you could continue to browse the NX Rewards website but would not fully enjoy all of its features. These cookies are:
   

   Name	Purpose	Duration
   BID	Uniquely identifies members who navigate on our Website from their browser	Permanent (until removed by Member)
   PID	Defines the lists of retailers a Member of the WL Programme can access	Permanent (until removed by Member)
   LV	Used for viewing preferences of a Member	Permanent (until removed by Member)
   SESSION	For verification of the validity of a Member session on our Website	Duration of the session
   ASP.NET _SESSION id session	For verification of the validity of a Member session on our Website	Duration of the session
   ASPSESSIONIDSQRCRRSB SESSION	For verification of the validity of a Member session on our Website	Duration of the session
   WLSESSION	For verification of the validity of a Member session on our Website	Duration of the session
   JOIN EMAIL SENT	For verification of sending a join confirmation email to a new Member	1 year
   COOKIECONSENT	Used to avoid repetitively asking a user for their consent to use cookies on the website when they have already agreed.
   ASPXAUTH	Used to determine if a user is authenticated.	Duration of the session
   WL_MSG_CODE	Used to enhance the browsing experience of the Website	1 year
   CS_WIDGET

2. Analytical/performance cookies. These allow WL to recognise and count the number of visitors and to see how visitors move around on the Website when they are using it. This helps to improve the way the Website works, for example, by ensuring that users are finding what they are looking for easily. Refusal of these cookies does not affect your use of the Website. These cookies are mainly third party cookies such as Google’s:
   

   Name	Purpose	More Information
   _ga ; _gid ; _dc_gtm_ ; AMP_TOKEN ; _gac_<property-id> ; _utma ; _utmb ; _utmt ; _utmc ; _utmz ; _utmv ; _utmx ; _utmxx ; _gaexp.	To collect information about how users use our Website. The information is collected anonymously and is used in reports that are solely for the purpose of improving our website.	We use Google Analytics to provide these cookies. For more information, please review this privacy policy and Google’s privacy policy: http://www.google.co.uk/intl/en/analytics/privacyoverview.html For more information on the purpose and duration of Google Analytic cookies, please visit: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage  To disable Google Analytic cookies, please visit: https://tools.google.com/dlpage/gaoptout
   WRUID CT_DATA CT_RS	Used to anonymously collect information on how to navigate users on our Website to improve functionality and offer an optimised customer experience.	Clicktale: For more details on these cookies and their duration, please visit: http://www.clicktale.com/privacy_service.aspx (See Section 8 below)

3. Functionality cookies. These are used to recognise you when you return to the website. This enables WL to personalise content for you, greet you by your name and remember your preferences.
   

   Name	Purpose	Duration
   USER ID	To tell us if a user is already a member of our service.	Permanent (until removed by Member)

4. Targeting cookies. These cookies record your visit to the Website, the pages you have visited and the links you have followed. Currently, WL do not use targeting cookies and if WL do, WL will provide you with a list of such cookies. Targeting cookies would be used to make the Website and the advertising displayed on it more relevant to your interests.

Yes, you can easily refuse one or even all cookies. Please remember that by refusing cookies you may still use the NX Rewards website, but you may not be able to access all of the NX Rewards website’s functionality and your access may be limited particularly if you decline the use of strictly necessary cookies.

You block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including strictly necessary cookies) you may not be able to access all or parts of the NX Rewards website.

To learn more, please follow the directions provided in your internet browser’s “help” file or by visiting www.allaboutcookies.org.  We have also provided you above with the relevant links which explain how to delete third party cookies we use.

We may also use cookies to enable the use of advertising technology to serve you advertisements that we feel may be relevant to you when you visit search engines, the NX Rewards website and/or third party websites upon which we advertise.

This technology uses information about your previous visits to the NX Rewards website and the third party websites upon which we advertise to tailor advertising to you.  In the course of serving these advertisements, a unique third-party cookie may be placed or recognised on your browser to enable us to recognise you.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control.  These cookies are likely to be analytical/performance cookies or targeting cookies.  Please see the sections above to understand what third party cookies we use.

We use web beacons, provided by our ad serving partner, to help manage our online advertisements, mainly conducted through banner advertisements. These web beacons allow us and/or our ad serving partner to access individual cookies when a browser visits the NX Rewards website.  This allows us to identify which advertisements or listings served by our ad serving partner bring users to the Website and to count the numbers of visitors to the Website.

Web beacons are tiny graphics with a unique identifier, similar in function to cookies, and are used to track the online movements of the users of the NX Rewards website. In contrast to cookies, which are stored on a user's computer hard drive, clear gifs are embedded invisibly on the NX Rewards website and are about the size of the period at the end of this sentence.

Like many websites, we gather certain information relating to use of the NX Rewards website automatically and store it in log files. This information includes internet protocol (IP) addresses, browser type, internet service provider (ISP), return/exit pages, operating system, date/time stamp and clickstream data. We use this information, which does not by itself identify individual users, to analyse trends, to administer the NX Rewards website, to track users' movements around the NX Rewards website and to gather demographic information about the user base as a whole.

In order to analyse the behaviour of the visitors on the NX Rewards website, we are likely to use some customer experience analytics service. Through these technology, we do not collect or transfer any personal identifiable information, using them only to record, on a completely anonymous basis, information such as mouse clicks, mouse movements, scrolling activity as well as non-Personally Identifiable Information text you type in the NX Rewards website.

We are, for instance, using at the moment the ClickTale customer experience analytics service. ClickTale does not create a user profile for the purpose of tracking a user across unrelated web sites and will only use such information pursuant to its Privacy Policy (located at http://www.clicktale.com/privacy_service.aspx). You can choose to disable the ClickTale service at http://www.clicktale.net/disable.html