Privacy Policy

1. Who we are

This Privacy Notice explains how Red Line Buses Ltd and Red Rose Travel Limited collect, use, retain and share personal information.

The two companies are separate legal entities and separate bus operators.

For information relating to a particular bus service, ticket, complaint, incident or vehicle, the data controller will normally be the company operating that service or dealing with that transaction.

For shared Red Group website functions, accounts, customer enquiries and other activities operated for the benefit of both businesses, personal information may be processed by both companies. Where both companies jointly determine how and why such information is processed, they act as joint controllers.

You may exercise your data-protection rights by contacting either company. We will ensure that your request is dealt with by the appropriate controller.

Redline Buses

Red Line Buses Ltd
Company number 08758110
International House
3 Griffin Lane
Aylesbury
Buckinghamshire
HP19 8BP

Red Rose Travel

Red Rose Travel Limited
Company number 02945744
Blinking Owl Garage
Oxford Road
Haddenham
Aylesbury
HP17 8TT

You can also contact us through the online contact form on the Red Group website. For privacy-related matters, please select or state “Data Protection / Privacy” when contacting us.

2. Data-protection law

We process personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations.

3. Information we may collect

Contact information

  • name
  • postal address
  • email address
  • telephone number
  • preferred method of contact

Ticket and account information

  • tickets and passes purchased
  • ticket validity and activation information
  • account details
  • journey or route information
  • season-ticket information
  • student or child-ticket eligibility information
  • concessionary travel information where relevant
  • transaction references
  • information relating to replacement, cancelled or refunded tickets

Website and app information

  • IP address
  • device and browser information
  • login and account activity
  • website pages viewed
  • journey searches
  • favourite stops, routes or journeys
  • cookie identifiers
  • security logs
  • information about how our digital services are used

Customer enquiries, complaints and feedback

  • the content of your enquiry or complaint
  • route, vehicle and journey information
  • correspondence between you and us
  • information provided by relevant employees
  • photographs or supporting documents
  • CCTV or audio recordings where relevant
  • information about the investigation and outcome

Payment information

Payments may be handled by third-party payment providers. We do not normally receive or store your complete payment-card number, security code or online banking credentials. We may retain transaction references and information about the amount, date and status of a payment for accounting, customer-service and fraud-prevention purposes.

Accessibility information

If you ask for assistance or raise an accessibility matter, you may choose to provide information about a disability, health condition, mobility requirement or other accessibility need. We will only use this information where necessary to deal with your request, provide appropriate assistance, investigate an incident or meet our legal obligations.

CCTV and audio recordings

CCTV systems operate on our vehicles and may also operate at our premises. Our buses contain multiple CCTV cameras. Not all cameras record audio.

Certain audio-enabled cameras are situated at the front of the vehicle, including in or around the driver’s cab and front passenger interaction area. These cameras record audio as well as video because spoken interactions may form important evidence when investigating assaults, threats, abusive behaviour, suspected criminal activity, serious complaints, safety incidents and road traffic collisions.

Other CCTV cameras on the vehicle may record video without audio. Depending on the camera and incident, recordings may include your image, your voice, conversations with the driver or persons in the immediate area, the date and time, the vehicle and journey concerned, and events occurring onboard or around the vehicle.

Our principal lawful basis is our legitimate interests in protecting passengers and employees, maintaining safety and security, investigating criminal and safety incidents, investigating road traffic collisions and establishing or defending legal and insurance claims.

Routine CCTV and audio recordings are normally retained for approximately three weeks (21 days) and are then automatically overwritten. Relevant footage may be extracted and kept for longer where required for a specific accident, road traffic collision, complaint, criminal investigation, police request, insurance claim, legal proceeding or other legitimate investigation. Further information is provided in our CCTV and Audio Recording Policy.

Lost property information

When dealing with lost property we may collect your name, contact information, a description of the property and information required to establish ownership.

Incident and insurance information

Where an accident, injury, crime, safety incident or insurance matter occurs, we may collect information about the incident and the people involved. This may include health information or information relating to alleged criminal activity where relevant and lawful.

Recruitment information

If you apply to work for us, we may process information including your employment history, qualifications, driving licence and entitlement information, contact details, references and other information supplied as part of the recruitment process. A more detailed recruitment privacy notice may be provided where appropriate.

4. How we obtain information

  • directly from you
  • through our website or app
  • when you buy or use a ticket
  • from our drivers and other employees
  • from CCTV and onboard recording systems
  • from ticketing and payment providers
  • from local authorities and concessionary travel schemes
  • from schools or colleges where relevant to school travel
  • from insurers, legal advisers or claims handlers
  • from the police or other public authorities
  • from witnesses to an incident
  • from other organisations where the law permits

5. Why we use personal information and our lawful bases

Providing transport and ticketing services

We use information to sell and administer tickets, manage accounts, provide bus services, deal with refunds and provide customer support. Our lawful basis will normally be that processing is necessary to perform a contract with you or take steps at your request before entering into a contract.

Customer service and complaints

We process information to answer enquiries, investigate complaints, resolve disputes and improve our services. Depending on the circumstances, our lawful basis is performance of a contract, compliance with a legal obligation or our legitimate interests in operating and improving our services and resolving complaints fairly.

Safety, security, CCTV and audio

We use CCTV and audio recordings to protect passengers, employees and the public; prevent and investigate crime and antisocial behaviour; investigate violence, threats and abuse; investigate accidents and safety incidents; investigate significant complaints and disputes; protect vehicles, premises and other property; establish what occurred during an incident; and support legal or insurance claims. Our principal lawful basis is our legitimate interests in maintaining safety and security and in establishing and defending legal rights.

Fraud and misuse

We may use personal information to detect and prevent ticket fraud, payment fraud, misuse of accounts and other unlawful activity. Our lawful basis is normally our legitimate interests and, where applicable, compliance with legal obligations.

Legal and regulatory requirements

We may process information where necessary to comply with legislation, regulatory requirements, court orders or lawful requests made by competent authorities. Our lawful basis is compliance with a legal obligation or another lawful basis permitted by data-protection law.

Website security and operation

We process technical information to maintain the security, availability and performance of our website, app and computer systems. Our lawful basis is normally our legitimate interests in maintaining secure and effective digital services.

Analytics

Where consent is required, analytics technologies are only used with your consent. Where a specific statutory exception permits limited statistical technologies to be used without consent, we will only rely on that exception where all applicable requirements have been met.

Marketing

Where we send electronic direct marketing that requires consent, we will obtain appropriate consent. You may withdraw marketing consent at any time.

6. Special-category and criminal-offence information

Some information, including information about health or disability, receives additional protection under data-protection law. We only process this information where an additional lawful condition applies. For example, this may include circumstances where you have expressly provided information so that we can arrange accessibility assistance, where processing is necessary in connection with legal claims, or where another condition under data-protection legislation applies.

We may process information relating to alleged or actual criminal activity where this is necessary and lawful, for example when investigating theft, assault, criminal damage, fraud or other incidents and when cooperating with law-enforcement authorities.

7. Who we share information with

  • the other Red Group operator
  • website, hosting and IT providers
  • app and ticketing-system providers
  • payment processors
  • email and communications providers
  • local authorities
  • concessionary travel authorities
  • schools and colleges where relevant
  • insurers and claims handlers
  • solicitors and other professional advisers
  • auditors and accountants
  • the police and other law-enforcement bodies
  • courts and tribunals
  • the Driver and Vehicle Standards Agency
  • Traffic Commissioners
  • government departments
  • regulators, including the Information Commissioner’s Office
  • other organisations where disclosure is required or permitted by law

Service providers processing personal information on our behalf are required to protect it appropriately. We do not sell passenger personal information to advertisers.

8. International transfers

Some technology or service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we will ensure that an appropriate legal safeguard is used where required. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another lawful safeguard.

9. How long we keep information

CCTV and audio recordings

Routine vehicle CCTV and audio recordings are retained for approximately three weeks (21 days) and are then automatically overwritten. Recordings may be extracted and kept for longer where necessary for an accident, road traffic collision, complaint, police investigation, insurance claim, legal proceedings, disciplinary matter or other specific investigation. Extracted footage is retained only for as long as reasonably necessary for that purpose.

Ticket and financial transaction records

Relevant transaction and accounting records may normally be retained for up to six years or longer where required by tax, accounting or legal requirements.

Customer enquiries

Routine enquiries will normally be retained for up to 12 months after the matter is closed unless there is a reason to retain them for longer.

Complaints

Complaint records will normally be retained for up to three years after closure. Where a complaint involves an accident, injury, potential legal claim, serious safety matter or other significant dispute, information may be retained for up to six years or for another period appropriate to the circumstances.

Lost property

Lost-property enquiry information will normally be retained for up to 12 months after the matter is concluded unless there is a particular reason to retain it for longer.

Online accounts

Basic account information may be retained while an account remains active and for a reasonable period after closure or inactivity. Transaction information associated with the account may be retained for longer where required for financial or legal purposes.

Marketing

Marketing contact information is retained until consent is withdrawn or the information is no longer required. We may retain a minimal suppression record after an opt-out so that we can respect the person’s preference not to receive further marketing.

10. Security

We use appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, loss, disclosure or destruction. Access to personal information is restricted to employees, contractors and service providers who require access for an authorised purpose.

11. Your rights

  • ask for access to personal information held about you
  • ask us to correct inaccurate information
  • ask us to erase information
  • ask us to restrict processing
  • object to particular processing
  • receive certain information in a portable format
  • withdraw consent where processing is based on consent
  • raise a complaint about how we have used your personal information

These rights are not absolute and exemptions may apply. We may need to verify your identity before responding to a request.

12. CCTV subject access requests

If you wish to request CCTV or audio relating to yourself, please contact us as soon as possible because routine footage is overwritten after approximately three weeks.

  • date
  • approximate time
  • route
  • direction of travel
  • boarding or alighting point
  • vehicle registration or fleet number if known
  • a description that will help us locate your image

Footage may contain information relating to other people. We may need to redact images or audio or restrict disclosure where permitted by law.

13. Data-protection complaints

If you are unhappy about how we have used your personal information, please raise a data-protection complaint with us first. You can do this electronically using our online contact form. Please select or state “Data Protection / Privacy”. You can also write to the registered office of the relevant company.

  • provide a clear means of making a data-protection complaint
  • acknowledge receipt within 30 days
  • take appropriate steps to investigate the matter without undue delay
  • keep you appropriately informed
  • tell you the outcome without undue delay

A data-protection complaint is separate from an ordinary passenger-service complaint or a request to exercise a data-protection right. If you remain dissatisfied after giving us an opportunity to deal with your complaint, you have the right to complain to the Information Commissioner’s Office (ICO).

14. Children

Children and young people use many of our services, including school and college services. We will handle children’s information with particular care and will only collect information that is reasonably required for ticketing, travel, safety, customer service or another legitimate purpose. We will not knowingly use children’s personal information for inappropriate marketing or profiling.

15. Changes to this notice

We may update this Privacy Notice to reflect changes in our services, technology or legal obligations. The current version will always be published on the Red Group website with the date it was last updated.