What is a Privacy Policy?

In order for Tower Transit to achieve our vision of being the best and most respected provider of London bus services we value the importance of appropriately processing personal data and keeping data secure. In our operations, we process personal data about our passengers, visitors to our website, members of the public and our suppliers.

This Privacy Policy sets out important information about our data processing activities. We encourage you to take the time to read the contents of this Privacy Policy so you can better understand what personal data we process, why we process it, what happens to your personal data and what rights you have in relation to your personal data. It applies to the processing of personal data in relation to services provided by Tower Transit which includes the operation of the Tower Transit website: https://www.towertransit.co.uk/

When we refer to “Tower Transit”, “us”, “we” or “our” what we really mean is Tower Transit Operations Ltd, a company registered in England and Wales with company number 08314506 and whose registered office is at No1 London Bridge London SE1 9BG. Tower Transit is a Controller of your personal data. You can contact us by emailing

It is important that you read this policy together with any other privacy notice or fair processing notice we may provide at the point of collecting or processing your personal data. This policy supplements those notices and is not intended to override them. However, it does supersede earlier versions of this Privacy Policy.

What personal data does Tower Transit collect?

When we refer to “personal data” we mean information about an individual from which that person can be identified, this does not include anonymous data where identifying information has been removed.

Types of personal data we collect

We process different types of personal data depending on who you are.

I am…	We collect your personal data…
A passenger	When you use one of our buses: We collect CCTV images of you on and around our buses and at our depots (CCTV Data) We may incidentally collect audio recordings of you from a microphone placed above our drivers’ assault screens (Audio Data) We collect your contact details (including your full name and address) if you have left personal belongings on one of our buses, or if you have found someone else’s personal belongings on one of our buses (Lost Property Data). If you are involved in an accident involving one of our buses we collect your contact details (including your full name, telephone number, address, vehicle details, age and email address) and we collect details of the accident (including [the time and date of the accident and the circumstances of the accident]) (Accident Data) If you have a complaint about how our buses are operated, we collect your full name, email address and telephone number (Complaint Data) We may collect special categories of personal data about you if you are involved in an accident involving one of our buses or if you make a complaint to us.  This may include data relating to your health, medical conditions or disability (Special Data)
A member of the public	If you: Witness an accident involving one of our buses we collect Accident Data from you Have a complaint about how our buses are operated, we collect Complaint Data. Claim lost property on someone’s behalf, we collect your name and address (Claimant Data). Phone us or our control room, we may monitor and record your call (Telephone Data) Visit one of our depots we collect CCTV Data
A visitor to our website	When you visit our website, we process information about how you use our website, for example we process personal data about your internet browser, operating device and application identifiers, IP address and geo-location information, access times and dates, referring and exit pages, URLs, clickstream data, search items, pages viewed and time spent on pages (Website Data)
A third party supplier	If you: Work for one of our third party suppliers, or if you work with us to help us provide our services, we process personal data about you and colleagues that we work with in order to help us facilitate the provision of services.  This includes your full name, email address, contact telephone number and job title (Supplier Data) Are on and around our buses and at our depots we collect CCTV Data

Where we get your personal data from

We collect information about you from different sources, including:

1. From you directly
   1. when you correspond with us by post, phone, email or otherwise;
   2. when you complete one of our lost property forms or accident forms; and
   3. when you use our website.
2. From a third party
   1. from Transport for London, if you make a complaint to them about how our buses are operated or if you contact them about lost property left on one of our buses; and
   2. from someone else, if you have left personal belongings on one of our buses and someone hands it in to us.

We try to be sure that the personal data we hold about you is accurate, and so please get in touch with us if your personal data changes so we can update our records. You can contact us using the details provided in this Privacy Policy.

Children

Our website is not intended for use by children, and we do not knowingly process personal data through our website that relates to children.

As a public transportation operator, we do process children’s personal data from time to time. For example, if they are a passenger on one of our buses they may appear on CCTV footage, or if they are involved in an incident we may collect personal data about them in order to investigate the incident appropriately.

If you would like more information about our processing of children’s personal data, please contact us at

CCTV

We operate CCTV cameras in all of our buses and in our depots, and we operate intermittent audio recording in and around our drivers’ cab area.

We use the footage and audio captured to ensure the safety of all drivers, passengers and members of the public, to investigate collisions and incidents involving our buses, to prevent, detect or investigate crime, and to assist with the apprehension and prosecution of offenders.

We can retrieve footage for up to 10 working days or 240 operating hours from the date of the incident, whichever is sooner. After this time, the footage is recorded over unless we need to retain it for investigations.

There may be circumstances where we disclose footage captured by our CCTV cameras and audio recording device.  This includes where statutory provisions or a court order imposes a mandatory duty to disclose, or where statutory provisions impose upon us discretion as to whether to disclose the footage. A member of senior management considers disclosure requests on a case by case basis.

Ticketing

When you pay to use one of our buses you “tap in” to a Transport for London operated payment system. This system provides us with a report that tells us that a payment has been made at a particular time by a particular payment method (i.e. oystercard, travelcard, credit/debit card or a bus pass).

We do not have control over the personal data processed by this payment system and we do not collect personal data from it. To find out more about how Transport for London processes your personal data when you use their services and make a contactless payment, please visit their website: https://tfl.gov.uk/corporate/privacy-and-cookies/

Why does Tower Transit need to process my personal data?

There are a number of reasons why we process your personal data. We have summarised the reasons within the table below.

Purpose	Types of Data	Lawful Basis for Processing
To comply with our obligations as an operator of public transport services	CCTV Data, Audio Data, Complaint Data and Accident Data	Necessary for our legitimate interests (to operate a public transportation service, to ensure the safety and security of our passengers, for running our business)
To ensure the safety of passengers, drivers and members of the public	CCTV Data and Audio Data	Necessary for our legitimate interests (to ensure the safety and security of our passengers and drivers and members of the public, to prevent and detect crime, to assist with investigating complaints and for the apprehension and prosecution of offenders) Necessary to comply with our legal obligations
To collect, store and return personal belongings left on our buses	Lost Property Data, Telephone Data and Claimant Data	Necessary for our legitimate interests (for customer services, to operate a public transportation service, to restore lost property to individuals, and for administrative purposes)
To record, manage and resolve complaints	Complaint Data, Telephone Data and Special Data	Necessary for our legitimate interests [(to ensure the safety and security of our passengers, drivers and members of the public, for insurance purposes, to operate a public transportation service and for administrative purposes)] In terms of Special Data, it is additionally processed: – with your explicit consent; – to protect your interests (or someone else’s interests) if you are not capable of giving consent; – where you have already made the information public; or –  in connection with legal claims.
To record and manage accidents on or involving our buses	Accident Data and Special Data	Necessary for our legitimate interests [(to appropriately deal with complaints, for insurance purposes, to operate a public transportation service and for administrative purposes)] Necessary to comply with our legal obligations In terms of Special Data, it is additionally processed: – with your explicit consent; – to protect your interests (or someone else’s interests) if you are not capable of giving consent; – where you have already made the information public; or –  in connection with legal claims.
To administer and protect our business and our website (for example, to facilitate the provision of our services, for troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	Website Data and Supplier Data	Necessary for our legitimate interests (to operate a public transportation service, provision of administration and IT services, network security and in the context of a business reorganisation or group restructuring exercise) Necessary to comply with our legal obligations
To comply with requirements imposed by law or any court order	CCTV Data, Audio Data, Lost Property Data, Complaint Data, Claimant Data, Accident Data and Website Data	Necessary to comply with our legal obligations

We may process your personal data for a different purpose than that listed above and without your consent where it is necessary for us to comply with our legal obligations.

If you would like further information about the specific legal basis for our processing of your personal data, please get in touch with us.

Our Website and Cookies

Our website may include links to third party websites, plug-ins or applications that allow third parties to collect or share your personal data. We have no control over the processing activities of these third party websites, and so when you leave our website, please read the privacy notice of every website you visit.

Our website may automatically collect data about how you use our website in order to help us improve future functionality. This may include personal data. Please read our cookie policy to get further information about the cookies we use.

What does Tower Transit do with my personal data?

We use your personal data for the purposes set out above. This might mean that we have to share your personal data with third parties, including:

• Transport for London – to whom we share information to assist with investigations involving our services, and to whom we send lost property left on our buses;
• insurance companies in relation to incidents involving our buses. These insurance companies are based inside the EEA;
• our professional advisers, such as our auditors and solicitors. These advisers are based in England;
• if we choose to restructure our business we may share your personal data with third parties who we choose to sell, transfer or merge parts of our business and assets with, or who we seek to acquire or merge with. New owners of our business may use your personal data in the same way as set out in this Privacy Policy; and
• other legal, regulatory, judicial and law-enforcement agencies who we may need to share personal data with to comply with our legal obligations.

These third parties are required to respect the security of your personal data and treat it in accordance with the law.  They can only use your personal data in connection with the services we provide to you.  We do not allow them to use your personal data for their own purposes unless it is incidental to the services they are providing to you on our request.

Transfers outside of the EEA

Whilst the Tower Transit group provides services in England, and Singapore, the personal data we process in England remains within the EEA.  We do not transfer personal data outside of the EEA.

How long does Tower Transit process my personal data for?

Under data protection laws, we cannot retain your personal data in a form that identifies you for longer than is necessary to fulfil the purposes for which we collected it. This may include for the purposes of satisfying any legal, accounting or reporting requirements.

We usually store personal data for up to 7 years, but there may be occasions where we need to store it for longer or shorter periods.  For example, we usually store CCTV and audio footage for 10 days or 240 hours unless it captures an incident that we investigate which involves a child, in which case we may keep this footage until they turn 21 years old.  In order to determine how long we store your personal data for, we take into consideration why we need to continue to store your personal data, whether we can achieve the same result without having access to your data, and what the potential risk is if there is a data breach that affects your data.

Occasionally we may anonymise data which means that it is no longer associated with you. We do this for statistical or research purposes so we can improve the services we offer to you.  We can use anonymous data indefinitely without further notice to you.

How does Tower Transit keep my personal data secure?

Once we have received your personal data we will use reasonable and necessary procedures and security features to try and prevent unauthorised access.  For example, we limit access to personal data to those employees, agents, contractors and other third parties who have a business need to know. They are only allowed to process personal data in accordance with our instructions, they are required to keep all such data secure, and they are subject to a duty of confidentiality.

If we become aware of a data breach that affects personal data, we will notify the Information Commissioner’s Office.  If we believe the data breach is serious, we may notify you in accordance with our legal requirements.

What RIGHTS DO I HAVE?

People who are in the European Union have the right to:

• ask us for details of the personal data we hold and process about them (this is usually called a subject access request);
• ask that any inaccurate information we hold about them is corrected;
• ask that we delete personal data we hold about them (this applies only in certain circumstances);
• ask that we stop using their personal data for certain purposes;
• ask that we do not make decisions about them using completely automated means;
• withdraw their consent;
• ask that we give them the personal data we hold about them, or (where technically feasible) that we give this personal data to a third party chosen by them, in a commonly-used machine-readable format; and
• complain to a Member States’ supervisory authority for data protection issues. Before exercising this right, we encourage you to contact us first to resolve any complaint you may have, although this is not legally required. In the UK, the supervisory authority is the Information Commissioner’s Office at Water Lane, Wycliffe House, Wilmslow, Cheshire SK9 5AF. Further details can be found at: ico.org.uk

Please be aware that the above rights are not available to everyone all the time.  Some are subject to exemptions, and so we may not always be able, or required, to comply with your request to exercise these rights.  You can read more about the rights that you have on the ICO website: https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

To exercise any of the rights above please contact us using the details in this Privacy Policy.  If you do so, please provide us with as much information as you can about the request you want to make to help us respond as soon as we can.  You might need to provide us with proof of identity (for example a passport or driving licence) before we can fully respond, as we need to be sure we are giving the correct personal data to the correct individual.

We usually respond to data protection requests within one month, but it can take longer if your request is particularly complex or if you have made a number of requests.  You will not usually have to pay a fee to exercise the rights above, but we reserve the right to charge a fee if your request is clearly unfounded, repetitive or excessive; alternatively, we may refuse to comply with your request.

We may need to process your personal data in order for us to respond to your request.

Who can I contact about Tower Transit’s processing of my personal data?

At Tower Transit we work hard to ensure that we process personal data in compliance with data protection laws.  We know that sometimes you might want to ask questions about our processing activities and so please contact us by emailing

We reserve the right to update this policy to reflect any changes to the way in which we collect, process or share your personal data, or to reflect any legal requirements. When we make any changes, we will upload the new version to our website. The new version will take effect as soon as it is uploaded.

We last updated this Privacy Policy in June 2022.