This privacy notice applies to you if you are an individual who applies for employment with a Company under the Group, which is established in the ROI. Irrespective of the role that you apply for and the method by which you apply.

In particular, it applies both to individuals who apply for employment by contacting us directly and those who are introduced to us by recruitment agencies.

This privacy notice explains what personal data we collect about you when you are applying for employment and what we do with it. It also explains your rights in respect of your personal data, and it informs you what to do if you have any questions or complaints about our use of your personal data.

We take your privacy seriously and are committed to abiding by the relevant data protection laws, which protect your privacy.

This privacy notice may change from time to time, and the most up-to-date version will always be available on the website. It is your responsibility to read this privacy notice and check the website for the current version.

The Group company, for which you are applying for employment, is the Data Controller of your personal data that is collected for the purposes explained in this privacy notice.

This will be one of the following named Group companies that is specified in the job vacancy, or which you are otherwise made aware of, during the application process:

• Mobico Group PLC

• National Express Bus & Coach Services Limited (trading as Dublin Express)

• National Express Transport Services Ireland Limited

• Airside Transport Services Limited

The data controller’s representative for the purposes of this privacy notice is the Data Protection Officer (DPO) (Ireland), who can be contacted using the contact details set out at the end of this notice. With the exception of Mobico Group PLC, you need to refer to the Job Application Notice for the United Kingdom. This notice does not apply to Mobico Group PLC.

We collect certain information about you that we need to process your employment application, including:

• your name, your date of birth, your home address, any personal email address and your home and/or mobile telephone number;

• your professional and/or vocational qualifications, your work experience and references about you and your aptitudes as an employee;

• evidence of your right to work in the ROI, which may include your passport details or work visa details;

• if you are applying for a role as a PCV driver, your PCV driver licence details, your driver qualification card details and, if relevant, your digital tachograph card details;

• your national insurance number; and

• your bank or building society account details.

In addition, depending on the role you are applying for employment in, we may collect additional information about you that we also need to process your employment application, which includes:

• any criminal record you have and/or any past spent or unspent convictions;

• confirmation whether you were previously employed for a Group company, we will use this data to assess against the datasets that we hold;

• certain information about your medical history and the results of any pre-employment health checks that we ask you to undertake; and

• the results of any pre-employment drug and alcohol tests we ask you to undertake.

We collect this information in a variety of ways, including:

• during the job application process, in which you (or the recruitment agency who introduces you to us) will provide us with such information, including by submitting information online via our website or a dedicated HR portal or by sending information by email or in hard copy form or submitting it orally during interviews or other recruitment related meetings;

• from third parties who provide references about you, including your current and former employers;

• from governmental bodies and regulatory agencies, such as the National Driver Licence Service (NDLS), with whom we perform checks on you; and

• from third parties who perform recruitment related services on our behalf, such as any recruitment agency who introduces you to us and third parties who carry out pre-employment checks on our behalf, including in relation to criminal records, medicals and drugs and alcohol tests.

We process personal data about you for the following purposes:

• processing your employment application, including to assess whether you are qualified and otherwise suitable and fit for the role you have applied for and whether you will be able to adhere to the values held and promoted by the Mobico Group;

• managing and seeking to develop and improve our employment application processes and procedures;

• monitoring the overall level of interest in employment vacancies and opportunities and carrying out analysis on these; and

• if you consent, contacting you about other employment vacancies or opportunities that arise we think may be of interest to you.

We will always process your personal data fairly, lawfully, transparently and:

Collect personal data for a specified, explicit and where applicable for a legitimate and compatible purpose;

The personal data will be adequate, relevant and limited to the purposes for which it is processed;

You and the Data Controller will ensure that the personal data is accurate and, where necessary, kept up to date;

Kept in a form which permits identification of a data subject, (you) for no longer than is necessary unless we record a legal, regulatory or legitimate purpose to extend the retention of the data; and

We will ensure appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.

You are not obliged to provide us with personal data about yourself, but if you do not, we may not be able to process your employment application.

We have a lawful basis to collect and process certain personal data about you, for example, to determine your right to work in the ROI and to ascertain your professional or vocational credentials to perform certain types of work, for example if you are applying for a role as a driver, whether you hold a valid PCV driving licence. We process your personal data where we have a lawful basis to do so and we have different lawful basis we can use under the GDPR:

When receiving and processing your application and any supporting information from you as the source or from a third party we have the above lawful basis to rely on. We also will retain and process this personal data

If you have any questions or want to exercise your rights under GDPR please contact the Data Protection Officer (DPO) (Ireland) noted below.

You may withdraw your consent of the processing of your personal data for the above purposes where “Consent” is relied on. The Company as a Data Controller, will determine if the withdrawal of consent can be accepted. There are occasions when a Company has to retain data for legal, regulatory, employment or pre-employment purposes which may override your objection. This will be determined on a case by case basis.

We will share your personal data with third parties where we are legally obliged to do so, for example with government bodies, regulatory agencies and the courts or parties to legal proceedings before the courts.

We may share your personal data with other Group companies, for example, those which are involved in processing employment applications on our behalf. With your consent, we will also share your personal data with other Group companies that have other employment vacancies that may be of interest to you.

We may also share your personal data with third parties who provide services to us or other Group companies, such as our professional advisors, those who assist us in administering job applications, and other third parties that we use to perform other processing activities, such as IT and telecommunications service providers. In particular, if you apply for employment with us through a recruitment agency, we will share your information with that recruitment agency.

The other Group companies and/or third parties who process your personal data on our behalf may do so in countries outside the UK, European Union (EU) and/or European Economic Area (EEA). When doing so the transfer of your personal data will be governed by a contract, adequacy regulations under Data Protection Legislation that the territory provides adequate protection for the privacy rights of individuals. Appropriate safeguards will be in place. Where applicable data transfer agreements/contracts will be recorded. Where restructuring, mergers or transfers of Group Companies take place we may share your personal data with these entities.

We will process your personal data for so long as you are involved in the job application process with us and thereafter for different periods of time as explained below.

• If you apply for a role and are successful and proceed to take up that role, we will retain all the personal data we collect about you during the job application process in your file and we refer you to the Workforce Privacy Notice (ROI) for further information about how, and for how long, we process your personal data once you are an employee.

• If you apply for a role and are not successful, we will retain all the personal data we collect about you during the job application process for a period of twelve (12) months in case any questions, complaints or legal claims about the process arise, and for so long thereafter as necessary to deal with any such questions, complaints or claims which do arise.

You have a number of rights in relation to your personal data. These include the right, subject to exceptions, to:

• to be informed;

• access your personal data;

• request the rectification or erasure of your personal data;

• for data portability;

• automated decision making including profiling;

• request restrictions on the processing of your personal data; and

• object to our processing of your personal data.

Please contact the Data Protection Officer (DPO) (Ireland) (details below) if you wish to exercise any of these rights.

You also have the right in some circumstances to receive a copy of your personal data in a portable format. This right is limited to personal data that you have provided to us and is processed on the basis of your consent or to prepare for a contract with you. It does not cover personal data that we process on other grounds.

Please contact the person with whom you had the primary contact in relation to your employment application to request a portable copy of the data that you have provided that is processed on these bases.

If you have any questions or complaints about how we process your personal data or otherwise about the matters set out in this privacy notice, you should contact the Data Protection Officer (DPO) (Ireland) at:

• Address: Data Protection Officer (Ireland), National Express, National Express House, Birmingham Coach Station, Mill Lane, Digbeth, West Midlands, B5 6DD

or

• Email address: data.protection@nationalexpress.com

You have a right to complain to the Data Controller by emailing the DPO, detailed above. On completion and conclusion of your complaint, if you are still dissatisfied that the Data Controller has not met the obligations set out under GDPR you have a right to complain to the Data Protection Regulator, the Data Protection Commission. The regulator details:

• Telephone - (01) 765 01 00 or 1800 437 737

• Web Form - https://forms.dataprotection.ie/contact

Group companies will carry out criminal record checks that are proportionate and relevant to the position applied for. All employees and potential employees will be treated fairly and will not be unfairly discriminated against on the basis of a conviction or other information revealed.

Where offences or information is revealed that is relevant to the position Group companies will have an open and measured discussion with the individual to assess the situation before making a decision on future employment.

Failure to disclose information that is directly relevant to the position applied for could lead to the withdrawal of an offer of employment.

Group companies comply with the National Vetting Bureau (NVB) Check (Standard).