Partner Portal – Privacy Fact Sheet

1. Who is responsible for personal data?
For the JustRide Partner Portal:
•    Your organisation (the Partner) and First Bus act as independent Data Controllers for the personal data relating to your scheme 
•    Masabi act as a Data Processor for First Bus, processing data on our behalf in line with contractual agreements.

2. What personal data is processed?
The platform processes limited personal data necessary to operate your scheme, including:
•    Customer identifiers (e.g. name, email, phone number)
•    Eligibility and discount scheme data
•    Ticket purchase and usage history

When an individual signs up for a First Bus app account, they are provided with full transparency information via our First Bus customer privacy policy.

3. Where will our organisation’s personal data be processed?
•    Personal data that our partners provide directly to us is processed within the Masabi JustRide Partner Portal
•    Data is stored securely in AWS cloud infrastructure located in Dublin, Ireland. 
•    Processing takes place within UK/EEA-aligned environments, and contractual obligations prevent Masabi from making any restricted transfers.

4. How is the data used?
Personal data is used only to administer your ticketing or discount scheme and verify eligibility.

5. Who can access the data?
Access is tightly controlled:
•    Your authorised staff can access only the data relevant to your scheme
•    First Bus customer service and operational teams may access data to support customers

All access is governed by:
•    Role-based access controls
•    User authentication (including MFA where available)
•    Audit logging of activity

6. How is data kept secure?
Require security measures are set out in our contract and include:
•    Encryption of data in transit and at rest
•    Secure cloud hosting aligned to ISO 27001 standards
•    Network security protections and monitoring
•    Regular penetration testing and security reviews
•    Incident response and backup procedures

7. How are individuals’ rights supported?
The platform supports all key data protection rights, including:
•    Access to personal data
•    Correction of inaccurate data
•    Deletion or restriction of processing
•    Data portability (where applicable)

Requests are handled through customer services using secure reporting tools. 

8. Where can we get more information?
Further information can be provided through:
•    Data Sharing agreements with First Bus
•    First Bus customer privacy notices
•    Data protection contact: FirstBus.dpo@firstgroup.co.uk