Great Rail Journeys Ltd ("we", "our", "us" or "GRJ") understands and respects the importance of your privacy and we are committed to safeguarding your personal information. In providing www.greatrail.com (the/our "Website") and our services to you, we must collect personal information from you and this policy outlines how we treat your personal data after it has been collected by us via channels which include our Website, call centre and any future digital services or channels as they evolve.
For the purposes of the Data Protection Act 1998 or any replacement legislation including the EU General Data Protection Regulation (together, the "Data Protection Legislation"), Great Rail Journeys Limited, Saviour House, 9 St. Saviourgate, York, YO1 8NL is the data controller.
1. WHAT INFORMATION WILL WE COLLECT?
When you visit or request services via our Website, or contact us via email, our call centre, letter or otherwise, we may collect all or some of the following information relating to you or other members of your party:
- names and contact/address details including telephone number and email address;
- credit/ debit card or other payment details (including card number, cardholder name, expiry date, and billing address);
- special requirements such as those relating to any disability or medical condition which may affect the chosen arrangements;
- dietary restrictions (which may disclose your religious beliefs).
We will also collect your name and email address when you sign up to receive our newsletter.
Some of the above information is collected and processed so that the contract with you can be performed, some for the purpose of legal compliance and some for the purposes of our legitimate business interests (subject to your rights), namely to analyse the use of our Website and services in order to continually improve our business and services.
You are responsible for ensuring that other members of your party are aware of the content of this policy and consent to your acting on their behalf in all your dealings with us.
Some of the information we collect (such as about health or religion) may be considered "sensitive personal data" under the Data Protection Legislation. We collect it to cater to your needs or act in your interest, and we are only prepared to accept sensitive personal data from you on the condition that we have your and each member of your party's express consent for us to use such information in the ways described in this policy. We will seek this consent when necessary.
2. WHAT INFORMATION DO WE COLLECT FROM OTHER PEOPLE
We work closely with third parties (including, for example, our business partners) who may collect personal information from you and pass it on to us. Where this is the case the third party is responsible for obtaining the relevant consents from you to ensure you are happy with the ways in which your personal data will be used.
We may also provide our advertising partners with aggregate information about our users (for example, we may inform them of how many people in a certain area have clicked on the adverts created with those partners on any given day). You will not be personally identifiable from this aggregate information.
3. WHAT DO WE DO WITH THE INFORMATION COLLECTED?
We will use your personal information to (a) provide you with access to the relevant parts of the Website; (b) supply the services you have requested (e.g. to contact you about your booking); and (c) improve our Website and services to ensure you get the best experience. It will also enable us to bill you and to contact you where necessary about our services. We will also use the information we collect from you for the purposes of statistical analysis and to help us prevent fraud.
Where you have consented at the time we collected your data or where we otherwise have a right to do so, we may use the information you have submitted to us to contact you about our offers, which are updated regularly and/or inform you about important changes or developments to the Website or our services, by post, telephone, mobile messaging (e.g. SMS, MMS etc.) as well as by e-mail.
If you would rather we did not use your information to contact you about offers you can indicate this using the options we have provided at the time that we collect your data. Alternatively, please let us know by contacting us using the details set out in section 10 below. You may also opt out of receiving marketing communications from us by following the instructions outlined in the relevant communication.
If you would like to receive further offers but have already opted out then please contact us using the details provided in section 10 below.
Where you have consented at the time you contact our call centre, or where we otherwise have a right to do so, in order to improve our service, any communication you have with GRJ may be recorded for the purposes of training and monitoring.
When you visit our Website by selecting a link from another, we may store the name of the site you have navigated from for internal administration purposes.
4. WHERE IS YOUR PERSONAL INFORMATION STORED?
Any and all information you provide to us will be stored in secure databases at our secured offices in the UK, and prohibited from unauthorised viewing and usage.
5. SHARING YOUR INFORMATION
The above applies to any sensitive information that you give to us such as details of any disabilities, or dietary/religious requirements but we will only pass these on where we have obtained the express consent of you and each member of your travel party. If we cannot pass on this information as set out above, we may be unable to provide your booking or other services you have requested (for example, travel insurance).
If you have consented, we may allow carefully selected third parties, including marketing and advertising companies, our business partners, or our group companies to contact you occasionally about services that may be of interest to you. They may contact you by telephone, post, SMS as well as by e-mail. If you change your mind about being contacted by these companies in the future, please let us know by contacting us using the details set out in section 10 below. You may also opt out of receiving any marketing communications you receive by following the instructions outlined in these communications.
If our business enters into, orattempts to enter into, a joint venture with, purchases or is sold to or merges with another business entity, your information may be disclosed or transferred to the target company, our new business partners or owners or their advisors.
We may use the information that you provide to us if we are under a duty to disclose or share your information in order to comply with (and/or where we believe we are under a duty to comply with) any legal obligation; or in order to enforce the terms of any other agreement; or to protect the rights, property, or safety of GRJ, customers, employees or others. This includes exchanging information with other companies and other organisations for the purposes of fraud protection and prevention.
6. SECURITY, DATA TRANSFERS OUTSIDE THE EEA AND DATA RETENTION
We take steps to protect your information from unauthorised access and against unlawful processing, accidental loss, destruction and damage. We will only keep your information for as long as we reasonably require and, in any event, only for as long as Data Protection Legislation allows.
Where your customer reference number or your password allows you to access certain parts of the Website, you are responsible for keeping this information confidential. We advise you not to share your login details with anyone.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will take steps to protect your information, we cannot guarantee the security of your data transmitted to the Website; any transmission is at your own risk.
7. YOUR RIGHTS
We will usually inform you (before collecting your information) if we intend to use your information for marketing purposes or if we intend to disclose your information to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at the details set out at section 10 below.
Should you have any queries or complaints in relation to how we use your information, please contact us via the details set out at section 10 below. Should you wish to take any complaints or queries further, you have the right to contact the Information Commissioner's Office regarding such issues.
Our Website may, from time to time, contain links to and from third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these websites or their related policies. Please check these policies before you submit any personal information via these websites.
8. ACCESSING AND UPDATING YOUR INFORMATION
You have the right to see the information we hold about you and to ask us to: (a) make any changes to ensure that any information we hold about you is accurate and up to date; (b) erase or stop processing any information we hold about you where there is no longer a legal ground for us to hold it; or (c) transfer any information we hold about you to a specified third party. If you wish to do this, please contact us using the contact details set out below. We may charge a £10 fee for complying with some of the requests made under this section if they are made before 25 May 2018.
10. CONTACT US
All comments, queries and requests relating to our use of your information are welcomed (including in relation to transfer of data outside the EEA) and should be addressed to us at Great Rail Journeys, Saviour House, 9 St. Saviourgate, York, YO1 8NL or by email at firstname.lastname@example.org.
Last updated: January 2018