Privacy Notice for California Residents
Last Modified July 23, 2026
This Privacy Notice for California Residents ("Notice") supplements the Privacy Policy found here and at www.greatrail.com/us of Great Rail Journeys, LLC, ("GRJ") formerly trading as Vacations by Rail/VBR Tours, LLC) shall supplement GRJ's Privacy Policy.
The California Consumer Privacy Act of 2018 ("CCPA") and the California Privacy Rights Act of 2020 ("CPRA") provide certain rights to residents of the State of California. This Notice, which supplements GRJ's Privacy Policy, only applies if you are a resident of the State of California. It is the express intent of GRJ to comply with and conform to the CCPA and the CPRA, and this Notice shall be read and interpreted to conform to the CCPA and the CPRA. California residents have privacy rights to their personal information including the right to not be discriminated against for exercising any of these rights. The terms "personal information," "sensitive personal information," "sell," "share," and "service provider" have the meanings given to them under the CCPA and CPRA. If any statement elsewhere in this Notice conflicts with this section, this section governs for California residents.
As a California resident, you have the right to receive a comprehensive description of how GRJ collects, uses, discloses, sells, shares and retains personal information, including sensitive personal information. You have the right to receive a copy of your personal information and sensitive personal information that GRJ collects, including disclosure of the categories of the information collected, sold and shared for a business purpose; the right to know about the information GRJ collects about you and how it is used and shared; the right to delete the information that GRJ collected from you, unless GRJ is permitted to keep the information as permitted by the CCPA and the CPRA; the right to non-discrimination for exercising your rights; and the right to delete inaccuracies in your information; the right to correct inaccurate information that a business has about you; the right to limit the use and disclosure of the information collected about you; and to opt out of the sale or sharing of your information, if GRJ sells or shares your personal information to third parties.
Notice at Collection
At or before the point at which GRJ collects personal information from you, GRJ provides notice of the categories of personal information and sensitive personal information we collect, the purposes for collecting them, whether they are sold or shared, and the applicable retention periods or criteria, as set forth herein. When you interact with GRJ online, this Notice, together with any notice presented at the point of collection, including the Privacy Policy, serves as our notice at collection and includes a link to the Privacy Policy and to our opt-out mechanism described below.
| Category of Information | Examples of Personal Information Collected | Collected? |
| A. Identifiers. | A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. | YES |
| B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code ยง 1798.80(e)). | A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories. | YES |
| C. Protected classification characteristics under California or federal law. | Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). | YES |
| D. Commercial information. | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | YES |
| E. Biometric information. | Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. | NO |
| F. Internet or other similar network activity. | Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. | YES |
| G. Geolocation data. | Physical location or movements. | YES |
| H. Sensory data. | Audio, electronic, visual, thermal, olfactory, or similar information. | NO |
| I. Professional or employment-related information. | Current or past job history or performance evaluations. | NO |
| J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). | Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. | NO |
| K. Inferences drawn from other personal information. | Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | NO |
Exempt Information
Please note that certain information is exempt from the CCPA. For example, personal information collected subject to a federal law called the Gramm-Leach-Bliley Act is exempt. As a result, insurance information would not be disclosed. Other exceptions include medical information and protected health information, personal information used to generate a consumer report, and personal information under the Driver Privacy Protection Act.
Sources of Personal Information and Sensitive Personal Information
GRJ collects personal information and sensitive personal information directly from you when you interact with us, automatically from your devices when you use our Website; and from third parties such as our affiliates and partners, referring websites, service providers, and advertising and analytics partners.
Business Purpose For Collecting and Using Personal Information and Sensitive Personal Information
GRJ uses each category of personal information and sensitive personal information for the purposes to process and fulfill bookings, maintain accounts, communicate with you, provide customer service, personalize your experience, send marketing you have requested or that is permitted by law, improve our services, ensure security and prevent fraud, and comply with legal obligations. GRJ does not use personal information and sensitive personal information for purposes that are incompatible with, or that materially differ from, the purposes disclosed at collection without providing you additional notice.
How GRJ Shares and Discloses Your Information
GRJ will share the personal information collected from and about you over the past twelve (12) months as discussed above for various business purposes. GRJ does not sell your personal information or sensitive personal information to third parties. The chart below explains the categories of information that we may share with third parties and the categories of information shared with those parties:
| Third Parties With Which We Share Information and Why | Categories of Information Shared |
| Our Subsidiaries and Affiliated Businesses. We may share information we collect within our family of companies to deliver products and services to you, and enhance our products, services, and your customer experience, consistent with our Privacy Policy. Those businesses may also use your information for their own purposes, including marketing purposes. | All categories of information we collect may be shared with our subsidiaries and affiliated businesses |
| Third Party Affiliates, Partners, and Service Providers. We may share your information with third party affiliates, partners and service providers whose offerings we think may interest you and to support and assist with your booking and tours selected. | Identifiers, Commercial Information, Internet or Other Similar Network Activity |
| Third Parties for Legal Requirements and Proceedings. We may disclose information to law enforcement authorities or other government officials if we are required to do so to comply with subpoenas, court orders, legal process or other law enforcement or government measures, and to comply with other legal obligations. We may disclose information if we believe disclosure is necessary or appropriate in connection with an investigation of suspected or actual fraudulent or illegal activity. | Any or all categories of information may be shared with third parties for legal requirements and proceedings, depending on the specific legal requirements |
| Third Parties for the Protection of our Services and Users. We may disclose information to protect and defend the rights, interests, and safety of the Services, our subsidiaries and affiliates, and their employees, contractors and agents; to protect the security and safety of our users of the Services, including when we believe disclosure is necessary to prevent physical harm or financial loss. | Any or all categories of information may be shared with third parties for legal requirements and proceedings, depending on the specific legal requirements |
| Third Parties in Business Transfers. We may disclose information in connection with a proposed or completed corporate transaction, including for example a merger, investment, acquisition, reorganization, consolidation, bankruptcy, liquidation, or sale of some or all of our assets. | Any or all categories of information may be shared with third parties in a business transaction, depending on the specific transaction |
| Third-Party Online Advertisers and Ad Networks. As discussed in the Advertising section of our Privacy Policy, we may rely on third-party advertising technologies that allow for the delivery of relevant content and advertising to you, as well as on other websites you visit and other applications you use, and these technologies will collect certain information from your use of the GRJ services to assist in delivering such ads. | Identifiers, Internet or Other Similar Network Activity, and Geolocation Data |
| Internet Services Providers. In connection with the provision of the services, we may share information with companies that provide internet services. | Identifiers, Internet or Other Similar Network Activity, and Geolocation Data |
| Data Analytics Providers. We may share information with companies that provide data analytics services in order to operate, evaluate and improve our business. | Identifiers, Internet or Other Similar Network Activity, and Geolocation Data |
| Operating Systems and Platforms. We may share information with software companies that power your devices and companies that provide common tools/information for software or apps about software or app consumers. | Identifiers |
Retention of Personal Information and Sensitive Personal Information
GRJ retains each category of personal information and sensitive personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, unless a lesser retention period is required or permitted by law. To determine the appropriate retention period, GRJ considers the length and nature of our relationship with you, our legal, tax, and accounting obligations, and whether retention is necessary to resolve disputes or to enforce our agreements.
Collection and Sharing of Personal Information and Sensitive Personal Information of Those Under 16 years of Age
GRJ does not sell personal information and sensitive personal information about consumers under 16 years of age. GRJ does not have actual knowledge of sharing personal information for cross-context behavioral advertising purposes for consumers under 16 years of age, although consumers under 16 that use the GRJ Website could have their personal information and sensitive personal information shared for cross-context behavioral advertising purposes.
However, there are circumstances when we offer a service that benefits a consumer under 16 years and in these events personal information could be shared with a third party. For example, if you purchase a booking for a child, in those circumstances information about the child would be collected from the adult purchasing the booking and may also be shared with GRJ affiliated companies, third party service and product providers related to the booking, the purchaser, and government/legal entities.
How to Exercise Your Rights and Opt-Out
As a California resident, you have the right to request access to, deletion of, or opt-out of the sale of your personal information.
Do Not Sell or Share My Personal Information
By clicking the above button and sending us an email with subject line "Do not sell my data" we will stop sharing your data with third parties as outlined in this privacy policy. Please include enough information for us to verify your identity.
To submit a Data Deletion Request:
Please email us at marketing@greatrail.com with the subject line "Data Deletion Request". Please include enough information for us to verify your identity.
You can also exercise your rights to know, delete, or correct your personal information or sensitive personal information by calling 1-877-929-7245. We will acknowledge your request and respond within the timeframes required by the CCPA (generally within 45 days, with an extension where permitted). Before completing certain requests, we will take steps to verify your identity, and we may decline requests we cannot verify. You may use an authorized agent to submit a request on your behalf, provided the agent presents your signed written permission and we can verify your identity. You do not need to create an account to submit a request, and we will not discriminate against you for making any request.
Where you have requested the categories of personal information that we have collected about you, we will provide a summary of this information and identify the category or categories of the personal information or sensitive personal information collected. Where you have requested specific pieces of personal information or sensitive personal information, we will provide you with the information that you have requested, except where not permitted under applicable law or where otherwise exempted. Where you have requested that we delete personal information of sensitive personal information that we have collected from you, we will inform you whether or not we are able to comply with your request. Certain information may be exempt from such requests under applicable law. If we are unable to complete your requests fully for any of the reasons above, we will provide you additional information about the reasons that we could not comply with your request.
You may also designate an agent to make requests to exercise your rights as described above. We will take steps both to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorized to make a request on your behalf through providing us with a signed written authorization or a copy of a power of attorney.
Limiting the Use of Sensitive Personal Information
GRJ uses sensitive personal information only for the purposes of providing the travel products and services you request and for related purposes permitted by the CCPA, such as security, fraud prevention, and legal compliance. We do not use or disclose sensitive personal information to infer characteristics about you. If our practices change, we will provide a "Limit the Use of My Sensitive Personal Information" link[KS2.1][AS2.2] and honor your requests to limit such use.
You have the right, at any time, to direct GRJ to limit its use of your sensitive personal information to that use which is necessary for GRJ to perform the services, as provided herein.
Automated Decision-Making Technology
GRJ does not currently use automated decision-making technology (ADMT) to make decisions that produce legal or similarly significant effects concerning you. Under CCPA regulation amendments that took effect January 1, 2026, businesses that use ADMT to make significant decisions about consumers must provide a pre-use notice, and consumers will have rights to access and opt out of such ADMT beginning January 1, 2027. If we begin using ADMT for significant decisions, we will provide a pre-use notice describing our use of the technology, how it works, and how you may exercise your rights to access and opt out.
Accessibility
GRJ strives to make this Notice accessible to individuals with disabilities in a manner consistent with generally recognized industry standards, such as the Web Content Accessibility Guidelines. If you need this Notice in an alternative format, please contact us at info@greatrail.com.
How to Contact Us
If you are a California resident, to submit a request, please contact GRJ via our online Website, by email at info@greatrail.com, or by contacting us at 1-877-929-7245. To protect your privacy and maintain security, we take steps to verify your identity before granting you access to your personal information or complying with your request.