Published on: 25 March, 2019
We understand that providing information online involves a great deal of trust on your part. We take this trust very seriously and make it a high priority to ensure the security and confidentiality of the personal information you provide us when you visit our website or use our Services. Before providing us with your personal information, please read this Privacy Statement carefully to learn about our privacy practices.
About This Privacy Statement and TrainPal
When Does This Privacy Statement Apply?
This Privacy Statement applies to information about you as an identifiable person that TrainPal’s mobile application and/or website (together the “Applications”) collects from, or about you. This Privacy Statement does not apply to anonymous data that cannot identify you in any way.
The Applications may contain links to third-party websites. TrainPal is not responsible for the privacy practices or the content of these third-party websites. We recommend that you carefully read the privacy statements of such sites.
The data controller of any and all information provided to or gathered by TrainPal and its Applications is Ctrip.com (Hong Kong) Limited, a limited company registered in Hong Kong with office at Unit 3003, 30/F, Paul Y. Centre, 51 Hung To Road, Kwun Tong, Kowloon, Hong Kong.
Ctrip.com (Hong Kong) Limited also trades under Trip.com. You can contact us at firstname.lastname@example.org
About Your Personal Information and Uses
What Personal Information Does TrainPal Hold on Me and Others?
Information You Provide Us Directly
TrainPal collects and uses the information you provide to us directly in order to provide you with the services you request. For example, you may provide us your name, email, passcode, fingerprint as passcode, and other information when you register a TrainPal account. When booking train tickets you may provide passenger names, email and delivery address, as well as other information such as age and gender. When paying for train tickets, you may provide your bank card number, CVV on back cardholder name, expiry date, etc.
In order for us to customize the services we provide you, we may also collect information about your travel plans and preferences which includes your departure date, departure city and arriving city, seat choice, ticket choice, provided by TrainPal.
If you need to get in touch with our customer service team, or reach out to us through other means (such as through social media) we will collect information from you there too, such as your name and contact information.
You may be travelling with other guests or make a booking on someone else’s behalf, in which case you will provide similar details to TrainPal. However, we would like to remind you that it is your responsibility to ensure that the person or people whose personal information you have provided are aware that you’ve done so, and have agreed to your sharing of their personal information with TrainPal for these purposes.
Information We Collect Automatically
TrainPal collects some information about you automatically. Specifically:
1. Log information, which refers to information that the system may automatically collect through cookies, a web beacon, or other channels when you use our website, including:
- Device information or software information, such as your IP address, software version and device identifier (IDFA / IMEI) of the mobile device you use, and configurations of the web browser or mobile device you use to access our services.
- Information that is searched for or browsed when you use our services, such as web pages used or terms searched and pages visited through the app, as well as other information browsed or provided when using our services.
- Information contained in the content you share through our services, such as a photo shared or uploaded, comments, and dates and times, etc.
- To help us recognize your browser as a previous visitor and save and remember any preferences that may have been set while your browser was visiting our website. We also may keep you logged in if you checked the box entitled "Sign me in automatically next time."
- To help us customize the content and advertisements provided to you on our website and on other sites across the Internet. For example, when you access a page on our website, a cookie is automatically set by us, our service providers, or our partners to recognize your browser as you navigate on the Internet and to present you with information and advertising based on your apparent interests.
- To help measure and research the effectiveness of our website features and offerings, advertisements, and email communications (by determining which emails you open and act upon).
You are not obligated to accept cookies. The Help portion of the toolbar on most browsers will tell you how to prevent your browser from accepting new cookies or how to disable cookies altogether. Please note that if you refuse to accept cookies, you may not be able to access many of the travel services offered on our website.
Information We Receive Through Other Sources
We will also obtain your information from affiliates and business partners. For example, we allow you to log into TrainPal with your social media account, and with your consent (you grant authorization to the social platform), your personal information will be shared with us through that social platform.
Additionally, we may integrate calling services into our platforms to enable you to connect with us, and when we do, we receive metadata about the call activities (such as where you called from, who you are, and the date and length of the call).
How Does TrainPal Use My Personal Information and What are Related Lawful Bases?
TrainPal will generally collect and use your personal information for the following purposes:
1. To fulfil a contract, or take steps linked to a contract: The use of your information may be necessary to perform the contract that you have with us, including:
- Providing services to you: We will use your personal information to complete and manage your online booking. In addition, we will provide you with related products and services through affiliates, business partners, and third parties.
- Fulfilling obligations: Dealing with insurance claims and payments that occur under relevant policies, processing commissions paid to partners, claiming for loss caused by service partners, or recovering payments made etc.
2. To conduct our business and pursue our legitimate interests. In particular:
- Account management: You can create a TrainPal account and we will use the information you provide to manage your account and provide you with practical features. You can use your account for various operations, such as managing bookings, adjusting personal settings, adding frequently used passenger information, checking past bookings, evaluating orders, and managing payments, etc.
- Responding to your inquiries and requests: We provide customer service in multiple languages to offer help when you need it.
- Marketing activities: We will also use your personal information for legitimate marketing purposes, such as sending you the latest news on travel products or services, providing personalized recommendations, and information on other promotional activities that may interest you.
- Contacting you: Responding to and dealing with your questions or requests, sending booking-related messages (such as messages telling you of a successfully submitted booking, messages reminding you to complete unfinished bookings, etc.). We may also send you questionnaires or invite you to provide feedback on our services, etc.
- Market research: We will sometimes invite you to participate in market research to better understand your interest in our products, services, and Applications.
- Improving service security and reliability: We may detect and prevent fraud and illegal activities and use your personal information for risk assessment and security purposes.
- Data analysis: We may use your personal information for analysis so that we can get to know your preferences, and demographic information, or match it with the data obtained from other sources (including third parties), to develop our products and services or marketing plans, and to improve our services.
- Daily operations: Including but not limited to booking management, customer verification, technical support, network maintenance, troubleshooting, internal administrative affairs, internal policies and procedures, and producing internal reports.
- Monitoring: We monitor customer accounts to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law. Your phone conversations with our customer service staff, both answering our calls and calling us, may also be recorded. We may rely on these recordings to monitor the quality of our customer service, check the accuracy of the information you provide to prevent fraud, or serve the purpose of internal staff training.
- Payment verification: If you use a credit or debit card as payment, we also use third parties to check the validity of the sort code, account number, and card number you submit in order to prevent fraud.
- Investigations and complaints management: We use information you provide to investigate any complaints received from you or from others about our Applications, or our products and services. We also use data in connection with legal claims, compliance, regulatory and investigative purposes as necessary (including the disclosure of such information in connection with legal process or litigation).
3. Where you give us consent:
- We will send you electronic direct marketing content in relation to our relevant products and services, or other products and services provided by our affiliates and partners.
- On other occasions where we ask you for consent, we will use the data for the purpose which we explain at that time.
4. For purposes which are required by law:
- Relying on our legitimate interests: We have carried out balancing tests for all the data processing we have done based on our legitimate interests, which we have described above. You can obtain information on any of our balancing tests by contacting us using the details set out later in this statement.
- Withdrawing consent or otherwise objecting to direct marketing: Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above. You have an absolute right to opt out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by contacting us using the details set out below.
Duration of Processing of Personal Data.
TrainPal will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. TrainPal may retain your personal data for a longer period in the event of a complaint or if TrainPal reasonably believes there is a prospect of litigation in respect to TrainPal’s relationship with you.
To determine the appropriate retention period for personal data, TrainPal will consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which TrainPal processes your personal data and whether TrainPal can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Where will My Personal Data be Processed?
TrainPal operates both inside and outside of the European Economic Area (the “EEA”). It also cooperates with third-party vendors located both inside and outside of the EEA. Therefore, TrainPal may transfer your personal information to countries outside of the EEA, including to countries which may not have in place laws that apply the same level of data protection as within the EEA. Whenever such transfer occurs, it is based on the Standard Contractual Clauses (according to EU Commission Decision 87/2010/EC or any future replacement) in order to provide your personal information a level of data protection that applies within the EEA.
How Does TrainPal Share My Information?
We may share your booking information, account information, and device information with affiliate companies within our corporate family and third parties, such as the partners detailed below, to ensure the successful provision of services to you. Our partners include the following types:
- Providers: including but not limited to National Rail, railways, railway companies and agents that meet your booking needs. These providers may contact you as needed to provide you with travel products or services. These providers are not controlled by TrainPal and personal information disclosed to them is subject to the applicable provider's privacy statement and security practices. Therefore, we encourage you to review the privacy policies of any travel provider whose products you purchase through TrainPal.
- Third party vendors: We may work with third party vendors under contract to us to provide services or functions on our behalf, including credit card processing, business analytics, customer service, marketing, distribution of surveys or sweepstakes, and fraud prevention. We may also authorize third-party vendors to collect information on our behalf, including information necessary for us to operate the features of our Applications or to facilitate the delivery of online advertising tailored to your interests. Third-party vendors have access to and may collect information only as needed to perform their functions and are not permitted to share or use the information for any other purpose.
- Financial institutions and third-party payment agencies: When you place a booking, apply for a refund, or purchase insurance, we will share the related information with the relevant financial institutions or the third-party payment agencies, and as we believe is necessary for fraud detection and prevention, we will further share other necessary information (i.e. email address, phone number, and IP address) with the relevant financial institutions.
- Affiliated companies within our corporate family: We may share your personal information with our affiliated companies so that we best provide you with the requested service as well as information about other travel-related products and services. All parts of our company provide similar protection measures for your personal information that are no less stringent than this Privacy Statement.
We may also share your information in the context of complying with legal obligations, to protect our or your interests in legal matters, and in the case of a merger or acquisition.