This Privacy Statement applies to information about you as an identifiable person that TrainPal’s mobile application and/or website (together the “Applications”) collects from, or about you. This Privacy Statement does not apply to anonymous data that cannot identify you in any way.
The Applications may contain links to third-party websites. TrainPal is not responsible for the privacy practices or the content of these third-party websites. We recommend that you carefully read the privacy statements of such sites.
Data Controller and Contact InformationThe data controller of any and all information provided to or gathered by TrainPal and its Applications is Trainpal B.V., a limited company registered in Netherlands with office at Hoekenrode 3, 1102 BR Amsterdam. You can contact us at data-protection@TrainPal.com.
Our data protection representative in the UK is Trip Air Ticketing (UK) Limited. You can reach them by email at dp@trip.com.
What Personal Data Does TrainPal Hold on Me and Others, How Does TrainPal Use My Personal Data, and What are Related Lawful Bases?
1.Information You Provide Us DirectlyTrainPal collects and uses the information you provide to us directly to provide you with the services you request. For example, you may provide us with your name, email address and passcode when you register a TrainPal account. When booking flight, coach or train tickets, you may provide contact information as well as other required data. Your phone conversations with our customer support staff, both answering our calls and calling us, may be recorded.
You may also participate in referral programs or prize promotions, the details of which may be found on the event page. Doing so will also mean providing us with your name and contact information. In addition to this, you can provide us with feedback or ask for help with using TrainPal’s travel services.
You may be travelling with other guests or make a booking on someone else’s behalf, in which case you will provide similar details to TrainPal. However, we would like to remind you that it is your responsibility to ensure that the person or people whose personal data you have provided are aware that you’ve done so, and have agreed to your sharing of their personal data with TrainPal for these purposes.
The table below describes the personal data we collect, for which purposes we use it and the legal bases we rely on to process it.
| No | Purpose | Detailed purpose and scenario description | Categories of Personal Data | Legal Basis |
|---|---|---|---|---|
| 1. | Account registration | We will use the information you provide to manage your TrainPal account and provide you with practical features. You can use your account for various operations, such as managing bookings, adjusting personal settings, checking past bookings, evaluating orders, and managing payments, etc. | When creating an account via email: name, email address and passcode. (altogether “Account Registration Information”) | It is necessary for us to process your personal data to perform our contract with you, or to take steps at your request prior to entering into a contract with you. |
| 2. | Account management | You can maintain and update your personal data in your profile, which are optional, and you may delete them anytime you want. | Your details (optional): date of birth, phone number. Card information (optional): credit/debit card number, cardholder name, expiry date. (altogether “Account Information”) | We also have a legitimate interest in managing our business and providing you with our Services. |
| 3. | Reservation management | We will use your personal data to complete and manage your online booking. In addition, we will provide you with related products and services through affiliates, business partners, and third parties. If you provide personal data of minors when booking tickets, please ensure that you have obtained the consent of the minor's guardian in accordance with applicable laws. Please note that tickets for minors can only be booked together with tickets for adults. Please see the section “Use of TrainPal by Minors” for more details. | For flight tickets: passenger name, contact information, nationality, date of birth, gender, ID information, frequent flyer card For train tickets: contact information. For coach tickets: passenger name, contact information. For reservations with payment conducted via Trainpal: card number, cardholder name, expiry date, CVV/CVC). (altogether “Reservation Information”). | It is necessary for us to process your personal data to perform our contract with you, or to take steps at your request prior to entering into a contract with you. |
| 4. | Fraud detection and prevention, payment verification, improving service security and reliability | We may detect and prevent fraud, illegal activities and potential transaction risks, and use your personal data for other risk assessment and security purposes. If you are using our app, it will send us error-reporting information when it crashes or hangs. This enables us to investigate the error and to improve the stability of the app for future releases. We monitor customer accounts to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law. If you use a credit or debit card as payment, we also use third parties to check the validity of the sort code, account number, and card number you submit to prevent fraud. | All data collected provided it is necessary. | We have a legitimate interest in ensuring the security of our operations, assets, and individuals interacting with our Services. |
| 5. | Customer service | We provide customer support in multiple languages to offer help when you need it. Responding to and dealing with your questions or requests, sending booking-related messages (such as messages telling you of a successfully submitted booking, messages reminding you to complete unfinished bookings, etc.) to you via email, platform notice and/or push. You may consent to getting contacted via SMS message and WhatsApp separately. Your phone conversations with our customer support staff, both answering our calls and calling us, may be recorded. We may rely on these recordings to monitor the quality of our customer support, check the accuracy of the information you provide for fraud prevention and transaction security, or serve the purpose of internal staff training. Additionally, due to factors such as network conditions, call environment, and regulatory policies, there may be instances of recording/storage failure. | Account Registration Information. Account Information. Reservation Information. Third-party account (e.g. WhatsApp) as you consent to separately. Call recording of your conversations with our customer support staff (you may have the right to refuse such call recording in accordance with applicable law) (“Call Recordings”). Automatically Collected Information as specified in this Privacy Statement. Other personal data you provided to customer service staff to facilitate your request. | It is necessary for us to process your personal data to perform our contract with you, or to take steps at your request prior to entering into a contract with you. We also have a legitimate interest in managing our business and providing you customer service. |
| 6. | Service improvement, customized service provision | We may use your personal data for analysis so that we can know your location, preferences, and demographic information, or match it with the data obtained from other sources (including third parties), to display customized contents, offer travel recommendations that we think may interest you, develop our products and services or marketing plans, and improve our services. We monitor your use of our website or app, to help us refine and improve the way our website or app works technically. We may also send you questionnaires or invite you to provide feedback on our services, etc. | Account Registration Information. Account Information. Reservation Information. Your communication with us. Automatically Collected Information. Geographic information (optional). | Your consent where cookies are used or when we ask for your geographic information. Otherwise, we have a legitimate interest in managing and improving our services. |
| 7. | Participation in platform activities | We collect your personal data when you participate in activities on TrainPal for more benefits or rewards (e.g. member activities, referral programs and prize promotions, etc.) | Data you provide when you participate in such activities, including any Account Registration Information. | It is necessary for us to process your personal data to perform our contract with you, or to take steps at your request prior to entering into a contract with you. |
| 8. | Fulfilling legal obligations; purposes required by law | Comply with applicable laws, protect our and your rights and interests, defend ourselves. Comply with applicable security and anti-terrorism, anti-bribery, customs and immigration, and other such due diligence laws and requirements. Dealing with payments that occur under relevant policies, processing commissions paid to partners, claiming for loss caused by service partners, or recovering payments made, etc. | All data collected provided it is necessary. | When we have a legal obligation under EU/UK laws, we process the data in order to comply with applicable law and regulations. When we have a legal obligation under laws outside the EU/UK, we have a legitimate interest in protecting our business interests and legal rights, and your interests and legal rights. |
| 9. | Investigations, complaints management, and dispute resolution | We use information you provide to investigate any complaints received from you or from others about our Services. We use data in connection with legal claims, compliance, crimes, regulatory and investigative purposes as necessary (including the disclosure of such data in connection with legal authority investigation, legal process or litigation). If dispute arises, including your dispute with the service providers, relevant call recordings may be used as reference for dispute resolution. | Account Registration Information. Account Information. Reservation Information. Call Recordings. Automatically collected information as specified in this Privacy Statement. Other personal data required under applicable law or by appropriate authorities. | When we have a legal obligation under EU/UK laws, we process the data to comply with applicable law and regulations. When we have a legal obligation under laws outside the EU/UK, we have a legitimate interest in protecting our business interests and legal rights, and your interests and legal rights. |
| 10. | User experience survey and market research | We will sometimes invite you to participate in user experience survey or market research to better understand your interest, comments and expectations in our Services. | Phone number, email address. | Your consent where required by law. We also have a legitimate interest in understanding and improving our services based on your feedbacks. |
| 11. | Marketing activities | We may ask for your consent to send you certain electronic direct marketing content in relation to our Services, or other products and services provided by our affiliates and partners. Our marketing activities also involve cross-device tracking, where third parties collect information on your online activities via cookies across multiple linked devices and combine this information to tailor the advertisement that you see across the Internet to your interests (commonly known as Internet based advertising). See our Cookie Statement for more details. | Phone number, email address, social media account you provide separately. | Your consent. |
| 12. | Refund or reservation modification claims due to medical issues | When you need to request a refund or change due to a medical issues, we may collect health information to confirm and proceed with your request. | Account Registration Information. Account Information. Health Information as required (e.g., health status, hospital diagnosis, illness). | It is necessary for us to process your personal data to perform our contract with you, or to take steps at your request prior to entering into a contract with you. |
For being able to use our Services and/or enter into a contract with us, the provision of data is mandatory: if relevant data is not provided, then we will not be able to use our Services and/or enter into a contract with you. We have highlighted above the data for which the provision is optional.
There are instances where we have a legitimate interest to use your data. Our legitimate interest will vary depending on what we are using your data for, and we explain above what the interest is and how it relates to the processing operations that we are carrying out. Where we process personal data on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place.
2.Information We Collect AutomaticallyTrainPal automatically collects user-related information during Services for security, service provision, claim response, dispute resolution, and restriction of legal and terms violations (“Automatically Collected Information”). The specific details are as follows:
- Log information, which refers to information that the system may automatically collect through cookies, a web beacon, or other channels (including those placed by our third-party business partners) when you use our Services.
- Device information or software information, such as your IP address, software version and device identifier of the mobile device you use, and configurations of the web browser or mobile device you use to access our Services.
- Information that is searched for or browsed when you use our services, such as web pages used or terms searched and pages visited through the app, as well as other information browsed or provided when using our Services.
- Information contained in the content you share through our services, such as a photo shared or uploaded, comments, and dates and times, etc.
- Information on your preferences, such as language, region and currency.
- Where you have given your consent: location information collected when you turn on your device’s location feature and use our location-based services. This includes location information collected via GPS or Wi-Fi, address information included in the account information you provide to us, and shared information uploaded by you or others showing your current or previous location. If you do not want your location information to be collected, you can disable the location function setting.
More information on how we use cookies can be found in our Cookie Statement.
3.Information We Receive through Other SourcesWe will obtain your information from third parties. For example, we allow you to log into TrainPal with your social media account (e.g., Google, Apple, Facebook), and with your consent (you grant authorization to the social platform), your personal data will be shared with us through that social platform.
Duration of Processing of Personal Data
Where TrainPal processes your personal data as allowed by law or with your consent, TrainPal will store your personal data i) only for as long as is required to fulfil the purposes mentioned previously, ii) until you object to our use of your personal data (where TrainPal has a legitimate interest in using your personal data), or iii) until you withdraw your consent, whichever is applicable. However, if TrainPal is required to retain your personal data by law or to address legal claims, TrainPal will retain your personal data until the end of the legally required period or until the claims in question have been settled.
To determine the appropriate retention period for personal data, TrainPal will consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which TrainPal processes your personal data and whether TrainPal can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
Where we process your data in relation to your account, we do this for as long as you are a user of TrainPal and as allowed by applicable laws after this. If you request data deletion when deleting your account, we will respond to your request in accordance with applicable laws.
Where we process personal data for marketing purposes or with your consent, we process the data until you ask us to stop and for a short period after this to allow us to implement your requests. We also keep a record of the fact that you have asked us not to send you direct marketing or to process your data indefinitely so that we can respect your request in future.
Where will My Personal Data be Processed?
We store personal data that we collect in Germany. Personal data that we collect from you may be transferred to and stored at a destination outside the UK/EEA to the extent necessary for providing you with requested Services. Due to the global nature of our business, your personal data will be disclosed to our Travel Service Providers, third-party vendors, financial institutions and third-party payment processors, business partners, advertising partners and affiliates within our group, government authorities, law enforcement, regulators and fraud prevention agencies, and prospective buyer/seller outside of the UK and the EEA. Where these locations do not provide an adequate level of data protection, we ensure appropriate safeguards are in place to protect the transfer of your personal data to these countries. A copy of the relevant mechanism can be obtained for your review on request by using the contact details below.
The measures we have in place include the following:
- Adequacy decisions of the European Commission and adequacy regulations of ICO confirming an adequate level of data protection of whitelisted countries. You can find out more at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en for the EU and at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/#Q1 for the UK;
- Standard contractual clauses as approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (available at https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32021D0914), or the standard data protection clauses approved by ICO (available at https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-data-transfer-agreement-and-guidance/); and
- Other appropriate mechanisms and technical measures to ensure data security and compliance.
To ensure the successful provision of Services to you, we may share your data with the following categories of recipients:
| Personal Data Category | Category of Recipient | Why? |
|---|---|---|
| Account Registration Information; Account Information; Reservation Information. | Travel Service Providers | We may share your account information, contact information and reservation information with travel service providers, including but not limited to train operators, railway companies, airlines, coach operators and agents that meet your booking needs (collectively “Travel Service Providers”). These providers may contact you as needed to provide you with travel products or services. These providers are not controlled by TrainPal and personal data disclosed to them is subject to the applicable provider’s privacy statements and security practices. Therefore, we encourage you to review the privacy policies of any travel provider whose products you purchase through TrainPal. |
| Account Registration Information; Account Information; Reservation Information; Automatically Collected Information; Other data collected provided it is necessary. | Third-party vendors | We may work with third party vendors under contract to us to provide services or functions on our behalf, including message delivery, business analysis, customer service, marketing, surveys or prize promotions, fraud prevention, technical support, etc. We may also authorise third-party vendors to collect information on our behalf, including information necessary for us to operate the features of our Applications or to facilitate the delivery of online advertising tailored to your interests. Third-party vendors have access to and may collect information only as needed to perform their functions and are not permitted to share or use the information for any other purpose. |
| Account Registration Information; Account Information; Reservation Information; Automatically Collected Information. | Financial institutions and third-party Payment processors | When you place a booking or apply for a refund, we may share your data as necessary with the relevant financial institutions or the third-party payment agencies. As we believe is necessary for fraud detection and prevention, we will further share other necessary information (i.e. email address, phone number, and IP address) with the relevant financial institutions. |
| Account Registration Information; Account Information; Reservation Information; Automatically Collected Information. | Business partners | These are partners who jointly provide products or services or offer products or services on our Applications. You can identify third-party involvement by the appearance of the third party’s name alone or with our name. We may share relevant information, including your account information, reservation information and Automatically Collected Information as necessary, with such partners when you request specific products or services. You may also be directed to such partners pages for provision of products or services. We recommend you carefully review their privacy statements. |
| Automatically Collected Information. | Advertising partners | We may disclose your Automatically Collected Information to third-party marketing partners to provide customized advertising. This allows us to tailor your experience with content that may be of interest and offer better travel experiences. For more details, please refer to our Cookie Statement. |
| Account Registration Information; Account Information; Reservation Information; Automatically Collected Information. | Affiliates within our corporate family | We may share your information with our affiliated companies so that we best provide you with the requested service as well as information about other travel-related products and services. All parts of our company provide similar protection measures for your personal data that are no less stringent than this Privacy Statement. |
| Account Registration Information; Account Information; Reservation Information; Automatically Collected Information. | Trip.com Group | We may share data with subsidiaries under Trip.com Group Limited in order to provide the necessary services to you, including payment processing services, customer service and ensure compliance with the applicable laws. All information would be treated in compliance with the laws and protected under this Privacy Statement. |
| All data collected provided it is necessary. | Government authorities, law enforcement, regulators and fraud prevention agencies | We may share necessary personal data with these entities to prevent, investigate and/or report fraud, terrorism, misrepresentation, security incidents or crime, in accordance with applicable law; and to assist competent authorities in investigation, legal process or litigation, for regulatory and investigative purposes as necessary. |
| All data collected provided it is necessary. | Prospective buyer/seller | In the event that the business is sold or integrated with another business, your personal data will be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business. |
You have the following rights:
| Right | Summary |
|---|---|
| The right of access | Enables you to receive a copy of your personal data. |
| The right to rectification | Enables you to correct any inaccurate or incomplete personal data we hold about you. |
| The right to erasure | Enables you to ask us to delete your personal data in certain circumstances. |
| The right to restrict processing | Enables you to ask us to halt the processing of your personal data in certain circumstances. |
| The right to object | Enables you to object to us processing your personal data in certain circumstances, including where we process your personal data on the basis of our legitimate interests (or those of a third party), or where we are performing a task in the public interest. In these circumstances your objection will be upheld, and we will cease processing your personal data, unless the processing is based on compelling legitimate grounds, is necessary for public interest reasons, is needed for the exercise or defence of legal claims that may be brought by or against us, or the law provides exemptions (e.g. for the purposes of law enforcement, national security or taxation). You have an absolute right to object to us processing your personal data for direct marketing purposes or profiling for purposes of direct marketing. |
| The right to data portability | Enables you to request us to transmit personal data that you have provided to us, to a third party without hindrance, or to give you a copy of it so that you can transmit it to a third party, where technically feasible. |
| If you live in France: The right to instruct us regarding the use of your personal data after your death | Enables you to instruct us on the processing (retention, deletion, and disclosure) of your personal data after your death. You can change or revoke such instructions at any time. |
These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. If you wish to exercise any of these rights, please contact us at the contact details set out below.
Wherever we rely on your consent, you will always be able to withdraw that consent, although we may have other legal grounds for processing your data for other purposes, such as those set out above. In some cases, where you have a TrainPal account, we are able to send you direct marketing without your explicit consent. You have an absolute right to opt out of direct marketing, or profiling we carry out for direct marketing, at any time. You can do this by contacting us using the details set out below. You can also opt out of receiving any non-essential emails, including marketing emails, by clicking the unsubscribe link contained at the bottom of such emails or by adjusting the notification settings in your account profile on our website or app. You can change your cookie settings as set out in our Cookie Statement.
We are committed to investigating and resolving complaints about our collection or use of your personal data. To make a complaint, please clearly provide the following information to help us address the issue effectively:
- The specific data privacy complaint (please provide as much detail as possible including country, your understanding of the data privacy infringement, and redress requested)
- Your full name and how we can contact you
- Any previous correspondence on this specific data privacy issue
If you are not satisfied with our resolution of your complaint, you have the right to complain to a data protection authority in the country that you reside in or, the country of your place of work or the country where the alleged infringement took place.
We aim to resolve all issues in a timely manner, or as mandated by applicable law, but if this is not possible because a more detailed investigation is required, we will keep in regular contact with you to ensure that you are kept informed of the resolution of your matter.
TrainPal is not intended for use by minors under 16 years of age and no person under the age of 16 should register or use the Applications or provide their personal data to Trainpal.
When booking tickets on TrainPal, if you provide personal data of minors, please ensure that you have obtained consent from the minors’ guardians in accordance with applicable laws. Please note that train or flight tickets for minors can only be booked together with tickets for adults.
We attach great importance to information security and has set up a dedicated team for this. We strive to protect your personal data and have taken appropriate managerial, technological, and physical security measures.
In terms of the data life cycle, we have established security measures for all stages including data collection, storage, display, processing, use, and destruction. We take different control measures according to the level of information sensitivity, including but not limited to access control, SSL encryption transmission, and high-level encryption algorithms for encrypted storage, in order to mask the sensitive information to be displayed, etc. We rely on currently available technologies and take appropriate security measures to protect your information.
In the unlikely event of a data breach affecting your personal data, we will inform you in accordance with laws and regulations by email or other means.
We reserve the right to update this Privacy Statement at any time, and we will provide you with a new Privacy Statement when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.