Smartcheck privacy policy

EUROSTAR – SMARTCHECK PRIVACY NOTICE

IDENTITY OF THE DATA CONTROLLER

Eurostar International Limited (EIL) is the data controller for the SmartCheck trial and is responsible for handling any personal data submitted by you through the SmartCheck app. EIL is registered as a company in England and Wales at 6th Floor, Kings Place, 90 York Way, London N1 9AG company number 2462001. EIL is registered with the Information Commissioner’s Officer under data protection registration number Z5773966

USE OF PERSONAL DATA FOR SMARTCHECK

SmartCheck aims to decrease the time to pass through passport control by using facial recognition technology to crossmatch with previously stored passport details. The SmartCheck trial is conducted on a purely opt-in basis. EIL will only collect, process and store your personal data (Data) submitted through the app with your explicit consent.

Participation in the SmartCheck trial is optional, and you are able to withdraw your consent at any time by selecting the “delete my data” option in the app, or by removing the app entirely. Please note that this does not affect the legality of any processing carried out before your withdrawal of consent.

Children under the age of 16 are not permitted to take part in the trial process.

In the list below, we have set out the personal and special category data we collect and process with your consent whilst taking part in the SmartCheck trial.

Contact Details - Collected as part of the registration process for the SmartCheck trial

• Name
• E-mail address

Collected for the purpose of: Selecting users to participate in the SmartCheck trial

Lawful basis for processing your personal data: Consent

Passport Information - Collected through the enrolment app

• Passport photo
• Passport number
• Name
• Date of Birth
• Nationality
• Date of expiry
  

Collected for the purpose of: Facilitation of the SmartCheck trial

Lawful basis for processing your personal data: Consent

Biometric Data - Collected through the enrolment app

• Facial image
• Liveness scan

Collected for the purpose of: Facilitation of the SmartCheck trial

Lawful basis for processing your personal data: Explicit consent

Train Ticket Information - Collected through the enrolment app

• PNR
• Booking reference
• Ticket number
• Origin station code
• Arrival station code
• Train number
• Departure date
• Coach number
• Seat number
• Physical class

Collected for the purpose of: Facilitation of the SmartCheck trial

Lawful basis for processing your personal data: Consent

RETENTION OF DATA

Data submitted as part of the invitation and feedback process to the trial will be retained for a period of six (6) months for statistical and analysis purposes. Following this time period, this data shall be deleted.

Data submitted through the SmartCheck app is not retained for the duration of the SmartCheck trial and is only stored on our systems to complete enrolment and for the duration of the traveller’s journey. After completing the enrolment process, data is immediately deleted from our systems and only stored locally on the device used to register with SmartCheck.

At the start of a traveller’s journey, the biometric, passport and ticket data stored locally on the device is sent to servers as outlined in section 5. Sharing Your Data, to validate the traveller for their journey. This data is deleted six (6) hours following the conclusion of the traveller’s journey. If for any reason travel does not take place, the data is deleted 24 hours after initial submission to the server.

Deletion of the SmartCheck app from your device will also result in the deletion of any data residing in the app as part of the trial.

PROTECTION OF YOUR DATA

EIL employ organisational and technical measures to protect data submitted through the SmartCheck app against unauthorised access, unlawful use, accidental loss, corruption or destruction. Technical measures include encryption of data in transit and at rest and password protection of systems data is stored in. Organisational measures include limiting the number of individuals who have access to databases containing your information and physical security measures. We keep these security measures under periodic review and refer to industry standards to stay up to date with best practice. Our security measures have been independently vetted by a third-party to ensure they meet industry standards.

SHARING YOUR DATA

To effectively facilitate and provide the seamless travel experience offered by SmartCheck we share data submitted as part of the trial with several of our third-party partners. All of this data resides on either Google Cloud Platform (GCP), Amazon Web Services (AWS) and Microsoft Azure Cloud Computing Services (Azure) servers hosted within the United Kingdom and the European Union. This data is never internationally transferred and under no circumstance shall we share any of the data submitted as part of the SmartCheck trial with third parties for marketing purposes. Please see the below for an outline of what data is shared and with whom:

Travel document data is extracted from the ePassport and the eID collected through the enrolment process. This includes biographical data such as the name and date of birth and a photo of the traveller. Travel document data is shared with the Entrust IDVaaS platform at both the pre-travel and trip stages of the journey.

Facial biometric data comprises of a picture of the traveller’s face taken during the enrolment process, the photo on their eID or ePassport and a facial image captured by the biometric corridor at the train station. Facial biometric data is shared with the Entrust IDVaaS platform during the both the pre-travel and the trip stages of the journey, and the iProov platform during the enrolment stage.

YOUR RIGHTS

You are entitled to exercise a variety of rights over your personal data which is collected as part of the SmartCheck trial. If you wish to exercise any of the below rights, please contact us by completing our Data Request Webform, which can be found here:

https://datarequest.eurostar.com/

Right of Access

You have the right to know whether we process your personal data, and if so, what data we process. Additionally, you are also entitled to receive a copy of this data if you wish to do so.

Right of Rectification

You have the right to request us to correct any personal data we hold on you if you believe this is inaccurate or incomplete.

Right to Erasure

You have the right to request us to delete your personal data that we process. Please note that this right is not absolute and there may be circumstances where we are legally obliged continue processing personal data collected.

Right to Restrict Processing

In certain circumstances, you may request that we cease processing your personal data, but still hold it on our systems.

Right to Data Portability

You have the right, where technically feasible, to have your personal data transmitted to another data controller in a commonly used, machine readable format.

COMPLAINTS

If you have any complaints concerning EIL’s processing of your personal/special category data as part of the SmartCheck trial, please email us at privacy@eurostar.com.

Trial participants located in the UK can contact our data protection regulator the Information Commissioner’s Office (ICO) by telephone on 0303 123 1113, or by the live chat service available on www.ico.org.uk.

CONTACT US

You may write to us at the postal address:

Eurostar Data Protection
2nd Floor
Kent House
81 Station Road
Ashford