PRIVACY POLICY

We can only use your personal data if we have a proper reason for doing so. According to the law, we can only use your data for one or more of these reasons:

• To fulfil a contract we have with you, or
• If we have a legal duty to use your data for a particular reason, or
• When you consent to it, or
• When it is in our legitimate interests.

Legitimate interests are our business or commercial reasons for using your data, but we will not unfairly put our legitimate interests above what is best for you.  Examples of legitimate interests we may rely on to process your data include developing products and services, identifying ways to improve the way we deliver services to our customers, and being efficient about how we conduct our business operations and fulfil our legal duties.

Countries take a different approach to the use by companies of legitimate interests as a reason for processing personal data. We are aware of those different approaches in the countries in which we operate and we take that into account and respect those differences when we process your personal data.

 

In the table below, we have set out the personal data we might collect from you (depending on how you use our services and our websites), the different ways in which we use that personal data and the reasons we rely on for using it.

Data collected	When we collect your data	Purposes	Legal basis for the use of your data
Your personal  details including your email address, telephone number and, where appropriate, your address	When you create an account	To make your purchases quicker and make it easier to manage your bookings	Your consent
	When you book a journey for yourself and, where applicable, for the children with whom you will be travelling with	To send you your booking confirmation and provide the requested services to you To help us better understand our customer base and to personalise the service we offer you	Performance of our contractual obligations Our legitimate interests And/or Your consent
	When you take part in a competition	To process your participation in the competition and, where appropriate, enable you to access the prize	Your consent
	When you wish to receive commercial information about our products and services	To promote our services and products which may be of interest to you	Your consent
	When you join the Club Eurostar loyalty programme	So that you can become a member of the scheme enabling you to collect and use points earned through our services and those of our partners	Performance of our contractual obligations
	When you purchase products and services of our partners which are related to the journey you have booked with us (e.g. motor insurance, car hire, tickets for attractions, etc.)	To send you your booking confirmation and provide the requested services to you	Performance of our contractual obligations
	When your train is disrupted or cancelled	To provide you with information about the status of our services and enable you, where appropriate, to exchange tickets, obtain a refund or access assistance	Fulfilment of our legal obligations   And   Performance of our contractual obligations
	When competent authorities with responsibility for immigration, customs checks, law enforcement and security make special requests	To provide the authorities with the requested relevant information in accordance with regulations	Fulfilment of our legal obligations
More sensitive data which may concern your health where appropriate (For more details, please see the “Sensitive Personal Data” section)	When you request special assistance at a station and/or book a wheelchair journey	To fulfil your special requests and provide the requested service to you	Fulfilment of our legal obligations And/or Performance of our contractual obligations
	If you are involved in an accident on board the train or at a station	To be able to identify the persons concerned and respond and provide help and assistance as necessary	Fulfilment of our legal obligations And/or Our legitimate interests
	If you book a special meal such as a Kosher or gluten-free meal	To fulfil your special requests and provide the requested service to you	Performance of our contractual obligations
Contact that we have with you (emails, letters, telephone calls, messages sent through our online messaging service, messages sent to us via social media and feedback provided)	When you contact us and make complaints	To process your requests in relation to bookings	Performance of our contractual obligations
	When you respond to our surveys	To find out your opinion on our products and services so that we can assess and improve our products and services	Your consent And/or Our legitimate interests
Information about  activities at stations obtained through remote surveillance cameras	When you go to stations	To put the necessary security arrangements in place at our stations	Fulfilment of our legal obligations And/or Our interests
Data from cookies or similar technologies (IP address, location, visited pages, reported errors, etc.) To find out more, see the “How we use your data to personalise the service we provide to you” section below	When you accept cookies which we place on your terminal When you update information in relation to your account When you open our Newsletters When you click on our advertisements When you take part in surveys When you agree to receive messages from us	To ensure the best possible use of our site, for web analytics and to provide you with content tailored to your interests	Your consent
Your payment card details	When you pay for your booking	To receive payments for your bookings	Performance of our contractual obligations
		To detect and prevent fraud and financial crimes	Our legitimate interests   And/or   Fulfilment of our legal obligations
Individual or household level information Basic demographic information such as your age and spoken language Household composition such as the number of people in your household and if you have children Economic information including your estimated income bracket Your interests and hobbies, such as whether you like to ski or eat out	From third party data enrichment providers, such as Acxiom. The data we obtain from Acxiom has been collected from publicly available records such as the electoral roll, or, with your consent, from surveys or other brands and companies that you engage with.	To help us better understand our customer base and to personalise the service we offer to you	Our legitimate interests

 

Sensitive personal data

Certain kinds of personal data, such as data about your racial or ethnic origin, your physical or mental health, your religious beliefs or alleged commission or conviction of criminal offences, are special categories of personal data which by law require additional protection. We try to limit the circumstances in which we collect sensitive personal data of this kind, but we do collect and process it when for example:

• You have booked a wheelchair seat to travel with us
• You have requested special assistance at the station
• You have been involved in an accident onboard or at the station
• You have requested a special meal type which implies or suggests your religion (e.g. a kosher meal) or a health issue (e.g. a gluten-free meal).

By providing any sensitive personal data, you explicitly agree that we may collect it and use it to provide services to you.

We use the data we collect about you from different sources and touch points to try to understand more about you and your preferences, so that we can personalise the service we offer to you.  We use information collected from the bookings you have made, from your participation in the Club Eurostar programme, and from cookies. Cookies are small pieces of information stored on your device by the web browser of your device. We use cookies placed on your devices to collect data about your use of our websites and on-board entertainment system. Sometimes we can use the personal data you provide to us to identify you when you visit our website using different devices. We also use data from third parties, including data enrichment providers (see the sections entitled ‘Data enrichment and profiling’ and ‘Sharing your data’ below). We use the information from these different sources in the following ways:

 

• to help us communicate with you. We use information about where you are, for example, to provide content in the most appropriate language
• to identify you when you access our websites from different devices
• to identify your likes and dislikes. We look at which of our website pages you visit most or which destinations you visit most frequently to understand what you are most interested in
• to improve our products and services. Trends in the personal data we collect show what our customers like and dislike and we use this to inform our business plans
• to understand more about your preferences and your purchasing habits - our data analytics tools and segmentation tools allow us to match data we collect from cookies with data we have about bookings you have made for travel on Eurostar (both directly and through third parties). Sometimes we include data and/or systems provided by third parties as part of this process. We know that similar customers are interested in similar products and services, so we group similar customers together in ‘segments’ to which we may add data from data enrichment providers (see the section entitled ‘Data enrichment and profiling’ below). We use segment information to improve our communications with you and recommend to you those services we think will be most interesting to you, including new products and services offered by our partners. We also use it to make sure that we show you adverts which we think will be of most interest to you when you visit through our online advertising space
• to help you complete a booking. If you are in the process of making a booking but you leave the booking path before your booking is finalised, we may with your consent contact you to help you to finalise your booking. For more information about cookies and how you can manage cookies and remove them, please refer to our Cookies Policy or update your preferences through our Privacy Manager.

Data enrichment and profiling

We carry out data enrichment and customer profiling to help us build a better picture of your needs and interests so that we can tailor your experience with Eurostar to be as relevant to you as possible. 
We use reputable third-party data enrichment providers such as Acxiom to complete this activity of segmentation. Data enrichment providers obtain personal data about you from publicly available sources and from other third parties who share your personal data with your consent. They then match this information against our own customer records.

Data enrichment providers are thoroughly vetted by us and external associations to ensure they comply with all data protection laws, including keeping your personal data secure and protected. For more information on Acxiom, please visit https://www.acxiom.co.uk/about-acxiom/privacy/uk-privacy-policy/. You can access your data or manage your preferences through Acxiom’s Consumer Preference Portal, available at https://gdpr.eu.acxiom.com/consumerPreference. For information on how to opt out of Eurostar’s data enrichment and profiling activities, please see ‘Your rights’ below.

We may send you marketing communications by email if you have given your consent for us to do so. Our marketing communications include information about our new and existing services, our loyalty programme ‘Club Eurostar’, special offers we think you might like and other travel services and products which we think might be useful to you when planning your travel. 

If you have previously opted in to receiving emails from us,  you can opt out of receiving marketing emails from us by logging into your account and amending your notification preferences which can  be found under the ‘Settings’ tab. You can update your preferences at any time. You can also opt out of receiving marketing emails by clicking on the unsubscribe link which we include in all our marketing emails.

If you ask us to stop sending marketing emails, we will keep a note of your personal information and your request so that we can make sure you are excluded from the emails when they are sent out.

If you have previously opted in to receive marketing notifications through our mobile app, you can manage your preferences and opt out from push notifications or location services by deselecting the relevant options under the heading ‘Communication Settings’ within ‘Settings’.

Please note that if you tell us that you do not wish to receive marketing emails, you will still receive service emails which are necessary for example to confirm your booking or to update you on the status of your travel service. We will use the contact details you give us when you are collecting your tickets (either your mobile telephone number, your email address or both) to let you know if your train is cancelled or delayed. This is so that we can perform the contract we have with you.  If you are a member of Club Eurostar you can opt out of receiving emails about even your membership.

From time to time, we may also contact you by phone when it is necessary to fulfil our contract with you or it is in our legitimate interests to do so, for example, we may contact you by phone when your journey has been disrupted, either to notify you in advance or to request feedback after the event. We may also contact you by phone when we believe there is an offer available to your future travel which you may be interested in, for example when there is an upgrade offer available to your group travel booking or to invite you to a VIP event.

We keep your data only for as long as we need it. How long we need data depends on what we are using it for, whether that is to provide services to you, for our own legitimate interests (described above) or so that we can comply with the law. We collect your contact details at the time we provide your tickets, for example, and we would only use this information in the event of disruption to our services. This information is deleted 48 hours after travel for passengers travelling in Standard or Standard Premier class, or 60 days for passengers travelling in Business Premier class.

We will actively review the information we hold and when there is no longer a customer, legal or business need for us to hold it, we will either delete it securely or in some cases anonymise it.

We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction. We use technical measures such as encryption and password protection to protect your data and the systems they are held in. We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which our booking information is held. We keep these security measures under review and refer to industry security standards to keep up to date with current best practice.

We share some of your personal data with, or obtain personal data from, the following categories of third parties:

• Government authorities such as border control authorities and law enforcement authorities We sometimes have to provide your personal data to government authorities to ensure that you can travel to your destination or to meet our legal and regulatory obligations. We retain some aggregated anonymised information based on the personal data you provide to the government authorities, such as statistics regarding the nationalities of our customers.
• Safety standards organisations We share personal data about accidents on our services and stations with the Rail Safety and Standards Board (‘RSSB’), whose aim is to improve safety throughout the rail industry. The RSSB processes this data in accordance with the RSSB privacy policy which is available at https://www.rssb.co.uk/privacy-notice.motn
• Other transport companies We sell through fares which are train tickets for travel on both a Eurostar train service and a train service provided by a third party train company. For example, if we sold you a ticket to travel from London to Cologne, you would travel on a Eurostar service to Brussels and then take a Thalys train for the rest of your journey. We would have to send details of your booking to Thalys so that you could travel from Brussels to Cologne. Similarly, Thalys would share your data with us if they sold the same ticket to you.
• Tour operators or companies through which you booked your Eurostar tickets Tickets for travel on our services are sold through many different channels. They have to share your booking information with us so that we can allow you to travel. We may also use the booking information they provide to build up what we know about you and your preferences, as described above under the heading ‘How we use your data to personalise the service we offer you’.
• Suppliers who provide services to us We will share your data with the company which provides our on-board catering services, for example, if you have requested a certain type of meal. We may share your data with the companies who we use to approach you for market research and feedback on our services. We will make sure that our suppliers respect your personal data and comply with data protection laws.
• Partners who provide services to you When you make a booking for a service which will be provided, either in whole or in part, by one of our partners, we share your personal data with that partner so that they can provide the service to you. For example, we would share your personal data with Allianz insurance when you buy one of their insurance products.
• Our sister company, Eurostar Holidays Limited We will share booking data and data from cookies and similar technologies with Eurostar Holidays Limited in order to facilitate any package bookings you make and to gain a better understanding of our customers’ purchasing activities across the Eurostar group.
• Data analytics companies and advertisers Depending on the cookies settings you have selected through our Privacy Manager tool, we may use your data in our data management platform. This platform helps us to understand more about you and your interests. We may use such data to make the connection between you and the devices you use to ensure relevance across these devices.  We may add to your data other information which we have received from third party advertisers or from our sister company, Eurostar Holidays Limited.  From time to time, we may share a limited and pseudonymised (or partially anonymised) version of your data with other advertisers.  For more information about this process, please see our Cookies Policy.
• Data enrichment providers: We may share the personal data we hold about you with data enrichment providers so that they can cross-check this data with personal data that they hold about you. If there is a match, we collect and store this additional information (for example your age and first language) and may we use this information to personalise the communications and services that you receive. Data enrichment providers will never keep your data or share it with any third parties.
• Your credit and debit card information In order to process payments and prevent and detect fraud, we process payment card data through our payment card and fraud management services providers.

We will only send data outside of the European Economic Area (‘EEA’) to work with our suppliers and advisers who we use to deliver services to you or to comply with a legal duty. If we do transfer data outside the EEA, we will make sure that it is protected in the same way as if it were being used in the EEA. We will use one of the following safeguards to ensure that it is protected:

• Transfer the data to a non-EEA country which has privacy laws at least as protective as those within the EEA
• Put in place a contract with the recipient of the data which means the recipient must protect the data to the same standards as required within the EEA, or
• Transfer it to organisations which are part of the Privacy Shield. The Privacy Shield is a framework which sets out the standards for data to be sent between the United States and European countries. The Privacy Shield ensures that data is protected to the same standards as used within the EEA.

You are entitled to see copies of all personal data held by us and to have that data amended, corrected or deleted. If you wish to make a request in relation to your personal data, please contact us by completing our Data Request Webform. You can also limit, restrict or object to the processing of your data.  You can use our Preference Centre and Privacy Manager tool, as described above. You can also log in to your Eurostar account to update the details held there.

If you gave us your consent to use your data, e.g. so that we can send you marketing emails, you can withdraw your consent. Information about how to stop receiving marketing communications is set out above under the heading ‘Marketing: How to manage the marketing messages you receive’. Please note that even if you withdraw your consent, we can still rely on the consent you gave as the lawful basis for processing your data before you withdrew your consent.

You can opt out of data enrichment and profiling at any time by emailing us at data.protection@eurostar.com. If you opt out of data enrichment and profiling, this means that your personal data held by us will no longer be combined with data held by data enrichment providers for marketing purposes.

You can object to our use of your data where we rely on our legitimate interests to do so.

To raise any objections or to exercise any of your rights, you can send an email to us at data.protection@eurostar.com or you can write to us at Eurostar Data Protection, 2nd Floor, Kent House, 81 Station Road, Ashford, Kent TN23 1AP. 

When you get in touch, we will come back to you as soon as possible and where possible within one month.  Please note that if your request is more complicated, it may take a little longer to come back to you and the response deadline can be extended by two months of your request where necessary. There is no charge for most requests, but if you ask us to provide a significant amount of data for example we may ask you to pay a reasonable admin fee.  We will also ask you to verify your identity before we provide any information to you.

If Eurostar decides to change this privacy policy, the changes will be posted on this page.

If you have any complaints concerning Eurostar’s processing of your personal data please email us at data.protection@eurostar.com or write to us at Data Protection, Eurostar International Limited, Times House, Bravingtons Walk, London N1 9AW.

Please note that you have the right to lodge a complaint with the supervisory authority which is responsible for the protection of personal data in the country where you live or work, or in which you think a breach of data protection laws might have taken place.

Customers in the UK can contact the Information Commissioner’s Office by telephone on 0303 123 1113, or by using the live chat service which is available through the Information Commissioner’s website www.ico.org.uk.

Customers in France can contact the Commission Nationale de l'Informatique et des Libertés by telephone on +33 (0)1.53.73.22.22 or by writing to the Commission at 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, France.   

Customers in Belgium can contact the Commission de la protection de la vie privée by telephone on  +32 (0)2 274 48 00 or by using the online contact form available through the Commission’s website at www.privacycommission.be.

Customers in the Netherlands can contact the Autoriteit Persoonsgegevens by telephone on (+31) - (0)70 - 888 85 00 or by writing to the Autoriteit Persoonsgegevens at Postbus 93374, 2509 AJ DEN HAAG.

You can write to us at Eurostar Data Protection, 2nd Floor, Kent House, 81 Station Road, Ashford, Kent TN23 1AP  , send us an email to us at data.protection@eurostar.com or contact us through our Data Request Webform.