Privacy Policy

Virgin Trains East Coast values the personal information you provide to us and wouldn’t want to use your personal data in a way that you wouldn’t expect. This Privacy Policy explains how we protect your privacy and how you can control the way we use your personal information.

Having read this policy, if you want to change the way in which we use your data, or if you have a question about how your personal information is used, please contact us using one of the methods below:

Our ICO Registration Number is: Z1992385. You can find more information on the ICO website.

 

Contents

  • Where and how we collect your personal information
  • What personal information do we hold about you
  • CCTV
  • Our legal basis for using your personal information
  • How we use your personal information
  • How we use your personal information for marketing
  • Sharing your personal information
  • Your rights regarding our use of your personal information
  • Accessing your Data by Subject Access Request (SAR)
  • How we keep your personal information up to date
  • How we keep your personal information safe
  • How long we keep your personal information
  • What to do if you have a complaint or query about how we use your information
  • Links to other websites
  • Changes to this privacy policy

 

Where and how we collect your personal information

We collect personal information about you in several ways:

  • When you fill in a form on our website or contact us via phone, email or another method
  • When you register with us and fill in a form on our website or mobile app, whether directly or via a social media account
  • When you subscribe to our services
  • When you purchase anything from us
  • When you opt in to receive marketing messages, ticket alerts, or news by email, post, SMS or other means
  • When you register with us to use our Wi-Fi services
  • When you enter a competition or promotion, or fill in a survey
  • When you browse our website or app, or use our onboard, lounge or station Wi-Fi
  • When you open or click on any emails or push notifications we send you.
  • If you are a stakeholder of Virgin Trains with publicly available contact details, we may collect your information through channels where this information is available.

We also collect your personal information from other organisations and sources, for example when you contact us through a social media company such as Facebook, Twitter, LinkedIn or Instagram. Before providing information to us via these channels, you should check these companies’ privacy policies and settings to understand how they use your personal information.

 

What personal information do we hold about you?

When you fill in a form or buy tickets, we normally ask you to provide us with:

  • Your name
  • Your contact details including your address, phone number, email address
  • Your bank or credit card details (if you're buying tickets or other items from us), including billing information
  • Details of how you would like us to contact you.

We don’t collect age information (except in the case of alcohol-related competitions, promotions or sales) but we recognise that young people use our services and are legally able to provide consent after the age of 13 years.

If you are using our travel services and are aged between 13 and 16 years of age, we recommend that you read our terms and conditions. We will let you know when you make a booking if there is any further information that we may need to be able to provide products or services you have asked for.

If you need help with things like getting on and off a train, you may choose to give us confidential information about medical conditions and the type of assistance you require.  All UK train companies use a system called Passenger Assist to book help on stations and on trains for all services. This makes sure that if you book help in advance, our staff on stations and on the trains know that you're travelling, where you are seated on the train, any connections you have to make, and the help you need.  You have the option to save those assistance details to your account, and can edit or remove them at any time.

When you visit our website or use our Wi-Fi services, we may collect the following information automatically:

  • Technical information, including the IP address used to connect your computer to the Internet, your login information, the browser you’re using, time zone setting, browser plug in types and versions, the operating system and the train that you're on
  • Location data and Wi-Fi usage
  • Information about your visit that will help us to improve our service and make your online experience more relevant. This can include your approximate geographical location, the date and time you visited, which of our products you looked at or searched for, which pages you looked at, how long you spent on certain pages, and how you clicked to, through, and from our website. 

In our communications with you by email, SMS, or push notification, we automatically collect data relating to:

  • How you interact with our communications, such as which emails you opened or clicked a link within, and how long the email was opened for
  • Where you are when you interact with our messages
  • What type of device, model and operating system you’re using.

This helps us build a better picture of whether our marketing is effective or not along our route.

We also collect information about your visits to our websites using cookies. More information about how we use cookies and how you can change your settings can be found in our Cookie Policy.

While we mainly use the personal information that you give us about yourself, we may sometimes use other sources of information about our customers and prospective customers where you've given your permission for your data to be shared. We do this to help us understand more about our customers, to ensure that our messages are relevant, and to make sure that the marketing information we send you, with your consent, is also relevant. We take great care in sourcing this information, but if you prefer us not to use your data in this way, please let us know by emailing our Data Safe team

 

CCTV

We employ CCTV on our trains and in our stations in order to:

  • prevent, deter and detect crime
  • apprehend and prosecute offenders, and provide evidence to take action in the courts
  • help provide a safer environment for our staff
  • protect public safety
  • monitor operational and safety-related incidents
  • assist with the verification of claims.

You have the right to make a Subject Access Request for CCTV images of yourself and to ask for a copy of them. Please direct any such request to our Data Safe team, using the subject line 'Subject Access Request - CCTV'.

We reserve the right to withhold information where permissible by the applicable data protection legislation, and we will only retain CCTV images for a reasonable period or as long as is required by law. In certain circumstances, we may need to disclose CCTV images for legal reasons. When this is done, there is a requirement for the organisation that has received the images to adhere to the relevant data protection legislation.

 

Our legal basis for using your personal information

Under UK data protection law, we must have a valid basis for using your personal information and we may not collect store or use information other than as described in this policy. There are four ways we may have a valid basis for using your personal information:

  1. Fulfilling the contract: Most of the information we collect from you is necessary to allow us to fulfil our contract with you or to enter into a contract with you e.g. you provide a billing address when you purchase tickets via our website; we may need to contact you to notify you about changes to our services. We may also need information from you to ensure that we can provide you your tickets in the event you have lost important information like your booking reference. Essentially, we need that information to ensure you’re the real you and provide assistance to you post purchase.
  2. Consent to contact you: When you register and open an online account with us you will be invited to give your consent to use your personal information as described in ‘How we use your personal information for marketing’ below. By opting in you are giving your permission for us to process your data using ‘consent’ as our legal basis. If you have given consent to our use of your personal information, you are entitled to withdraw this consent at any time.
  3. Legitimate interest: We may also have a legitimate interest in using your personal information e.g. to ensure that the content on our website is presented to you and your computer as effectively as possible.  If this is our reason for using your personal information, we must make sure that our interests do not override yours and you can object to this use of your personal information.
  4. Legal obligation: Lastly, we may have a legal obligation to use your personal information in certain ways or to protect your interests e.g. we may exchange information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

 

How we use your personal information

We use the personal information you provide to:

  • fulfill the service or information you’ve requested 
  • handle the administration of your payment, issue your tickets/products, or confirm orders
  • alert you about your booked journeys or tickets coming on sale
  • provide post-sales support and deal with any complaints, refunds or other ticketing or travel issues
  • personalise your experience of our website by using your purchases and browsing activity to make recommendations that we think may be of interest to you
  • improve our website and the range of services and products we provide
  • carry out market research and survey related activities
  • analyse and optimise our marketing activities
  • facilitate loyalty schemes
  • contact you with your consent to tell you about our super savings, loyalty programmes and partners, latest news, events and personalised travel suggestions, services and special offers where you have given us permission to do so
  • to ensure our technical helpdesk can assist you if you have trouble with the Wi-Fi service.

 

How we use your personal information for marketing

We use your personal information for marketing where you have given us permission to do so, or you have provided permission to other organisations to allow us to market to you.

Where you’ve given us permission to do so, we use some of your personal information for marketing. For example, we may use information like name, address, location and past journeys to ensure we make our marketing relevant, accurate, and measure its effectiveness.

The marketing content may include tailored marketing messages about travel offers, ideas and news, and is dependent on the permission you have given us or another organisation.

By using the information you provide, we may contact you with specific marketing messages about travel offers, ideas and news and, depending on the permission you have given us or another organisation. This may be by post, email, phone, SMS, social media, or other means.

We also use your personal information to provide personalised experiences on our website, and to show you offers or rewards which are relevant to you.

If you’ve given us your consent to use your personal information for marketing, you have the right to withdraw your consent at any time by contacting our Data Safe team by email, clicking the “unsubscribe” link in our marketing emails, or replying STOP to a text message. You can also log in to your account on our website at any time to update your marketing opt-in permissions.

If you’re a Railblazers or corporate customer and would like to opt out of marketing, please send your request by email .

If you are a stakeholder who receives our communications, you have the right to unsubscribe from our communications by responding to our emails asking to unsubscribe or clicking the unsubscribe button.

 

Sharing your personal information

We respect your privacy and will not sell or lease your personal information. The information you provide us may be accessed by our staff, business partners, Virgin Group companies and carefully selected third parties in the course of providing services and to facilitate our marketing activities described above. We will not share or distribute any of the information you provide to us to unaffiliated third parties without receiving your consent, unless required to do so by law.

Third-party companies will be required to use your personal information in accordance with the Data Protection legislation currently in force. We may also use information in aggregate, where personally identifiable information is removed, for marketing and strategic development to improve and support our business.

We may transfer your personal information to any company who takes over the East Coast Main Line Company Limited, trading as Virgin Trains East Coast, to enable them to use that information in line with the consent you have provided, or where lawfully requested or required to do so by legal or regulatory authorities.

Where we use trusted suppliers to help us deliver our service to you, we allow the supplier concerned limited access to the personal data they need to provide their service. A list of just some of the service suppliers are listed below:

  • mailing houses to send you pre-booked tickets
  • website development and hosting companies which we use to administer our website content, including personalised messaging
  • our onboard Wi-Fi supplier
  • agencies which we use to manage season tickets and loyalty programmes
  • agencies which we use to analyse traffic on our website and use of our services
  • customer feedback and market research organisations
  • the organisations that run our online ticket booking systems
  • the organisation that sends our booking confirmation emails, registration emails, etc.
  • agencies supporting customer service activity carried out by rail staff.

 

We may also use trusted suppliers to help us with marketing:

  • an email service provider to send our emails and make sure you only receive what you have asked for 
  • a mailing house to send out marketing by post
  • a telemarketing agency to contact you by phone or SMS
  • online media owners who help us target, deliver and track our marketing campaigns using cookies. You can view our Cookie Policy here.

All personal information sent to our trusted suppliers is transferred securely. In all cases we require these companies to comply strictly with our instructions and they are not allowed to use your information for their own business purposes. We also require these companies to have sufficient organisational and technical measures in place to ensure the security of your personal information.

We may use suppliers who operate outside of the country of which you are a resident, for example in the United States. These countries may not offer the same legal protection of your personal information as the UK. If we use one of these organisations, we take appropriate steps to ensure that they provide an adequate level of protection in accordance with UK data protection law.  By submitting your personal information to us you agree to this transfer, storing or processing of your personal information at our approved locations outside the EEA.  If you would like to know more about the ways in which we safeguard your personal information, please get in touch using the contact details in this policy.

Under some circumstances we may be required to disclose or share your information without your consent, for example if we are required by the police, the courts or for other legal reasons.

We operate our rail franchise for a given period under license from the Secretary of State for Transport.  If at the end of that period the franchise is granted to another rail operator and, if you have given us your permission to do so, we are required to disclose your personal information to the new operator and/or franchising authority.  They are required to process your data lawfully and as described in this Privacy Policy.

 

Your rights regarding our use of your personal information

You provide us with details of what we can do with your data and have the right to manage your choices as detailed in How we use your personal information for marketing above.

You have the following rights:

  • To know that your data is being processed                                         
  • To access your personal data by making a Subject Access Request (SAR)
  • To have your information corrected if inaccurate 
  • To data portability if applicable
  • To request that your data be erased, restrict processing, and object to processing
  • Those relating to automated decision-making and profiling.

 

Accessing your Data by Subject Access Request (SAR)

You have the right to request a copy of the information that we hold about you. This is known as a Subject Access Request (SAR). We will provide this to you free of charge once we have confirmed your identity within 30 days of receipt of your request.

If you would like a copy of some or all of your personal information, please email our Data Safe team, or write to us. Unless you specify otherwise we will provide your information electronically.

If we do hold information about you we will:

  • give you a description of it
  • tell you why we are holding it
  • tell you who it could be shared with
  • tell you how long we will keep the information
  • if the information was not provided by you, we will give you any available information such as the source of the data
  • tell you if the information has been used for automated decision making
  • tell you if the information is stored outside of the European Economic Area, and if so what safeguards are in place to protect your personal information
  • let you have a concise and clear copy of the information.

 

How we keep your personal information up-to-date

We have a legal obligation to keep the personal information we collect accurate and up–to-date. You have the right to ask us to correct any inaccuracies in the personal information we hold about you and to restrict the use of your information until it has been corrected.  

The simplest way to keep your data accurate is to log in to your Virgin Trains East Coast online account.

We keep your information accurate as follows:

  • By giving you the opportunity at any time to contact us to correct or change your information
  • If you contact us we may ask you to confirm certain details. 
  • When we receive undelivered mail or email we will update our records accordingly.

We have specific rectification, restriction, objection and erasure policies in place to make sure we respond effectively to your request to correct data and to any erasure requests.

 

How we keep your personal information safe

We use administrative, electronic and physical security measures to ensure the information we collect about you is protected from access by unauthorised persons and protected against unlawful processing, accidental loss, destruction and damage.

By using our website and/or services, you acknowledge and agree that, except to the extent required by the Data Protection laws, we shall not be responsible for any unauthorised use, distribution, damage or destruction of personal data. We will only retain your information for a reasonable period or as long as is required by law.

 

How long we keep your personal information

Of the data we process outside of any contract we retain the data for no longer than is necessary. Where there is a legal requirement to retain data for longer than Virgin Trains East Coast requires, we will do so. Where reasonably practicable data is minimised so not to be identifiable to the data subject unless required by law or is subject to a Subject Access Request.

We keep your personal information where we have:

  • A legal or regulatory requirement requires that we hold data for a specific time
  • The business has a legal basis to retain data including data opt-ins, revised opt-ins and renewed consents.

 

What to do if you have a complaint about our use of your personal information

If you have a complaint about the information we hold or how we use that information, please contact our Data Safe team who will deal with your request promptly. If you are not satisfied with the way your complaint was handled, you can refer your complaint to UK Information Commissioner’s Office

 

Links to other websites

We link from our websites directly to other sites including, for example, virgintrains.co.uk. This privacy policy does not cover other websites and organisations we may link out to from our websites or apps. We strongly encourage you to read the privacy statements on the other websites you visit.

 

Changes to this privacy policy

This privacy policy does not provide exhaustive detail of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation if you contact us to request it.

We keep our privacy policy under regular review. This privacy policy was last updated on 24 May 2018.

 

APPENDIX: Legal basis for processing

 

Our use of your data

Legal basis for processing

To carry out our contract with you to provide you with products and services including purchase and issue of tickets, transportation, journey planning and travel advice

Necessary for the performance of our contract with you or to take steps to enter into that contract

To notify you of any changes to our service

Necessary for the performance of our contract with you or to take steps to enter into that contract

To provide you with marketing information about goods and services we believe may be of interest to you. 

You have given us your consent, or we rely on a legitimate interest.

To understand the effectiveness of the online advertising we show you and to deliver relevant advertising to you via our website

Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you  is relevant.

To make recommendations via our website regarding goods and services we believe may be of interest to you

You have given us your consent

To ensure that the content on our website is presented to you and your computer as effectively as possible so that you can find the correct tickets for your journey

Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you  is administered effectively

To create statistical information, market research, analysis and customer group profiles to better manage and run our business

Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you  is administered effectively

To monitor our websites to ensure that they are functioning correctly and that you receive the correct advice and best value tickets for your journey

Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively

To allow you to use the interactive features of our websites and app in planning your journey and purchasing tickets

Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you  is administered effectively

To protect your personal information when using our website or purchasing tickets

Processing is necessary to protect your vital interests

To allocate points to you within our affiliated loyalty schemes. 

You've consented to the allocation of reward points to your chosen loyalty scheme (of which you are a member).