Privacy & Cookie Policy

East Midlands Trains: Privacy Notice

East Midlands Trains (EMT) values the personal information you provide to us and wouldn’t want to use your personal data in a way that you wouldn’t expect.  This Privacy Notice explains how we protect your privacy and how you control the use of your personal information. Having read this information, if you want to change the way in which we use your data or if you have a question about how your personal information is used please contact the Data Controller: East Midlands Trains Limited using the methods below:

Email:

DSAR@eastmidlandstrains.co.uk

Postal address:                   

Prospect House
No 1 Prospect Place
Millennium Way, Pride Park
Derby
DE24 8HG

Our ICO Registration Number is: Z1302978 and can be viewed here.

Contents

Where and how we collect your personal information

We collect personal information about you in several ways:

  • When you fill in a form on our website or contact us via phone, email or another route
  • When you register with us and fill in a form on our website or mobile app, either directly or via a social media account
  • When you subscribe to our services
  • When you purchase tickets
  • When you opt-in to receive marketing and our newsletter by email, post or SMS
  • When you register with us to use our on-train wi-fi services
  • When you enter a competition, promotion or survey
  • When you telephone our Contact Centre
  • When you get in touch using the Contact Us form on our website
  • When you browse our website or use our on-train wi-fi
  • When you open any marketing emails we send you

We also collect your personal information from other organisations and sources, for example when you book a ticket through The Trainline or contact us through a social media company such as Facebook, Twitter, LinkedIn or Instagram. When providing information to us via these channels you should check these companies’ privacy policies and settings to understand how they use your personal information.

What personal information do we hold about you?

When you fill in a form or purchase tickets we only require you to supply the information that we need to provide the service you have requested. We will normally ask you to provide us with:

  • Your name
  • Your contact details
  • Your bank or credit card details
  • How you would like us to contact you

We don’t collect date of birth information but we recognise that young people use our services and are legally able to provide consent after the age of 13 years. If you are using our travel services and are aged between 13 and 16 years of age we recommend that you read our terms and conditions. We will let you know when you make a booking if there is any further information that we may need to be able to provide products or services you have asked for. We will also tell you which information is optional.

If you need help with things like getting on and off a train, you may choose to give us confidential information about your disability and the assistance you require. All UK train companies use a system called Passenger Assist to book help on stations and on trains for all services. This makes sure that if you book help in advance, our staff on stations and on the trains know that you are travelling, where you are seated on the train, any connections you have to make and the help you need.

When you visit our website or register to use our on-train wi-fi services, we may collect the following information automatically:

  • Technical information, including the IP address used to connect your computer to the Internet, your login information, the browser you’re using, time zone setting, browser plug-in types and versions, the operating system and platform you are using;
  • Location data and wi-fi usage;
  • Information about your visit that will help us to improve our service. This can include date and time, which products you looked at or searched for, how long you spent on certain pages and how you moved around the page, how you clicked to, through and from our website and any phone number used to contact our Contact Centre.

While we mainly use the personal information that you provide to us yourself, we may sometimes use other public sources of information about our customers and enquirers where you have given your permission for your data to be shared. We do this to help us understand more about our customers and to ensure that our public messages are relevant and to make sure that the marketing information we send you, with your consent, is also relevant.  We take great care in sourcing this information but if you prefer us not to use your data in this way then please let us know by contacting DSAR@eastmidlandstrains.co.uk

Cookies: How we use them

Our aim is to continually improve the experience you have when you visit our website. As part of this process we use cookies. Cookies are small text files containing information about your browsing session (e.g. which pages you visited) which are located in your browser directory.

We use different types of cookies and each has a specific function. Some cookies are essential to the working of the website and allow you to navigate easily from page to page and perform certain functions (e.g. making a purchase). Other non-essential cookies allow us to analyse how you use our site, which enables us to make decisions about how best to improve the website design and functionality to fit your future needs.

In some cases, we use cookies to remember a selection you have made (e.g. your location) which saves you having to make that selection again if you return to the site. Other cookies allow our partners to see how many visitors click from their website to our website and subsequently allow us to select the best partners to work with.

We will not store personally identifiable information such as credit card or address details in the cookies we create. All data collected using a cookie will be anonymous and will not hold specific knowledge of who a visitor is.

Usually web browsers are set to accept cookies. If you have visited this site, however, and did not want cookies to be used, please exit the site and use your browser tools settings to delete the cookies. If you do this and revisit this site, cookies will again be set unless you change your browser settings to reject cookies.

We are committed to complying with legislation changes for storing information on a user’s computer or mobile device. We aim to be honest and clear about your privacy when using our website.

Our legal basis for using your personal information

The following are four different legal bases that we rely on to use your personal information:

  1. Contract—Most of the information we collect from you is necessary to allow us to fulfil our contract with you or to enter into a contract with you e.g. you provide a billing address when you purchase tickets via our website; we may need to contact you to notify you about changes to our services.
  2. Consent—When you register and open an online account with us you will be invited to give us your consent to use your personal information as described in ‘How we use your personal information for marketing’. By opting in you are giving us your permission to process your data using consent as our legal basis. If you have given consent to our use of your personal information, you are entitled to withdraw this consent at any time.
  3. Legitimate Interests—We have a legitimate interest in using your personal information e.g. to ensure that the content on our website is presented to you and your device as effectively as possible. If this is our reason for using your personal information, we must make sure that our interests do not override yours and you can object to this use of your personal information. We also have a legitimate interest in exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
  4. Legal Obligation—Lastly, we have a legal obligation to use your personal information where lawfully requested or required to do so by public authorities.

A full description of the different types of personal information we process, the purpose of the processing and the legal basis for the processing is shown below:

Our use of your data Legal basis for processing
To carry out our contract with you to provide you with products and services including purchase and issue of tickets, transportation, journey planning and travel advice Necessary for the performance of our contract with you or to take steps to enter into that contract
To notify you of any changes to our service Necessary for the performance of our contract with you or to take steps to enter into that contract
To provide you with marketing information via email, SMS or post about goods and services we believe may be of interest to you You have given us your consent  (where you have actively given an opt-in preference) / Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively (where you have previously opted-in but have since not given an opt-out preference)
To understand the effectiveness of the online advertising we show you and to deliver relevant advertising to you via our website Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively
To make recommendations via our website regarding goods and services we believe may be of interest to you Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively
To ensure that the content on our website is presented to you and your computer as effectively as possible so that you can find the correct tickets for your journey Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively 
To create statistical information, market research, analysis, individual and group customer profiles to better manage and run our business, including for marketing and customer service purposes. Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively
To monitor our websites to ensure that they are functioning correctly and that you receive the correct advice and best value tickets for your journey Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively
To allow you to use the interactive features of our websites and app in planning your journey and purchasing tickets Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively
To verify and protect your personal information when using our website or purchasing tickets Our use of your data is necessary for our legitimate interests in ensuring that the service we provide to you is administered effectively
To provide data to public authorities where legally required. We have a legal obligation to use your personal information where lawfully requested or required to do so by public authorities

Our legitimate interests and your right to object

Legitimate Interests means the interests of our company in conducting and managing our business [to enable us to give you the best service/products and the best and most secure experience].

For example, we have an interest in making sure our marketing is relevant for you, so we may process your information to send you marketing that is tailored to your interests. It can also apply to processing that is in your interests as well.

When we process your personal information for our legitimate interests, we make sure to consider and balance any potential impact on you (both positive and negative), and your rights under data protection laws. Our legitimate business interests do not automatically override your interests - we will not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Whenever we process data for these purposes we will ensure that we always keep your Personal Data rights in high regard and take account of these rights. You have the right to object to this processing. If you wish to do so, please let us know by contacting DSAR@eastmidlandstrains.co.uk. Please bear in mind that if you object, this may affect our ability to carry out the tasks for your benefit.

How we use your personal information

We use administrative, electronic and physical security measures to ensure the information we collect about you is protected from access by unauthorised persons and protected against unlawful processing, accidental loss, destruction and damage.

We also have a legal obligation under data protection legislation to keep the personal information we collect accurate and up to date. Amongst other things, it helps us ensure that we do not contact you with inappropriate information and marketing messages and also prevents us from wasting valuable resources on print and postage. You can:

  • Contact us to correct or change your information by emailing DSAR@eastmidlandstrains.co.uk
  • Login to your online account to update your information and/or change marketing preferences

In addition, when you contact us we may ask you to confirm certain details during that call and, if we receive an undelivered mail or email we will update your personal information to reflect the fact that your data is no longer up to date

How we use your personal information for marketing

By using the information you provide to us, we are able to contact you with specific marketing messages about travel offers, ideas and news and, depending on the permission you have given us or another organisation this may be by post, email, telephone, SMS or social media.

If you have given us your consent to use your personal information for marketing, you have the right to withdraw your consent at any time by contacting DSAR@eastmidlandstrains.co.uk, clicking the “unsubscribe” link in our marketing emails or replying STOP to a text message. You can also log into your account on our website at any time to update your marketing preferences.

Sharing your personal information

We do not share or sell your personal information to any other company for marketing purposes, however; there are several situations where we use trusted suppliers to help us deliver our service to you. To do this, we allow the supplier limited access to the personal data they need to provide their service. A list of our service suppliers are listed below:

  • Mailing houses to send you pre-booked tickets
  • Website hosting companies which we use to administer our website content, including personalised timetables
  • Our on-train wi-fi supplier
  • Agencies which we use to manage season tickets and loyalty programmes
  • Agencies which we use to analyse traffic on our website and use of our services
  • Market research organisations
  • A database company that supports us in keeping all our records in order
  • The organisation that runs our booking system
  • The agency that handles our customer service enquiries, complaints and refunds
  • Fraud checking and prevention organisation.

We also use trusted suppliers to help us with marketing:

  • An email service provider to send our emails and make sure you only receive what you have asked for.
  • A mailing house to send out marketing by post.
  • A telemarketing agency to contact you by phone or SMS.
  • An organisation which helps us keep your information accurate and up to date.

All personal information sent to our trusted suppliers is encrypted. In all cases we require these companies to strictly comply with our instructions and they are not allowed to use your information for their own business purposes. We also require these companies to have sufficient organisational and technical measures in place to ensure the security of your personal information.

We may use suppliers who operate outside of the country of which you are a resident, for example in the United States. These countries may not offer the same legal protection of your personal information as the UK. If we use one of these organisations, we take appropriate steps to ensure that they provide an adequate level of protection in accordance with UK data protection law. By submitting your personal information to us you agree to this transfer, storing or processing of your personal information at our approved locations outside the EEA.  If you would like to know more about the ways in which we safeguard your personal information, please get in touch using the contact details in this policy.

Under some circumstances we may be required to disclose or share your information without your consent, for example if we are required by the police, the courts or for other legal reasons.

We operate our rail franchise for a given period under licence from the Secretary of State for Transport. If at the end of that period the franchise is granted to another rail operator, we may be required to disclose your personal information to the new operator and/or franchising authority. They are required to process your data lawfully and as described in this Privacy Notice.

Your rights regarding our use of your personal information

You provide us with details of what we can do with your data and have the right to manage your choices as detailed in How we use your personal information for marketing.

You have the following rights:

  • To know that your data is being processed
  • To access a copy of your personal data by making a Subject Access Request (SAR)
  • To have your information corrected if inaccurate
  • To data portability (if applicable)
  • To request that your data be erased, restrict processing, object to processing and;
  • To rights relating to automated decision making and profiling.

Automated Decision Making

An automated fraud assessment may take place to make a decision whether to accept or decline your purchase. You have the right to contest the decision, to express your point of view, and to require a human review of the decision. You can exercise this right by contacting us using the contact details provided.

Accessing your Data by Subject Access Request (SAR)

You have the right to request a copy of the information that we hold about you, this is known as a Subject Access Request (SAR). Once we have confirmed your identity, we will provide this to you free of charge within 30 days of your request.

If you would like a copy of some or all of your personal information, please email or write to us using the contact details in this policy. Unless you specify otherwise, we will provide your information electronically.

If we do hold information about you, we will:

  • Give you a description of it
  • Tell you why we are holding it
  • Tell you who it could be shared with
  • Tell you how long we will keep the information
  • If the information was not provided by you, we will give you any available information such as the source of the data
  • Tell you if the information has been used for automated decision making and explain the logic involved in the decision-making process
  • Tell you if the information is stored outside of the European Economic Area, and if so what safeguards are in place to protect your personal information
  • Let you have a concise and clear copy of the information

How we keep your personal information up to date

We have a legal obligation to keep the personal information we collect accurate and up to date. You have the right to ask us to correct any inaccuracies in the personal information we hold about you and to restrict the use of your information until it has been corrected.

The simplest way to keep your data accurate is to login into your East Midlands Trains online account

We keep your information accurate as follows:

  • By giving you the opportunity at any time to contact us to correct or change your information.
  • If you contact us we may ask you to confirm certain details.
  • When we receive undelivered mail or email we will update your personal information accordingly.

We have specific rectification, restriction, objection and erasure policies in place to make sure we respond effectively to such requests.

How we keep your personal information safe

We have a legal obligation under data protection legislation to keep the personal information we collect accurate and up to date. Amongst other things, it helps us ensure that we do not contact you with inappropriate information and marketing messages and also prevents us from wasting valuable resources on print and postage. You can:

  • Contact us to correct or change your information by emailing DSAR@eastmidlandstrains.co.uk
  • Login to your online account to update your information and/or change marketing preferences

In addition, when you contact us we may ask you to confirm certain details during that call and, if we receive an undelivered mail or email we will update your personal information to reflect the fact that your data is no longer up to date

How long we keep your personal information

Of the data we process, we retain the data for no longer than 6 years. Where reasonably practicable, data is minimised so as not to be identifiable to the data subject, unless required by law.

We keep your personal information where we have:

  • A legal or regulatory requirement requires that we hold data for a specific time
  • The business has a legal basis to retain data, including data opt-ins, revised opt-ins, renewed consents and for legitimate interests

What to do if you have a complaint about our use of your personal information

If you have a complaint about the information we hold or how we use that information, please contact us by emailing DSAR@eastmidlandstrains.co.uk or sending a letter to our postal address. We will deal with your request promptly and if you are not satisfied with the way your complaint was handled, you can refer your complaint to UK Information Commissioner’s Office. https://ico.org.uk/concerns/

Links to other websites

We link our website directly to other sites. This privacy notice does not cover the links within our site linking to other websites and organisations. We encourage you to read the privacy statements on the other websites you visit.

Changes to this privacy notice

This privacy notice does not provide exhaustive detail of all aspects of our collection and use of personal information. However, we are happy to provide any additional information or explanation using the contact details at the beginning of this privacy policy.

We keep our privacy notice under regular review. This privacy notice was last updated on May 23, 2018.