Privacy Policy & Data Protection Policy

Introduction
We are Virgin Rail Group Holding Limited, or more simply, Virgin Trains. This privacy notice is to let you know how we promise to look after your personal data. This notice explains how we do this and tells you about your privacy rights and how the law protects you.

Virgin Trains is the trading name for Virgin Rail Group Holdings Limited and its subsidiaries as follows: Virgin Rail Group Holdings Limited, Registered in England and Wales No. 4196341. Virgin Rail Group Limited, Registered in England & Wales No. 328548. Virgin Rail Group Holdings Limited are registered in England and Wales No. 3007940. Registered Office: The Battleship Building, 179 Harrow Road, London, W2 6NB, VAT no. 672859095.

You can find out more about us at www.virgintrains.co.uk.

If you have any questions or want more details about how we use your personal data, please let us know. See the 'how to contact us' section below for all the different ways you can get in touch.

Did you travel with us on the West Coast Mainline?
If you used to travel with us, unless we had your permission to use your information for marketing purposes or you have an active booking we no longer hold your data. Your data was only transferred onto the successor operator of the West Coast Mainline if you provided your consent.

What personal information do we collect?

Technical: Details on the devices and technology you use
Communications: What we learn about you from letters, email, and conversations between us
Usage of data: Other data about how you use our products and services
Documentary data: Details about you that are stored in documents in different formats, or copies of them
Special types of data: The law and other regulations treat some types of personal data as special. We will only collect and use these types of data if the law allows us to do so.
Consents: Any permissions, consents or preferences that you give us

 

What types of personal data do we use?
We use many kinds of personal data, and group them together like this.

Data we collect when you use our products, services and facilities:
Profile and usage data 
Communication
Customer Satisfaction
Competition & Promotion
Recruitment


Who do we share your data with?
We may share your personal data with these organisations:
Regulators and other competent authorities
Fraud prevention agencies
Companies you ask us to share your data with

How do we use your data?
Data Protection law says that we can use personal data only if we have a proper reason to do so. This includes sharing it outside Virgin Trains. The law says we must have one or more of these reasons:

To fulfil a contract we have with you
When it's our legal duty
When it's in our legitimate interest
When you consent to it.

A legitimate interest is when we have a legitimate business or commercial reason to use your information. But even then, it must not unfairly go against what is right and best for you. If we rely on our legitimate interest, we will tell you what that is.

Below is a list of all the ways that we may use your personal data, and which of the reasons we rely on to do so. Our legitimate interests are also below.

Serving our customers
What we use your personal data for:
To deliver our products and services
To manage our relationship with you or your business
To develop new ways to meet our customers’ needs and to grow our business
To develop and carry out marketing activities
To study how our customers use our products and services
To market our products and services

Our reasons:
Your consent
Fulfilling contracts
Our legitimate interests
Our legal duty

Our legitimate interests:
Keeping our records up to date
Working out which of our products and services may interest you and telling you about them
Developing products and services, and what we charge for them
Defining types of customers for new products and services
Seeking your consent when we need it to contact you
To provide you with information relating to how you can travel with us
As an active customer to keep you informed about our latest offers, deals and competitions
Being efficient about how we fulfil our legal and contractual duties
 

Reducing crime and operating in a safe and lawful manner
What we use your personal data for:
To detect, investigate, report, and seek to prevent fraud
To manage risk for us and our customers
To obey laws and regulations that apply to us
To respond to complaints and seek to resolve them

Our reasons:
Fulfilling contracts
Our legitimate interests
Our legal duty

Our legitimate interests:
Developing and improving how we deal with fraud, as well as doing our legal duties in this respect
Complying with regulations that apply to us
Being efficient about how we fulfil our legal and contractual duties

Operating our business effectively
What we use your personal data for:
To run our business in an efficient and proper way. This includes managing our business capability, financial position, communications, corporate governance, planning, and audit.

Our reasons:
Our legitimate interests
Our legal duty

Our legitimate interests:
Complying with regulations that apply to us
Being efficient about how we fulfil our legal and contractual duties

Developing our products and services
What we use your personal data for:
To develop and manage our brand, products, and services
To manage how we work with other companies that provide products and services to us and our customers
To find people who might benefit from using our products and services

Our reasons:
Fulfilling contracts
Our legitimate interests
Our legal duty

Our legitimate interests:
Developing products and services, and what we charge for them
Defining types of customers for new products and services
Being efficient about how we fulfil our legal and contractual duties
Complying with regulations that apply to us

What happens if we send your data outside of the EEA?

We will only send your data outside of the European Economic Area (‘EEA’) to:
Comply with a legal duty
Provide our products and services

If we do transfer information outside of the EEA, we will make sure that it is protected in the same way as if it was being used in the EEA. To do this, we will use one or more of these safeguards:
Only transfer it to a non-EEA country with privacy laws that give the same protection as the EEA, as deemed by the European Commission
Ensure that a contract with the recipient is in place that means they must protect it to the same standards as the EEA
Transfer it to organisations that are part of Privacy Shield. This is a framework that sets privacy standards for data sent between the US and EU countries.

You can find out more about these safeguards on the European Commission Justice and Information Commissioner’s Office (ICO) websites.

Here is a list of the services we currently use which are located outside of the EEA:

Service provider: Purpose: Location: Safeguards:
The Trainline

Customer Services After Sales

India Binding Corporate Rules
EU Model Clauses 

 

How do we use your data for marketing?
We may use your personal data to tell you about our relevant products, competitions and offers. This is what we mean when we talk about ‘marketing’. We may also use your data to help create a profile to find potential customers like you.

We will send you marketing based on what you tell us about yourself, data we collect when you use our services, and using information from third parties we work with. We use this information to get a view on what we think would interest you the most.

We will only send you marketing messages if we have either your consent or a legitimate interest. This is when we have a legitimate business or commercial reason to use your information that does not unfairly go against what is right and best for you.

You can ask us to stop sending you marketing messages by contacting us at any time by clicking unsubscribe at the bottom of any marketing email or updating your preferences in your online account.

Whatever you choose for marketing, you'll still receive service messages, such as booking confirmations and timetable changes.

How long will we keep your personal data?
We will keep your personal data for as long as you are a customer of Virgin Trains to respond to any questions, claims or complaints. We will also retain your information for Marketing Purposes while you have provided your consent or we have a legitimate interest.

What rights do you have to your personal data?

You have a number of rights in relation to your personal data. There are circumstances in which your rights may not apply. You have the right to request that we:

provide you with a copy of the information we hold about you;
update any of your personal information if it is inaccurate or out of date;
delete the personal data we hold about you - if we are providing services to you and you ask us to delete personal data we hold about you then we may be unable to continue providing those services to you;
restrict the way in which we process your personal data;
stop processing your data if you have valid objections to such processing; and
transfer your personal data to a third party.

If you want us to fulfil any of these rights, please let us know. See the 'how to contact us' section below for all the different ways you can get in touch.

How to contact us
If you have any questions or want more details about how we use your personal data, please let us know by sending an email to:

[email protected]


You also have the right to complain to the Information Commissioner’s Office. You can use the relevant section of the Information Commissioner's Office website to do this.