Privacy policy

September 2023

Executive summary

This is a short overview of the processing of your personal data by Eurostar. The section below will provide you with the full details regarding the processing of your personal data.

Our commitment to protecting your privacy

We use your data to provide you with a unique train travel experience in Europe.

We need to collect and store your data, such as your name, email address, travel details and payment details to provide you with our train services.

We use the data you share with us and our distributors to provide you with your travel tickets, to let you know if there are changes to your trips, to manage access to the stations, ensure safety on board our trains or comply with your legal obligations.

If you are a member of our Club Eurostar reward programme, we will also use your data to allow you to earn Points and redeem them against free train tickets or choose other gifts and advantages.

We use your data to provide you with services that suit you better.

We analyse the travel data of our travellers to develop innovative services and offers to best suit our travellers.

Moreover, if you consent to receive marketing emails from Eurostar, we will send you information about our promotions, our new service proposals, our contests, and our partners' offers. Please note that in this case, your data will only be shared with these partners when it is necessary.

We may share your data to allow our trains to travel across Europe.

We may share some of your data with third parties to provide you with our services or when we are required to do so by law.

Third-party recipients of your data include Official government authorities, Safety regulatory organisations, other train companies, partners providing you with services, data analytics or service providers.

We do not sell and will not at any point sell your personal data.

You have control of your data.

You can manage your personal data and your marketing communication preference through your Club Eurostar account.

If you want to obtain more information about the data we have about you or if you want to exercise your rights of rectification, portability, erasure of your data and your rights to object and limit processing, simply contact us at data.protection@eurostar.com.

Eurostar (“we”) consisting of Eurostar International Limited (“EIL”) [1] and THI Factory (“THIF”) as Joint Controllers use your personal data to provide, maintain and continuously improve the travel services offered to you. We respect your privacy and are committed to handling your personal data in strict compliance with our Data Protection regulatory obligations.

In this Privacy Notice, we specifically detail how we collect, handle, store or otherwise process your personal data (“data”) you submit to us. Please take the time to familiarise yourself with it.

EIL and THIF act as joint controllers. This means that both companies jointly determine the purposes and means of processing your personal data. Please see below for the identity of both data controllers:

Eurostar International Limited
6th Floor, Kings Place, 90 York Way
London N1 9AG, United Kingdom
Registered company number: 2462001

THI Factory
4 Place Marcel Broodthaers
1060 Brussels, Belgium
Registered VAT number BE 0541.696.005

EIL and THIF are now part of the same group of companies, Eurostar. Within the group, our processing activities are supported by centralised databases and systems which may be hosted or managed by a Eurostar company on behalf of another Eurostar company. Additionally, and for efficiency purposes, certain operation and commercial functions may be performed by one Eurostar company on behalf of the other.

This Privacy Policy applies to:

• Users of the Eurostar.com website
• Travellers who use our trains
• Travellers using the café.eurostar.com
• Members of the Club Eurostar reward program
• Members of our travellers’ panel
• Users of our on-board WiFi services
• Travellers in our lounges

Your personal data (hereinafter “your data”) is data which allows your identification as a natural person either directly, or through a combination of different information sources indirectly. Here are the types of direct and indirect data we may process:

• personal details, including: first name, surname, home address, telephone number, email address, etc.;
• professional information;
• lifestyle and consumption of goods and services;
• purchase and points exchange history;
• financial information, such as your credit/debit card number or other billing information (to execute your ticket orders, ThePass subscription orders or to make a possible refund, or execute your order with the Eurostar Café);
• travel details including Passenger Name Record (“PNR”), Ticket Number (“TCN”), seat, coach, origin, destination, date of travel;
• passport details if you are required to provide them for border controls;
• hobbies and interests;
• recording of images and sounds from cameras or when calling customer service;
• online ID and password (Club Eurostar account);
• business profile (preferred products and services, preferred modes of communication, etc.);
• your comments and suggestions on Eurostar products or services;
• information relating to navigation and behaviour on our website (depending on the pages viewed, the products viewed, searches performed, etc.);
• geolocation data, including your IP address, or physical location only when you request geolocation-based services and when paying for products or services via credit card.

The section below outlined how we use the personal data we may collect, process, store or otherwise handle (depending on how you use our services and our websites):

Why do we use your data

We can only use your personal data if we have a proper reason for doing so. This is commonly referred to as the “lawful basis”.

In general, we use your data:

• when we have your consent.

In this case, we process your data only for the purposes to which you have agreed as specified on the consent form you have completed.

As an example, you can explicitly consent via an opt-in to receiving communications from Eurostar. If you agree, Eurostar will electronically send you newsletters or other personalised communication based on your traveller’s profile containing commercial information about new services and products, promotions and benefits, the opportunity to participate in games, surveys, as well as information regarding our partners, etc.

If you no longer wish to receive our communications, you can withdraw your consent at any time via the link integrated directly into our marketing communications. You can find more information about this under the section Withdrawing your consent.

Your devices should also ask for your consent when you log in to our application for the first time to allow us to send you push notifications. This allows us to keep you informed of changes to your trip and offers that may be of interest to you. If you no longer wish to receive notifications, you can withdraw your consent at any time by changing the notification settings on our app via your phone settings.

• as part of the execution of your contract or for the actions taken in order to conclude the contract, to:

- allow you to purchase a trip (purchases or bookings from the eurostar.com website and on the websites of our distributors) [2] or products/services related to travel offered by Eurostar or gifts and benefits;
- provide and track the products or services purchased;
- manage your complaints and guarantee you quality customer service;
- check the validity of your ticket;
- provide you with information about your trip (text message if your train is delayed, or other information about your itinerary, such as the cancellation of your train);
- make a payment or a refund, if applicable;
- allow you to create a Club Eurostar account;
- manage the collection of points to redeem them against train tickets or gifts and benefits and to access your purchase history and the data for managing your account;
- allow you to buy and manage your Carte Blanche subscription;
- allow you to buy and manage your thePass subscription;
- manage your requests related to the supply of related products and services offered by our partners and processors (choice of meals on board, car rental, booking of taxis and hotels, reservation of Lounge rooms);
- be able to deal with your questions, messages or requests and to respond to them;
- allow you to access magazines/newspapers online (via our mobile application or website);
- allow you to access our Wifi on board our trains and in the lounges;
- allow you access to our lounges;
- place an order and execute your order with the Eurostar Café.

We need to collect some of your data to execute your contract. If you choose not to share this data with us, it may render the performance of the contract impossible.

• as part of the execution of your contract or for the actions taken in order to conclude the contract, if you are a member of our Eurostar Panel to:

- collect your comments and suggestions on Eurostar products or services;
- allow you to participate in online surveys to help Eurostar improve its offers;
- allow you to participate in quizzes and games;
- allow you to participate in events organised by Eurostar.

We need to collect some of your data in order to execute your contract. If you choose not to share this data with us, this may make it impossible for you to participate in the Panel.

• to comply with all legal and regulatory obligations to which we are subject, including:

- prevention and detection of terrorist offences and other serious forms of crime;
- implementation of legislation (such as the GDPR);
- tax and accounting obligations of Eurostar;
- transportation safety obligations;
- obligations relating to the fight against health crises.

• for purposes that are in our legitimate interest, in which case we seek to preserve a proportionate balance between our legitimate interest and respect for your privacy. In this context, your data can be processed in order to:

- protect Eurostar property;
- prevent abuse and fraud, please refer to the Profiling section;
- disclose any abuse that may or may seriously prejudice the financial status, results and/or reputation of Eurostar;
- control the regularity of our operations;
- maintain safety on board and near our trains;
- sanction certain irregularities (such as no valid ticket) through payment of a fine;
- manage and improve our relationship with you;
- continuously improve our website and our products/services (in particular by conducting satisfaction surveys and analysing data collected via cookies);
- conduct market research on our products/services or to develop new products/services;
- contacting you to remind you to complete your order when you have started the process of ordering a trip without completing the purchase ("abandon cart").
- analyse data, establish sales and sales activity reports, frequency of visits and establish marketing profiles;
- analyse whether you are eligible for our Panel programme (based on your number of trips purchased);
- adjust our products and services that are available to you and adapt them to your needs, in particular by offering tailored services that could interest you based on the Club Eurostar profile created by you, please refer to the Profiling section;
- carrying out analyses in the context of mergers or takeovers of Eurostar activities;
- exercise, defend and preserve our rights, for example during litigation, as well as to compile the proof of a possible violation of our rights.

Profiling

Traveller profile: to better meet your needs and expectations, and offer you the best services and the most suitable rates:

• we determine general or specific customer profiles, including:

- the type of passenger you are;
- your profile, which is a summary of the information you have shared with us, and/or the products/services you have used

• we examine the overview of the products and services you have purchased;
• We measure your (sub)optimal use of a product or service.

It is in our legitimate interest to do this profiling to improve your customer experience. We reassure you that this profiling is not intended for automated decision-making with negative consequences for you.

Combating fraud by profiling: the security and the proper functioning of our sites is a major issue. A number of data is analysed automatically by our systems or those of our subcontractors to determine a level of fraud risk associated with each order.

The analysis criteria include browsing behaviour and bank details.

Depending on the results of this risk analysis, and after checking with our anti-fraud teams, Eurostar may do one of the following:

• validation of your order
• request for additional proof
• refusal of the order
• order cancellation with refund

In the event of a confirmed problem with an order, or in the event of non-payment, your data will be included in Eurostar’s alert file and we may carry out additional checks for future orders.

It is in our legitimate interest to carry out this profiling to improve your customer experience and for anti-fraud purposes for the financial security of Eurostar.

We reassure you that this profiling is not intended for automated decision-making with negative consequences for you.

Special category of data and data relating to minors

In certain circumstances, we may process “special category” of data. This includes, but is not limited to:

• assistance requirements if you are a passenger with reduced mobility or other needs including an unaccompanied minor. We shall process data related to your health to provide you with the assistance you need. We also share those data with assistance services provided by stations, more details in section 9 below.
• if you have requested a special meal not ordinarily offered by our on-board catering service we may process personal data which implies or suggests your religion (e.g. a kosher or halal meal), or data related to your health (e.g. a dairy or gluten-free meal).
• if you have been involved with an accident or incident either on-board or at the station we may process special category data to assist you, and properly investigate the situation.

In certain circumstances, we may process “special category” of data. This includes, but is not limited to:

• assistance requirements if you are a passenger with reduced mobility or other needs including an unaccompanied minor. We shall process data related to your health to provide you with the assistance you need. We also share those data with assistance services provided by stations, more details in section 9 below.
• if you have requested a special meal not ordinarily offered by our on-board catering service we may process personal data which implies or suggests your religion (e.g. a kosher or halal meal), or data related to your health (e.g. a dairy or gluten-free meal).
• if you have been involved with an accident or incident either on-board or at the station we may process special category data to assist you, and properly investigate the situation.

We only keep data for as long as we have a valid reason to do so. The exact period of time is determined by what we are using it for. This can range from the provision of services to you, for our own legitimate interests (described above) or so that we are able to comply with any legal obligations we are subject to. Legal requirements to retain data are set by each jurisdiction we operate in and will depend on local laws.

We share some of your data with, or obtain data from the following categories of third parties:

Official government authorities such as border control authorities and law enforcement authorities

We sometimes are obliged to provide your data to official government authorities to ensure that you have the correct eligibility to travel to your destination or to meet any legal or regulatory obligations we may have.

Safety standards organisations

We share data about any accidents or serious incidents at our stations or on our services with the Rail Safety and Standards Board (‘RSSB’), whose aim is to improve safety throughout the rail industry. The RSSB processes this data in accordance with their own privacy notice.

Other transport companies

We sell through fares, which are train tickets for travel on both our train service and a train service provided by another third-party non-Eurostar train company. Similarly, third-party train companies and distributors which you have bought a ticket directly from would share your data with us.

Tour operators or companies through which you booked your Eurostar tickets

Tickets for travel on our services are sold through many channels, including third-party travel agencies. These third-parties have to share your booking information with us to enable you to travel. We may also use booking metadata to build up our knowledge about your preferences and needs.

Suppliers who provide services to us

We will share your data with different suppliers who provide services to us. For example, we share your data with the company which provides our on-board catering services in order to facilitate any meal preference requests. We may share your data with suppliers who we are engaged with for market research purposes and feedback on the services we provide to you. We ensure any suppliers engaged which process your data do so with the utmost respect and compliance with data protection laws.

Digital wallet management services

We will share information regarding your ticket if you elect to use the various digital wallet management services such as Apple Wallet and Google Play.

Partners who provide services to you

When you make a booking for a service which will be provided either in whole or in part by one of our partners we share your data with them in order for them to provide the service to you. For example, we may share your data with our insurance partner Allianz when you buy one of their insurance products.

Data analytics companies and advertisers

Depending on the cookie and other technology settings you have selected through our Cookies management tool, we may use your data in our own data management platform. This platform helps us understand more about your preferences and behaviours whilst using Eurostar.com in order to provide you with an enhanced user experience. We may use such data to make a connection between you and several devices you may use to ensure relevance across these devices.

Occasionally we may add to your data other information we have received from third-party advertisers or from other companies in the Eurostar.

Finally, from time-to-time we may share a limited amount of pseudonymised data with other advertisers. For more information about this, please see our specific Cookies and Other Technologies Policy.

Data enrichment providers

We may share data we hold about you with data enrichment providers so they are able to cross-check this data with data they may hold on you. If a successful match is made, we collect and store this additional information about you (for example your age and preferred language) to personalise any marketing communications you may have opted-in to receive. Any data enrichment parties we use do not store your data nor do they share it with any additional third-parties.

Payment service providers

In order to process payments and to prevent and detect fraudulent activity, we process payment card data through various payment and fraud management service providers.

Special Assistance

To provide you with special assistance in the stations, we coordinate with stations management services in the countries in which we operate. In that context, we act as joint data controller with the companies managing the stations that provide the requested assistance in Belgium, France, Germany and the Netherlands. [3]

For any information on our joint data controller agreements with those assistance management services, please contact our DPO: privacy@eurostar.com.

In any circumstances, Eurostar do not and will never sell your data to anyone.

When you use our “Chatbot” on our website, any data you submit is processed in order to:

• answer your questions;
• manage your refund and compensation requests (in this case, we use the PNR and date of your trip);
• process your complaint (in this case, we use your credentials and your e-mail address); and
• improve the chatbot itself via a self-learning tool.

Chatlogs from the conversations you have with the chatbot during your session will be anonymised and aggregated to be sent to our third-party supplier for analytical and service improvement purposes. Due to the free-form nature of interacting with the chatbot, please do not mention any personal data or data unless specifically prompted to do so.

Data transfers to the United Kingdom

EIL headquarters are located in the United Kingdom. According to the European Parliament resolution of 21 May 2021 on the adequate protection of personal data by the United Kingdom (2021/2594(RSP)), the United Kingdom provides an adequate level of data protection and no further requirements are needed to transfer data to the United Kingdom. Should there be a change regarding this adequacy decision, Eurostar will take all necessary measures to make sure the data transfers to the United Kingdom are compliant with the applicable legislation.

Data transfers to other countries outside the EEA

We will only send data outside the EEA to work with our suppliers and advertisers who we use to deliver services to you or to comply with a legal duty. If we do transfer data outside the EEA, we will make sure that is afforded an adequate level of data protection. We will use one of the below safeguards to ensure such protection:

• transfer the data to a non-EEA country which has privacy laws at least as protective as those within the EEA (known as EU adequacy decision); or
• enter into a written agreement with the recipient of the data binding the recipient to protect data to the same standards as required within the EEA.

Both the EU and the UK GDPRs as well as other data protection laws empower you and give you control over the data you share with various organisations.

In order to reasonably assist us with locating your data, when making a request on the below heads we ask that you provide the following basic information:

• your full name
• the email address associated with your request
• a rough time frame of what period you are requesting your data from
• any other information you may have to assist us searching for your data.

Below are the rights available to you as data subjects under data protection law.

We aim to respond to requests within one calendar month of identity verification of the requestee, however we reserve the right to extend this by a further two calendar months in the event of complex or numerous requests.

Should your request be deemed manifestly unfounded or excessive in nature we reserve the right to refuse to fulfil your request or charge a flat fee to process it further.

The Right to be Informed

• You have the right to receive confirmation from us that we are processing your data.

The Right of Access

You are entitled to request a copy of all the personal data currently processed by us as well as the following information about your data:

• the lawful basis and purpose of processing
• the categories of data processed
• the recipients with whom the data has been shared
• the actual or envisioned retention period

The Right to Rectification

We take all reasonable steps to ensure that your data that we process is accurate and up-to-date. For whatever reason you believe that the data that we process is either inaccurate or incomplete, you are able to request that we correct or complete this data.

We encourage you to regularly access and check your Eurostar.com or Club Eurostar account to ensure that your information is up-to-date.

The Right to Erasure

You have the right to request the erasure of your data when there is no valid reason for us to continue processing it. Please note that the right to erasure is not absolute and certain data may be retained for overriding legal purposes.

The Right to Restrict Processing

You have the right to request that we suspend processing your data without full erasure in the following circumstances:

• you believe the data we process is inaccurate;
• you believe the processing of your data is being done unlawfully, but do not wish for us to erase it;
• when you require us to store the data for longer than the retention period prescribed in order to establish, exercise or defend legal claims; or
• you have exercised your right to object and we are currently verifying whether overriding ground to continue processing exists.

The Right to Data Portability

You may request your personal data be transferred to another controller or processor in a commonly used, machine-readable format. Please be aware that this right is only able to be exercised when all the below grounds apply:

• the processing is done on the lawful basis of consent;
• the processing is done so by automated means; and
• the processing is for the fulfilment of a contractual obligation.

The Right to Object

Where we process your data on the lawful basis of “legitimate interest” you may exercise your “right to object” to such processing. Please be aware that we reserve the right to continue processing your personal data in such a way as long as we are able to justify the legitimate reasons to do so.

The only exception is when you exercise your right to object against any direct marketing communications, which is absolute and requires no further action.

Withdrawing Consent

When we process your data on the lawful basis of consent you are entitled to withdraw this at any time. Withdrawal of consent does not affect the legality of the processing of your data during the time when your consent was still active and valid. There may be circumstances whereby we are still entitled to process your data for overriding legal or regulatory purposes.

For direct marketing, which is processed on consent, the right to withdraw your consent is absolute and requires no further qualifications.

Enforcing your GDPR rights

If you wish to take action of any of the above rights, please visit our Data Request Webform. Alternatively, you may contact our dedicated data protection team at data.protection@eurostar.com who can assist you with your request.

Complaints

If you have any concerns or complaints about Eurostar’s processing of your data you are able to contact our Eurostar DPO directly at privacy@eurostar.com. Alternatively, you may write to them at:

Data Protection Officer
Eurostar International Limited
Kings Place
90 York Way
London, N1 9AG, United Kingdom

Or

Data Protection Officer
THI Factory
4 Place Marcel Broodthaers
1060 Brussels, Belgium

You have the right to lodge a complaint with the national data protection supervisory authority responsible for the protection of personal data in the country where you live or work, or in a country which you think a breach of data protection laws has taken place.

Customers in the UK can contact the Information Commissioner’s Office by telephone on +44 (0)303 123 1113, or by using the live chat service which is available through the Information Commissioner’s website www.ico.org.uk.

Customers in France can contact the Commission Nationale de l'Informatique et des Libertés by telephone on +33 (0)1 53 73 22 22 or by writing to the Commission at 3 Place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07, France.

Customers in Belgium can contact the Autorité de Protection des Données by telephone on +32 (0)2 274 48 00 or by using the online contact form available through the Autorité de Protection des Données website at www.autoriteprotectiondonnees.be

Customers in the Netherlands can contact the Autoriteit Persoonsgegevens by telephone on +31 (0)70 888 85 00 or by writing to the Autoriteit Persoonsgegevens at Postbus 93374, 2509 AJ DEN HAAG.

1. Including all its subsidiaries, Eurostar International Limited, Eurostar Holidays Limited, Eurostar France, Eurostar International SAS, Eurostar International SPRL.

2. In the rail context, a "distributor" refers to the entity that will take care of the sales of tickets to passengers.

3. If travelling to and from London, call us on: +32 (0)2 400 67 76. For journeys between Belgium, France, the Netherlands, and Germany, call us on: +32 (0)2 400 67 76.