Privacy Policy

Last updated: April 2024

ON THE MOVE: THIS IS WHAT YOU NEED TO KNOW

We always recommend that our customers read this privacy policy in full. It explains who we are, how and why we collect personal data from you, how and why it will be processed by us and our commitment to protecting your data.

But just in case you’re on the move or do not have time to read it in full we have summarised the key points for you in our 'speed read' section below.

• Transpennine Express ("TPE", "we", "our" or "us") is a trading name of Transpennine Trains Limited.
• We have appointed a Data Protection Officer, who is responsible for overseeing our approach to data protection and protecting your privacy. You can contact our Data Protection Officer by email: tpe.dataprotection@tpexpress.co.uk or by post: 7th Floor, Bridgewater House, 60 Whitworth Street, Manchester, M1 6LT .
• We process (i.e. handle) your personal data to provide our services to you. Under the United Kingdom’s General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, (collectively referred to as the “Data Protection Laws“), we are only permitted to process your personal data where we have a legal basis for doing so. We will only ever process your personal data in compliance with applicable laws.
• We may share your personal data with our third party suppliers, including payment processors and data analysts, where it is necessary to enable the efficient and secure provision of services to you. Except as explained in this privacy policy, we will not share your data with third parties without your consent unless we:

  • are required to do so by law;

  • need to do so to allow us to exercise, establish or defend legal claims; or

  • are otherwise permitted to do so by the Data Protection Laws.

• We will retain your personal data for as long as it is necessary for us to keep it. This depends on what we are using it for, whether that is to provide services to you, for our own legitimate interests (described below) or so that we can comply with, or evidence our compliance with, the law. We will regularly review the personal data we hold and when there is no longer a customer, legal or business need for us to hold it, we will either delete it securely or in some cases anonymise it.
• We may transfer your personal data to a recipient located outside of the United Kingdom (UK). If we do this, we will ensure that any legal transfer mechanism required and as approved by the United Kingdom is implemented to ensure that your personal data continues to be subject to adequate level of protection. If you require additional information as to the mechanisms used, please contact our Data Protection Officer.
• The Data Protection Laws grant you a number of rights over your personal data. This policy sets out your rights and how you can exercise them. For more information, read section 11. You also have the right to make a complaint to the Information Commissioner’s Office if you are unhappy with how we have handled your personal data or responded to any request you have made to exercise your rights over your personal data. For more information on how to make such a complaint, please read section 14.

CONTENTS

1. About Transpennine Express

This section sets out who we are. It provides some useful information about us including our company number and registered address.

2. About This Privacy Policy

This section tells you when this privacy policy applies (e.g. when you use our website or communicate with us). It also lets you know how and when we will communicate updates of this privacy policy to you.

3. What Personal Data Do We Collect About You?

This section informs you of exactly what personal data we collect about you and why. This includes information that is provided to us directly by you as well as information that we gather from your visits to our website and information that we receive from other sources.

4. How is Your Personal Data Collected?

This section explains to you the different ways in which we will collect the personal data that you provide to us.

5. Purposes For Which We Will Use Your Personal Data

This section explains the purposes for which we will use your personal data we hold. We also set out what we consider to be the legal basis for processing your personal data for each purpose, this is to ensure that you have all the information that we are required to provide you by law.

6. Communications

This section explains how we will ensure that you only receive communications that you wish to receive. We will ensure that you have total control over the information that you receive.

7. Who Will Have Access To Your Personal Data?

This section explains which of our employees will have access to your personal data. It also explains the reason for our employees accessing your personal data.

8. Who Else Might We Share Your Personal Data With?

This section informs you of who we share your personal data with. It also explains the reason for sharing; this is largely so that we can provide our services to you.

9. How Do We Protect Your Personal Data?

This section explains how we keep your personal data safe and where it will be held. It also explains how we may process your personal data outside of the United Kingdom, but that we will only do so using recognised mechanisms which offer an adequate level of protection, when those are needed.

10. How Long Do We Keep Your Personal Data?

This section explains the length of time that we will retain your personal data. It also explains why we would hold your personal data for such time periods.

11. What Are Your Rights?

This section explains that you have rights in relation to your personal data. It also explains what these rights are and how you can go about exercising them.

12. Cookies

This section explains that our Website uses cookies and where you can find further information about the cookies used.

13. Freedom of Information

This section explains how you can make a request for information other than your personal data.

14. Who Can You Ask For More Information?

This section provides you with contact information should you have any questions or concerns about the way we handle your personal data. It also explains how you can contact the Information Commissioner’s Office (the statutory Data Protection Regulator) should you be unsatisfied with our response to your data protection issues.

1. About Transpennine Express

Transpennine Express ("TPE", "we", "our" or "us") is a trading name of Transpennine Trains Limited, a company registered in England and Wales under company number 12544930 whose registered office is at 7th Floor, Bridgewater House, 58-60 Whitworth Street, Manchester M1 6LT.

We are registered as a controller with the Information.

2. About this privacy policy

This privacy policy applies to the personal data we collect about you through our website https://www.tpexpress.co.uk/ by post, by telephone, in person (for example in stations and on board), through our apps and when you otherwise communicate with us.

This privacy policy may change from time to time and, if it does, the up-to-date version will always be available on our Website. We will also tell you about any important changes to our privacy policy.

3. What personal data do we collect about you?

This section informs you of what information we collect about you and why. Personal data means any information about an individual from which that individual can be identified.

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data  includes first name, surname, username or similar identifier, marital status, title, date of birth, gender and CCTV footage.
• Contact Data includes billing address, delivery address, postcode, email address and telephone numbers.
• Financial Data  includes bank account and payment card details.
• Transaction Data  includes details as to your journeys, details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data  includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Profile Data  includes your username and password; purchases or orders made by you; your stated interests that help us personalise the services we offer to you; travel preferences such as your home station, and whether your travel is for leisure, business, or commuting; feedback; survey responses; and your date of birth. This also encompasses your content preferences, such as your interest in family-related content or other specific types of information you have indicated you would like to receive from us. If you have opted into marketing communications, we will use this information to ensure that the marketing messages we send you are tailored to your interests and preferences, making them more relevant and valuable to you.
• Usage Data includes information about how you use the Website, products and services.
• Health Data  includes information relating to your mobility and disability status to enable us to provide Passenger Assist and ensure that you receive the correct pricing and any information detailed within any accident reports that relates to personal injury or receipt of medical attention.
• Marketing Data includes your preferences in receiving marketing from us and from third parties.
• Communications Data means any communication preferences you have indicated.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose where it is anonymised, i.e. cannot be used to identify any specific individual. Aggregated Data is not considered personal data in law as this data does not directly or indirectly reveal your identity. An example of Aggregated Data would be where we use your Usage Data to calculate the percentage of users accessing a specific Website feature. If the Aggregated Data is combined with other personal data to directly or indirectly identify you, we will treat this combined data as personal data and in accordance with this privacy policy.

Special Category Data
Includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not seek to collect or otherwise process your Special Category Data, except where:

• we have obtained your explicit consent prior to processing your Special Category Data (e.g. you consent to us processing your Health Data to provide travel assistance services to you);
• the processing is necessary for compliance with a legal obligation;
• the processing is necessary for the detection or prevention of crime (including the prevention of fraud) to the extent permitted by applicable law;
• you have manifestly made those Special Category Data public;
• the processing is necessary for the establishment, exercise or defence of legal rights; or
• processing is necessary for reasons of substantial public interest and occurs on the basis of an applicable law that is proportionate to the aim pursued and provides for suitable and specific measures to safeguard your fundamental rights and interests.

4. How is your personal data collected?

We use different methods to collect data from and about you including through:

Direct interactions:

We collect personal data about you if you fill in forms on the Website or correspond with us by telephone, email or otherwise. This includes information you provide when you:

• register to use our Website or app;
• buy train tickets or other products or services;
• enter a competition, promotion or survey; or
• report a problem with our Website or give us feedback.

We may also ask you to share your personal data with us, either directly or via a third party, if it is necessary for us to provide our services to you – for example, where you have booked a seat via a third party ticket provider.

We may also ask you to share your personal data with us, either directly or via third parties, if it is necessary for us to know this so that we can comply with legal obligations imposed on us, for example, we may ask if you require mobility assistance when travelling.

We may process personal data that you manifestly choose to make public, including via social media (e.g. we may collect information from your social media profile(s), to the extent that you choose to make your profile visible).

Automated technologies or interactions:

If you use our Website, we automatically collect the following information where you have consented to us installing cookies on your device:

• web usage information (e.g. IP address), your login information, browser type and version, time zone setting, operating system and platform;
• demographic and interest data (such as age, gender, and interests), as well as cross-device tracking information to help us better understand how users interact with our services across different devices;
• and information about your visit, including the full Uniform Resource Locators (URLs) clickstream to, through and from our Website (including date and time); time on page, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs).

Where we collect information about you in the ways described above, we do so on the basis that it is in our legitimate interests to collect and process this data. In most situations this will be anonymised but we collect and process this data to ensure that our site is functioning properly and that our customer experience is to the standard that you and we expect.

Our Website may, from time to time, contain links to and from the websites of advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

For further information about how we use cookies on our Website, please see our Digital Data Policy.

We use automated decision making to calculate the validity and value of Delay Repay claims made through our Website. Any claim is automatically processed by a computer which checks the information provided by you against previous claims and details of our trains that were either cancelled or delayed to validate the claim. When you receive notification of the outcome of your claim, you can appeal the decision. All appeals will follow an automated process and will either be deemed successful and payment will be made in due course or will be forwarded to a member of the Delay Repay team for manual review. If you remain dissatisfied, you can appeal the outcome of your claim via the Customer Relations team.

Information we receive from other sources:

We may receive information about you if you use any other Website we operate or the other services we provide. We are also working closely with third parties, (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them, in particular where you purchase any of our products or services through such third parties. In addition, we may receive information about you from third parties who provide it to us (e.g. your employer, our customers and law enforcement authorities).

When we receive information from other sources, we rely on them having the appropriate provisions in place telling you how they collect data and who they may share it with. We carefully check our sources to ensure that we only receive your information when it is lawful for us to do so.

CCTV and Body Worn Video:

We employ CCTV, on-demand audio recording and Body Worn Video (BWV) cameras to capture, record and monitor what takes place at our offices, stations, car parks and on our trains in order to help provide a safe environment for both our employees and customers, reduce the number of assaults on our employees, provide an accurate record of certain interactions and prevent, deter and detect crime and to evidence our compliance with the law and/or other legal obligations imposed on us.

BWV will only be activated when absolutely necessary. Prior to the record mode being activated, our employees will give notice that the camera is being activated and that it will make both a video and audio recording. For further information on CCTV and retention periods, please contact us using the details provided in Section 14 below.

For further information on CCTV and retention periods, please contact us using the details provided in Section 14 below.

5. Purposes for which we will use your personal data

This section explains how we will use personal data you provide to us in order to carry out the activities relevant to the provision of our services to you.

We must have a legal basis for processing your personal data. We consider that we have a legal basis where:

• you have given us consent to do so for the specific purposes which we have told you about - for example, we will need your consent to process any health information you provide to us, such as information relating to mobility;
• it is necessary for us to do so to enable us to provide you with the services that you have requested from us - for example, contacting you about your journey;
• it is necessary in order to fulfil our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
• it is necessary for our exercise of a public task (also called performance of a task carried out in the public interest); or
• the law otherwise permits or requires it.

Where we process your personal data on the basis of our legitimate interests, these are our (or our third party’s) interests in providing our services to you in an efficient and secure manner.

We have set out below a list of all the ways we may use your personal data and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate.

In some cases we may use more than one legal basis for processing your personal data; this will depend on the specific purpose for which we are using your personal data. Please contact us if you have any queries about the specific legal basis that we rely on for processing your personal data.

What we use your personal data for (purpose)	Type(s) of data	Legal basis for processing (including basis of legitimate interest)
To register you as a new customer	(a) Identity (b) Contact	Necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract; Your consent (though we only ask for a consent where we need it – not if these other legal basis reasons can be relied on); and/or Legitimate interests – to prevent fraud.
To carry out our obligations arising from any contracts entered into between you and us including: (a) managing payments, paying refunds or compensation, fees and charges; (b) collecting and recovering money owed to us; (c) running fraud checks if we have reasonable suspicions; (d) provide you with the information, products and services that you request from us including, but not limited to, contacting you about your journey;	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Communications	Necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract; Necessary for our legitimate interests, including to allow us: To recover debts due to us and to prevent fraud; To provide you with service delivery information about our services by email. Necessary to comply with legal obligations imposed on us, including to allow us to process claims for, and pay refunds or compensation owed to you for delayed or cancelled services; and/or Necessary for the performance of a task carried out in the public interest;
To respond to your enquiries or to process your requests in relation to your information.	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Communications (f) Health	Necessary for the performance of a contract with you; and/or Necessary for compliance with a legal obligation to which we are subject; Necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or you in the field of employment and social security and social protection law in so far as it is authorised by domestic law or a collective agreement pursuant to domestic law providing for appropriate safeguards for your fundamental rights and interests (for instance the social protection law part of this would usually be relevant if we need to know health details about you because of a disability access need when you’re our passenger); or Where you have given us your explicit consent.
To respond to your enquiries or to process your requests in relation to your personal information	(a) Identity (b) Contact (c) Financial (d) Transaction	Necessary for the performance of a contract with you or to take steps at your request prior to entering into a contract; Necessary to comply with legal obligations imposed on us; Necessary for our legitimate interests – i.e. to respond to any queries raised by you; and/or Necessary for the performance of a task carried out in the public interest.
To help provide a safe environment for our employees and customers; to reduce the number of assaults on our employees during revenue enforcement duties; and to improve the quality of evidence available for submission to the authorities.	(e) Health	One of the above grounds together with: Necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard your fundamental rights and interests.
To maintain a suppression list should you opt-out of receiving communications.	(a) Identity (b) Contact (c) Marketing Data (d) Communications Data	Necessary to comply with legal obligations imposed on us - to ensure that we do not send you unsolicited electronic marketing communications where you have not consented to receive them or where you withdraw any consent to receive them.
To manage our relationship with you which will include: (a) notifying you about changes to our Website, services, terms or privacy policy; (b) asking you to leave a review or take a survey; and/or (c) to investigate and respond to complaints.	(a) Identity (b) Contact (c) Profile (d) Communications Data	Necessary for the performance of a contract with you; Necessary to comply with legal obligations imposed on us; Necessary for our legitimate interests – to allow us to understand your needs and identify any steps that we can take to improve our services; and/or Necessary for the performance of a task carried out in the public interest.
To help provide a safe environment for our employees and customers; to reduce the number of assaults on our employees during revenue enforcement duties; and to improve the quality of evidence available for submission to the authorities	(a) Identity	Necessary to comply with legal obligations imposed on us; Necessary for our legitimate interests; and/or Necessary for the performance of a task carried out in the public interest.
To enable you to partake in a prize draw, competition or complete a survey	(a) Identity (b) Contact (c) Profile (d) Usage (c) Marketing Data; and (d) Communications Data	Necessary for our legitimate interests. Consent.
To send you direct marketing communications by email or SMS	(a) Identity (b) Contact (c) Profile (d) Usage (c) Marketing Data; and (d) Communications Data	Consent.
To administer and protect our business and the Website (including training our employees, troubleshooting, data analysis, testing, system maintenance, security audits, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Profile (d) Usage (c) Marketing Data; and (d) Communications Data	Necessary for the performance of a contract with you; Necessary to comply with legal obligations imposed on us; Necessary for our legitimate interests – to allow us to understand your needs and identify any steps that we can take to improve our services; and/or Necessary for the performance of a task carried out in the public interest.
To conduct health and safety assessments and record keeping; and compliance with related legal obligations	(a) Identity (b) Contact (c) Profile (d) Health	Necessary to comply with legal obligations imposed on us; and Necessary for the purposes of carrying out the obligations and exercising specific rights of us or you in the field of employment and social security and social protection law (including health and safety laws) in so far as it is authorised by domestic law or a collective agreement pursuant to domestic law and provided we are providing for appropriate safeguards for the fundamental rights and your interests.
To process information (gathered by our use of cookies) relating to the devices you use to access our Website or app to understand more about you and your use of our Website or app, and/or to allow us or our partners to use information gathered through cookies to serve personalised adverts to you though our Website. Please note that if you do not consent to the installation of advertising cookies, the number of adverts will remain the same, but they may not reflect your interests.	(a) Identity (b) Contact (c) Profile (d) Usage (c) Marketing Data; and (d) Communications Data	Your consent; or Necessary for our (or a third party’s) legitimate interests.

6. Communications

This section is to explain how we will ensure that you only receive communications that you wish to receive.

Marketing communications:

We can only use your personal information to send you electronic marketing messages (i.e. by email or SMS) where we have your prior consent. Additionally, we collect and process data about your interactions across different devices, including demographic and interest data provided by services such as Google Signals, to enhance your user experience and personalise the content and advertisements you see. You can opt out of this data collection at any time by adjusting your cookie settings or using the Google Analytics opt-out options.

The personal data we have for you is made up of what you tell us, and the data we collect about you when you use our services, or data provided to us from third parties we work with. We study this to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

We want to ensure that you are informed and aware of the best products, services, promotions and events that we can offer you. By consenting to receive additional communications (by mail, telephone, SMS, text/picture/video message, app push notifications or email) from us and any named third parties that feature at the point of obtaining consent in respect of such information, we will process your personal data in accordance with this privacy policy.

If you have provided your consent to receive marketing communications from us and you change your mind, you can change your preferences and unsubscribe at any time by unsubscribing from the relevant communication channel, changing your preferences in your “My Account” or by contacting us at tpecustomer.relations@tpexpress.co.uk.

If you choose not to receive this information we will be unable to keep you informed of new products, services and promotions that may interest you.

Whatever you choose, you'll still receive booking confirmations and other important information, for example service communications.

Service communications

As detailed in the table at Section 6, we may send you communications such as those which relate to any service updates (e.g. service disruption or cancellations) or provide customer satisfaction surveys. We consider that we can lawfully send these communications to you as we have a legitimate interest to do so, namely to effectively provide you with the best service we can and to grow our business.

7. Who will have access to your personal data

This section is to explain who, within TPE, will have access to your data. Your personal data will only be seen or used by our employees who have a legitimate business need to access your personal data for the purposes set out in this privacy policy.

We take your privacy seriously and have implemented appropriate physical, technical and organisational security measures designed to secure your personal data against accidental loss, destruction or damage and unauthorised access, use, alteration or disclosure.

8. Who else might we share your personal data with

This section will inform you of who we share your personal data with and why. Except as explained in this privacy policy, we will not share your personal data without your consent unless required to do so by law.

We may share your personal data:

• with you, and where appropriate, your family, your associates and your representatives.
• with the British Transport Police or any other law enforcement agency or court to the extent necessary for purposes including preventing, investigating, detecting, and prosecuting criminal offences; preventing threats to public security in accordance with applicable law; or validating a claim; and/or
• with the following third-parties who assist us with administering the provision of our services to you:

  • business partners, suppliers, and sub-contractors for the performance of any contract we enter into with them or you;

  • analytics and search engine providers, including Google, that assist us in the improvement, optimisation, and cross-device tracking of user interactions on our site. This may involve the sharing of demographic and interest data (such as age, gender, and device usage) to improve the user experience and enable remarketing efforts.

  • other rail industry bodies including the Office of Rail and Road, other Rail Operators, Network Rail, Transport Focus, the Department for Transport, Transport for the North and London TravelWatch, in order to comply with our regulatory obligations and to help resolve complaints or other issues; and

  • agents we engage to perform functions on our behalf including fulfilling order deliveries, repaying compensation claims for delay, sending customer communications, analysing data, providing marketing assistance, processing payments, issuing and obtaining payment for penalty fares or fines, researching customer satisfaction, and providing customer service. They have access to personal data needed to perform their functions, but may not use it for other purposes.

We may also pass Aggregated Data on the usage of our site (e.g. we might disclose the median ages of visitors to our site, or the numbers of visitors to our site that come from different geographic areas) to third parties but this will not include information that can be used to identify you personally.

If a business transfer or change of business ownership takes place or is envisaged or if our rail franchise is awarded to another company in the future, we may transfer your personal data to the Secretary of Statement for Transport and/or the new owner (or a prospective new owner) or the new franchisee. If this happens, you will be informed of this transfer.

9. How do we protect your personal data?

This section explains how we keep your personal data safe and where it will be held.

We take your privacy seriously and are committed to maintaining the privacy and security of the personal data you provide to us, and the choices you have regarding our collection and use of your personal data.

Once we have received your personal data, we follow strict security procedures as to how your personal data is stored and used, and who sees it, to help stop any unauthorised access.

Any payment transactions will be encrypted. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. You should not share this information with anyone.

The information that we collect from you, including data processed via services such as Google Analytics and Google Signals, may be transferred to, and stored at, a destination outside the United Kingdom (UK). This includes transfers to the United States for processing by Google. When we transfer and store your personal data outside of the UK, we will ensure that it is adequately protected by using appropriate safeguards, where needed, such as the Standard Contractual Clauses (SCCs) or other relevant transfer mechanisms.

We may also share personal data with third parties acting as separate controllers where necessary for the provision of professional services, such as legal advice or audits.

Staff operating outside the UK who work for us, or one of our suppliers, may process the information. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services;

Where your personal data is transferred from the UK to a recipient located in (and subject to the laws of) a country not recognised by the United Kingdom as providing an adequate level of protection for personal data, such transfer shall be covered by a framework recognised by the Information Commissioner and/or the courts of England and Wales as providing an adequate level of protection for personal data including but not limited to:

• an International Data Transfer Agreement (IDTA), in a form as approved by the Information Commissioner; or
• an International Data Transfer Addendum to the Standard Contractual Clauses set out in the Annex of the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021);

The transmission of your personal data via the internet is not completely secure and although we do our best to protect your personal data, we cannot guarantee the security of your data transmitted to us over the internet and you acknowledge that any transmission is at your own risk.

10. How long do we keep your personal data?

This section explains the length of time that we will retain your personal data.

We will keep your personal data for no longer than is necessary for the purposes for which it was obtained. The criteria for determining the duration for which we will retain your personal data are as follows:

(1) we will retain your personal data in a form that permits identification only for as long as:

1. we maintain an ongoing relationship with you; or
2. your personal data is necessary in connection with the lawful purposes set out in this policy for which we have a valid legal basis.

plus

(2) the duration of:

1. any applicable limitation period under applicable law (i.e. any period during which any person could bring a legal claim against us in connection with your personal data, or to which your personal data may be relevant); or
2. an additional reasonable period following the end of such applicable limitation period;

plus an additional reasonable period following the end of such applicable limitation period.

In addition, if any relevant legal claims are brought, we may continue to process your personal data for such additional periods as are necessary in connection with that claim.

After this period your personal data will be securely and irretrievably deleted/destroyed or in certain situations, anonymised so that you are no longer identified or identifiable from such information.

After this period your personal data will be anonymised so that you are no longer identified or identifiable from such information, or securely deleted/destroyed.

Any third parties that we engage will keep your data stored on their systems for as long as is necessary to provide the relevant services to you or us. If we end our relationship with any third party providers, we will make sure that they securely delete or return your personal data to us.

The retention periods for CCTV and BWV vary depending on the location and system in use. Such periods tend not to exceed 30 days and will always be reasonable or as long as is required by law. For more information please contact us using the details provided in in Section 14.

We may retain personal data about you for statistical purposes (for example, to help us improve our services). Where data is retained for statistical purposes it will always be anonymised, meaning that you will not be identifiable from that data.

11. What are your rights?

This section explains that you have a number of rights in relation to your personal data. There are circumstances in which your rights may not apply. You have the right to request that we:

• provide you with a copy of the information we hold about you;
• update any of your personal information if it is inaccurate or out of date;
• delete the personal data we hold about you - if we are providing services to you and you ask us to delete personal data we hold about you then we may be unable to continue providing those services to you;
• restrict the way in which we process your personal data;
• stop processing your data if you have valid objections to such processing;
• object to any automated decision being made about you, or request a human review any such automated decision, and
• transfer your personal data to a third party.

Please note that some of these requests may not apply to personal data processed for certain processing activities. If this is the case, we will explain why when we respond to your request.

For more information on your rights and how to use them, or if you would like to make any of the requests set out above, please contact us using the details provided in Section 14. We will seek to respond to all such requests within one month of receipt of either:-

• your request; or
• or any additional information we reasonably require, where we have requested it. If we fail to receive this additional information within 1 month of our request for this additional information, we will close your request without any further reference to yourself.

Occasionally, we may seek to extend the deadline to respond to your request from one month to up to 3 months from the latter of either:

1. the date of our receipt of your valid request; or
2. the date of our receipt of any additional information reasonably requested by us to allow us to confirm your identity;

if your request is particularly complex and we are handling a large volume of requests. If this is the case, we will notify you that we are seeking to extend the deadline to respond to your request within that first month.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

As explained in the section on Communications above, even if you consented to the processing of your personal data for marketing purposes (by ticking the relevant box or by requesting information about services), you have the right to ask us to stop processing your personal data for such purposes. You can exercise this right at any time by unsubscribing from the relevant communication channel, changing your preferences in your “My Account” or by contacting us at tpe.dataprotection@tpexpress.co.uk.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

12. Cookies

The Website uses cookies. Cookies are text files containing small amounts of information which are downloaded to your personal computer, mobile or other device when you visit a website. For more information please see our Digital Data Policy.

13. Freedom of Information

We are subject to the Freedom of Information Act 2000 and the Environmental Information Regulations 2004. If you wish to request access to any information (other than your Personal Data), that we hold, please contact our Data Protection Officer at FOIA@tpexpress.co.uk

We will normally respond to your request within 20 working days of receipt of your request, but where some of the requested information falls under an exemption that involves a public interest test, we may extend the deadline by a further 20 working days.

For further information about the Freedom of Information Act 2000 and the Environmental Information Regulations 2004, please see the ICO website.

14. Who can you ask for more information?

If you have any questions or concerns about how we handle your personal data, you can contact us using any one (or more) of the following:

Post:
Customer Relations
TransPennine Express
7th Floor, Bridgewater House, 60 Whitworth Street, Manchester, M1 6LT

Email:
Use our online contact form

Phone:
0345 600 1671

Alternatively, you can contact us through the Contact Us section of the Website.

We have appointed a Data Protection Officer. They are responsible for our approach to data protection and protecting your privacy. You can contact them at tpe.dataprotection@tpexpress.co.uk.

If you are unsatisfied with our response(s) to:

• any data protection issues you raise with us or our DPO;
• any requests made where you are seeking to exercise your rights under the Data Protection Laws; or
• any requests that you have made to us under the Freedom of Information Act 2000 or Environmental Information Regulations 2004;

you have the right to make a complaint to the Information Commissioner’s Office (ICO). The ICO is the authority in the UK which is tasked with the protection of personal data and privacy.

They can be contacted via their webchat function on their website: ICO.ORG.UK or by telephone on 0303 123 1113.

TransPennine Express Chatbot

The TransPennine Express chatbot is designed to provide quick and helpful responses by pulling information directly from our website. It uses generative AI technology to understand your enquiries and deliver relevant content based on what’s available on the site.

What the chatbot can do

• Assist with general questions by finding relevant information from our website content
• Provide answers on topics such as timetables, ticketing, policies, and travel updates
• Help guide users to specific sections of our website for more detailed information

What the chatbot doesn’t do

• The chatbot is not monitored by live agents and does not connect you to customer service representatives
• It cannot handle or process personal data (e.g., names, contact details, or payment information)
• It is not able to complete tasks that require personal or account information

Important information about personal data

The chatbot is strictly designed to operate without storing, processing, or handling personal data. For this reason, we actively discourage users from sharing any personal information during interactions. If personal data is provided, the chatbot will not be able to use or act on it.

Privacy and security

All chatbot interactions are secured via HTTPS encryption, ensuring your conversations remain private and protected. The chatbot operates fully within the guidelines outlined in this privacy policy, and no data is transferred outside the UK or European Economic Area (EEA).

Digital Data Policy

This policy explains how TransPennine Express collects and uses your information through digital technologies when you interact with our website, mobile app, wi-fi portals, and online advertising.

Types of digital data we collect

We use a variety of technologies to collect data about your online activities and device when you use our digital services, including:

• Cookies:
  Small text files stored on your browser or device to enable functionality, remember your preferences, and collect analytics. We also use Google Signals as part of Google Analytics to collect data about user interactions across multiple devices. This enables us to gather demographic, interest, and cross-device tracking information to improve our services and offer more relevant advertising. You can manage your cookie preferences and opt out of Google Signals through your account settings or browser tools.

• Pixels and web beacons:
  Tiny graphics that allow us and third parties to track your interactions and collect data for analytics and advertising.

• Local storage and cache:
  Technologies that allow data to be stored locally on your browser or device to improve performance and enable certain features.

• SDKs:
  Software development kits embedded in our mobile apps to analyse usage and support functionality.

• Customer data for advertising:
  Hashed customer data (such as email addresses) collected on our conversion pages and shared with advertising partners like Google to improve the accuracy of conversion tracking and ad attribution. Hashed customer data refers to a secure, one-way conversion of personal information, such as email addresses, into a unique string of characters that cannot be reversed. This data is collected only with your consent.

Of the above, the most used type of tracking technology are ‘Cookies’. We use three main types of cookies on our sites:

a) Necessary Cookies: These cookies are essential for core site functionality and security, such as logging in, secure areas, and online purchases. They are always active and can't be disabled.

b) Analytics Cookies: We use these to analyse site usage and performance. They help us understand visitor behaviour, track popular pages, and identify areas for improvement.

c) Advertising Cookies: Set by our ad partners, these cookies build interest profiles to show you relevant ads on other sites. They may track your online activities and be shared with social networks and other third-party platforms.

Your Choices and Controls

You have several options to control the collection and use of your data via cookies and similar technologies:

• Adjust browser settings to manage cookies and local storage

• Use industry opt-out tools like the NAI or DAA to opt out of interest-based advertising

• Change your mobile device's ad settings

• For Google advertising, including Enhanced Conversions, opt out of advertising cookies or withdraw consent anytime

Opting out of certain cookies may impact site functionality. For instance, if you disable analytics cookies, we won't be able to use data about your site interactions to improve the user experience. This means we may not be able to identify and fix issues like slow page loads, confusing navigation, or unclear content. Without these insights, it becomes harder for us to ensure the site works smoothly and intuitively for all users.

Additionally, opting out of advertising cookies means you'll likely still see ads on our site and others, but they'll be less relevant to your interests. You may see the same ad multiple times or ads for products you're not interested in, which can make your online experience less enjoyable and efficient.

However, we respect your right to choice. If you prefer not to have your data collected for analytics and advertising, you can use the tools mentioned above to opt out. Just be aware that this may affect the functionality and personalisation of the TransPennine Express website and other sites you visit.

For more details on the specific cookies and technologies we use, see the table below.

Third-Party Cookies and Similar Technologies

On certain pages of our website, other companies such as Facebook and various platforms (including Twitter, Instagram, Snapchat, and Amazon) may use cookies or similar technologies like web beacons, pixels, and local storage to gather or receive data from our site or other places on the internet. They use this information for measurement services and targeted advertising. Due to the nature of these technologies, we cannot access the data they collect. For information on how these third parties use cookies and similar technologies, please refer to their respective cookie and privacy policies.

Facebook Tools and Targeted Communication

We may utilise Facebook tools like pixels, SDKs, and APIs to optimise our communication and deliver more relevant, targeted messages through Facebook, Instagram, and the Facebook Audience Network.

Information Processing and Advertising

With your consent, we process data collected by the www.facebook.com third-party cookie to show you ads for products we believe match your interests, based on your interactions with Meta's products such as Facebook and Instagram. This cookie is set only with your permission and lasts until it expires (as specified in Meta's cookie policy) or until you revoke your consent. You can change your consent preferences at any time by following the steps outlined below. Please note that data gathered through this Facebook cookie may be sent to the United States, which is not considered "adequate" by UK and EU standards for personal data processing. As a result, some of your data privacy rights may not apply. For more details, please see Meta's Privacy Policy at https://www.facebook.com/privacy/policy.

You have several options to control the collection and use of your information for ad targeting across various websites:

1. Digital Advertising Alliance (DAA) WebChoices Tool
   Visit http://www.aboutads.info/choices to manage your preferences for interest-based advertising from participating companies. This tool allows you to opt out of data collection and use for ad targeting by DAA member companies across multiple websites.


2. Network Advertising Initiative (NAI) Opt-Out Tool
   Go to http://optout.networkadvertising.org/ to opt out of data collection and use for online behavioral advertising by NAI member companies. This tool lets you control your preferences for interest-based ads across various websites.


3. European Interactive Digital Advertising Alliance (EDAA) YourOnlineChoices Tool
   If you're in the UK or EU, visit http://www.youronlinechoices.com/uk/your-ad-choices to manage your preferences for online behavioral advertising by EDAA member companies. This tool enables you to control your choices for interest-based ads across multiple European websites.

Google Advertising and Analytics Opt-Out

Google provides various advertising services through platforms like DoubleClick for Publishers, Google AdX, and AdWords. AdWords remarketing cookies allow us to show our ads to people who have previously visited our website when they browse Google search and other sites.

Google also uses conversion cookies to help advertisers track how many users who click on their ads go on to make a purchase. These cookies let Google and the advertiser know that you clicked the ad and later visited the advertiser's site.

To opt out of Google Analytics data collection across all websites, you can install the Google Analytics Opt-Out Browser Add-On. To control your preferences for Google Analytics for display advertising or customize Google Display Network ads, visit the Google Ads Settings page.

For more information about the third-party cookies and similar technologies used by these platforms, please refer to their respective websites and privacy policies.

https://adssettings.google.com
https://www.amazon.co.uk/adprefs
http://www.facebook.com/ads/preferences
http://www.google.com/policies/privacy/ads
https://help.instagram.com/615366948510230
https://support.snapchat.com/en-GB/a/advertising-preferences
https://about.ads.microsoft.com/en-gb/resources/policies/personalized-ads
https://help.twitter.com/en/safety-and-security/privacy-controls-for-tailored-ads
https://www.linkedin.com/help/linkedin/answer/90274/manage-your-linkedin-ads-settings?lang=en

Managing and deleting cookies

When you visit our website for the first time on a particular device, a cookie banner will appear explaining our use of cookies, the reasons we use them, and providing a link to this detailed cookie policy.

The banner includes a settings option that allows you to customize your cookie preferences for our site. By clicking on the settings, you can enable or disable certain optional cookies. You can always revisit these preferences in the future by clicking the "Cookie Settings" link in the header of any page on our site.

Please note that disabling cookies may impact the functionality and features available on our website.

Deleting Cookies

In addition to managing cookies through our settings, most web browsers allow you to erase existing cookies from your device or block new ones from being placed. Typically, you can find these options under the "Help", "Tools" or "Edit" menus in your browser.

For detailed instructions on managing cookies in your specific browser, we recommend the following resources:

Your Online Choices: www.youronlinechoices.eu
About Cookies: www.aboutcookies.org
All About Cookies: www.allaboutcookies.org

These sites provide comprehensive guides on cookie management across a wide range of browsers. They also include information on deleting cookies from your computer and more general facts about cookie technology.

Remember that restricting or deleting cookies may impact your user experience on our website and limit access to certain features.

Previously Set Cookies

If you have previously disabled any analytics or advertising cookies, please be aware that we may continue to use information captured by those cookies prior to you disabling them. However, once disabled, those cookies will no longer collect any new information from your activity on our site going forward.