Privacy Policy

London North Eastern Railway, West Offices, Station Rise, York, YO1 6GA, (“LNER”, “we”, “us” and “our”) values the personal information you provide to us and wouldn’t want to use your personal data in a way that you wouldn’t expect. This Privacy Policy explains what we do with your personal information, what our lawful reasons are for this under data protection laws, what your rights are under data protection laws and how you can exercise them, and how you can control the way we use your personal information.

“Personal information” or personal data (these two terms are used interchangeably) is any information that relates to an identifiable natural person. Your name, address and contact details are all examples of your personal data.

The term “process” means any activity relating to personal data, including, by way of example, collection, storage, use and transmission.

LNER is a "controller" of your personal data. This means that we make decisions about how and why we process your personal data and, because of this, we are responsible for making sure it is used in accordance with data protection laws.

We have appointed a data protection officer. If you have a question about how your personal information is used or if you wish to exercise your rights under data protection laws, please contact us or our data protection officer using one of the methods below:

Send an email to our Data Safe team
Contact us via our Privacy Portal
Write to us at Data Safe, West Offices, Station Rise, York, YO1 6GA

We are listed on the Information Commissioner’s Office (“ICO”) register of fee payers. Our registration number is ZA429672.

Contents

Where and how we collect your personal information

Collection from you. We collect personal information about you in several ways:

When you fill in a form on our website or contact us via phone, email or another method
When you register with us and fill in a form on our website or mobile app, whether directly or via a social media account
When you subscribe to our services
When you purchase anything from us (this includes the purchase of tickets)
When you opt in to receive marketing messages, ticket alerts, or news by email, post, SMS or other means
When you sign up to our loyalty scheme, LNER Perks
When you register with us to use our Wi-Fi services
When you enter a competition or promotion, or fill in a survey run by us or on our behalf
When you browse our website or app, or use our onboard, lounge or station Wi-Fi
When you open or click on any emails or push notifications we send you.

Collection from the device used to access our website or used on our trains to access WIFI.Please see the next section where we mention website information and how we collect that. This will be collected from the device you use to access our website including when you are travelling on our trains or when you use WIFI on our trains.

Collection from publicly available sources. We also collect your personal information from other organisations and sources, including publicly available sources, for example when you contact us through a social media company such as Facebook, Twitter, LinkedIn or Instagram. Before providing information to us via these channels, you should check these companies’ privacy policies and settings to understand how they use your personal information.

Collection from law enforcement agencies/rail station operators. We may also obtain or collect your personal information from law enforcement agencies (including the police and the British Transport Police) and from rail station operators if you are involved in any incidents when you are on our trains or otherwise at the train stations from where we operate our rail passenger services.

Collection from Virgin Trains East Coast: LNER has taken over the rail franchise from the East Coast Main Line Company Limited, trading as Virgin Trains East Coast (as mentioned in emails to you). This means that LNER will have obtained your personal data from Virgin Trains East Coast if you were a passenger and/or if you had signed up for newsletters or alerts (or other marketing) previously and if your details were for this reason included in the passenger databases or marketing databases of Virgin Trains East Coast.

Collection via CCTV. When your image is captured on CCTV on our trains or in rail stations we will be able to view that image. More details below on this.

What personal information do we hold about you?

We collect personal information in relation to the following broad categories:

Contact information
User Information
Payment card information
Website information
Sensitive information (known as ‘special categories of personal data’ and ‘criminal convictions and offences data’ under data protection laws).
CCTV information

Here are the particular types of personal information we collect within the categories above.

Contact information; payment card information. When you fill in a form or buy tickets, we normally ask you to provide us with:

Your name
Your contact details including your address, phone number, email address
Your bank or credit card details (if you're buying tickets or other items from us), including billing information
Details of how you would like us to contact you.

We don’t collect age information (except in the case of alcohol-related competitions, promotions or sales), but it is possible that this would be provided to us by law enforcement agencies/rail station operators, or in the course of ticket examinations carried out by authorised staff where a breach of Railway laws has occurred.

We recognise that young people use our services and are legally able to provide consent after the age of 13 years. If you are using our travel services and are aged between 13 and 16 years of age, we recommend that you read our terms and conditions because they are relevant to you in the same way as to other passengers.

Sensitive information. If you need help with things like getting on and off a train, you may choose to give us confidential information about medical conditions and the type of assistance you require. All UK train companies use a system called Passenger Assist to book help on stations and on trains for all services. This makes sure that if you book help in advance, our staff on stations and on the trains know that you're travelling, where you are seated on the train, any connections you have to make, and the help you need. You have the option to save those assistance details to your account, and can edit or remove them at any time. If you commit or are suspected of committing or are the victim of a fraud or other crime or other serious incident on our trains or in railway stations or in relation to your delay repay claim or ticket purchase we will process information about that too in relation to you.

User information: This is information collected about you as a user of our services more generally, where we use data to understand our customers.

If you have entered your address in your LNER account we might use this data, together with your ticket purchase data, to work out how far you travel to our stations, so that we can understand the geographic range of our customers.
When you sign up to our loyalty scheme, LNER Perks, we may collect data where you engage with benefits provided by the scheme. Analysis of this data allows us to better understand you as a customer and ensures that the scheme stays relevant to its members.

Website information. When you visit our website or use our Wi-Fi services, we may collect the following information automatically:

Technical information, including the IP address (which is a category of personal information) which is used to connect your computer to the Internet, your login information, the browser you’re using, time zone setting, browser plug in types and versions, the operating system and the train that you're on
Location data and Wi-Fi usage
Information about your visit that will help us to improve our service and make your online experience more relevant. This can include your approximate geographical location, the date and time you visited, which of our products you looked at or searched for, which pages you looked at, how long you spent on certain pages, and how you clicked to, through, and from our website.

In our communications with you by email, SMS, or push notification, we automatically collect data relating to:

How you interact with our communications, such as which emails you opened or clicked a link within, and how long the email was opened for
Where you are when you interact with our messages
What type of device, model and operating system you’re using.

We also collect information about your visits to our websites using cookies. More information about how we use cookies and how you can change your settings can be found in our Cookie Policy.

While we mainly use the personal information that you give us about yourself, we may sometimes use other sources of information about our customers and prospective customers where you've given your permission for your data to be shared. We do this to help us understand more about our customers, to ensure that our messages are relevant, and to make sure that the marketing information we send you, with your consent, is also relevant. We take great care in sourcing this information, but if you prefer us not to use your data in this way, please let us know by emailing our Data Safe team.

CCTV information.

We employ CCTV on our trains and in our stations in order to:

prevent, deter and detect crime
apprehend and prosecute offenders, and provide evidence to take action in the courts
help provide a safer environment for our staff
protect public safety
monitor operational and safety-related incidents
assist with the verification of claims.

You have the right to make a Subject Access Request for CCTV images of yourself and to ask for a copy of them. Please direct any such request to our Data Safe team.

We reserve the right to withhold information where permissible by the applicable data protection laws, and we will only retain CCTV images for a reasonable period (this means 28 days or less) or for longer as is required by law or to protect our own legitimate interests. For more details please see below. In certain circumstances, we may need to disclose CCTV images to law enforcement agencies. When this is done, there is a statutory requirement for the organisation that has received the images to adhere to the relevant data protection laws.

General overview: Our legal basis for using your personal information

Here is a broad overview of the data protection law reasons we have for using and otherwise processing your personal information. In the next section we will explain the purposes for which we use and otherwise process it and which of the following legal reasons apply to justify that.

Under UK data protection law, we must have a valid basis for using your personal information and we may not collect store or use information other than as described in this policy. There are seven ways we may have a valid basis for using your personal information:

Fulfilling the contract: Most of the information we collect from you is necessary to allow us to fulfil our contract with you or to enter into a contract with you e.g. you provide a billing address when you purchase tickets via our website; we may need to contact you to notify you about changes to our services. We may also need information from you to ensure that we can provide you your tickets in the event you have lost important information like your booking reference. Essentially, we need that information to ensure you’re the real you and provide assistance to you post purchase.
Consent: When you register and open an online account with us you will be invited to give your consent to use your personal information as described in ‘How we use your personal information for marketing’ below. By opting in you are giving your permission for us to process your data using ‘consent’ as our legal basis. If you have given consent to our use of your personal information, you are entitled to withdraw this consent at any time. There are more details about withdrawing that consent below.
Legitimate interest: We may also have a legitimate interest in using your personal information e.g. to ensure that the content on our website is presented to you and your computer as effectively as possible. Sometimes the legitimate interests will be those of third parties for instance when we share personal information about you with a replacement operator of the rail franchise (this includes our trains and our stations) for our legitimate interests in sharing our passenger database(s) with any replacement operator and for the incoming provider’s legitimate interest in having that personal information in order to fulfil its contractual obligations under the franchise arrangement (which is a contract with The Secretary of State for Transport). If this is our reason for using your personal information, we must make sure that our interests do not override yours and you can object to this use of your personal information. We are required by data protection laws to explain each of the legitimate interest we rely upon. Please see the next section for this detail.
Legal obligation: We may have a legal obligation to use your personal information in certain ways or to protect your interests e.g. we may exchange information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
Vital interests: If it is necessary for us to use and share your sensitive information with law enforcement agencies, next of kin who can be identified or medical professionals in order to protect your vital interests (for instance in an emergency situation where you are taken ill on a train or in a station or when a major incident has occurred), we will do so.
Reasons of substantial public interest: If it is necessary for us to use and share your sensitive information with law enforcement agencies, next of kin who can be identified or medical professionals, for substantial public interest reasons, we will do so; likewise in order for us to adhere to and deal with the system called Passenger Assist to book help on stations and on trains for all services; likewise in order for us to know information about fraud or other crimes or other serious incidents on our trains or in railway stations or in relation to your delay repay claim or ticket purchase.
Explicit consent: If we have your explicit consent in relation to your sensitive information that is relevant to Passenger Assist we will rely on this as the legal basis for our use of that sensitive information.

Under data protection laws you have the right to withdraw your consent at any time including when we rely on this for our marketing communications. The consequence of this is that we would not be able to send you any further marketing communications unless you re-subscribed. If we rely on your explicit consent for Passenger Assist and you withdraw that then unless an alternative legal basis applies (such as reasons of substantial public interest) the consequence will be that we cannot provide all the assistance we would like to give under that system.

For what purposes do we use your personal information and what is our legal basis for this

Here is a broad overview. We use the personal information you provide to:

respond to your enquiries and/or complaints
fulfil the service or provide the information you’ve requested
handle the administration of your payment, issue your tickets/products, or confirm orders
send you information and communications (including service communications and direct marketing communications)
contact you when we have updated this Policy and considering whether it is necessary to advise you about any changes to the way we are processing your personal data
alert you about your booked journeys or tickets coming on sale
provide post-sales support and deal with any complaints, refunds or other ticketing or travel issues
personalise your experience of our website by using your purchases and browsing activity to make recommendations that we think may be of interest to you
improve our website and the range of services and products we provide
carry out market research and survey related activities
analyse and optimise our marketing activities
facilitate loyalty schemes, such as LNER Perks
contact you to tell you about our super savings, loyalty schemes and partners, latest news, events and personalised travel suggestions, services and special offers where you have given us permission to do so
to ensure our technical helpdesk can assist you if you have trouble with the Wi-Fi service
help you in an emergency situation or by way of Passenger Assist
deal with law enforcement agency requests for CCTV and otherwise deal with crimes and other serious incidents on our trains or at our stations

Here we explain these use purposes by reference to the legal basis we rely upon under data protection laws.

Your consent

Purposes of processing	Your consent
Contact Information and payment card information
Send you information and communications (including service communications and direct marketing communications)	✓ (Where we send you direct marketing)
Alert you about your booked journeys or tickets coming on sale	✓ (Where we send you the alert at your request and with your consent about tickets coming on sale)
Contact you to tell you about our super savings, loyalty schemes and partners, latest news, events and personalised travel suggestions, services and special offers where you have given us permission to do so	✓ (Where we send you direct marketing)
Website Information
Marketing and partner services	✓ (So we can link to services provided by third parties such as social networks and direct marketing)
Contact you as part of LNER Perks to tell you about the scheme’s benefits and rewards	Contact you as part of LNER Perks to tell you about the scheme’s benefits and rewards

To perform a contract with you

Purposes of processing	To perform a contract with you
Contact Information and payment card information
Responding to your enquiries and/or complaints	✓
Fulfil the service or provide the information you’ve requested	✓
Handle the administration of your payment, issue your tickets/products, or confirm order	✓
Provide post-sales support and deal with any complaints, refunds or other ticketing or travel issues	✓
Facilitate loyalty schemes, such as LNER Perks	✓ So you can earn LNER Perks credit when you book, and use your LNER Perks credit as part payment towards an LNER Advance ticket, or donate your LNER Perks credit to charity.
To ensure our technical helpdesk can assist you if you have trouble with the Wi-Fi service	✓ (If you have paid to use Wi-Fi we are in a contract with you for this and we need to provide Wi-Fi under that contract)
All categories
For our general record-keeping and passenger relationship management	✓
Resolving any complaints from or disputes with you	✓
To share your personal data with third parties (such as our service providers who assist us administer or process ticket purchase or refund or delay repay claim transactions on our behalf)	✓

To comply with a legal obligation

Purposes of processing	To comply with a legal obligation
Contact Information and payment card information
Contact you when we have updated this Policy and considering whether it is necessary to advise you about any changes to the way we are processing your personal data	✓
CCTV Information
We employ CCTV on our trains and in our stations in order to: prevent, deter and detect crime apprehend and prosecute offenders, and provide evidence to take action in the courts help provide a safer environment for our staff protect public safety monitor operational and safety-related incidents assist with the verification of claims	✓ (We have a legal obligation to protect the safety of passengers and to keep our trains and stations operating safely and efficiently and we may have requests for sharing of CCTV with law enforcement agencies based on a court order or statutory compulsion)
All categories
Establishing and enforcing our legal rights	✓ (We have a legal obligation to keep our trains and stations operating safely and efficiently and we have a number of other legal rights)
To comply with requests made by you when exercising your legal rights (such as those contained within this Privacy Policy	✓
Complying with instructions from law enforcement agencies, any court or otherwise as required by law	✓ (In addition see reference to sensitive information and CCTV in table below)
Managing the proposed sale, restructuring or merging of any or all part(s) of our business, including to respond to queries from the prospective buyer or merging organisation	✓
To keep records required by law or to evidence our compliance with laws, including tax laws, consumer protection laws and data protection laws	✓

For our legitimate interests

Purposes of processing

For our legitimate interests

Contact Information and payment card information

Responding to your enquiries and/or complaints

✓

(It’s important that we can respond to you in relation to such matters)

Fulfil the service or provide the information you’ve requested

✓

(It’s important that we can respond to you in relation to such matters)

Handle the administration of your payment, issue your tickets/products, or confirm order

✓

(It’s important that we can respond to you in relation to such matters)

Send you information and communications (including service communications and direct marketing communications)

✓

(It is important to keep you updated of ticket purchases and orders made with us and notified of factual updates to our contract and our engagement with you for those purposes)

Alert you about your booked journeys or tickets coming on sale

✓

(Where we need to send you information only communications to keep you updated of ticket purchases and orders made with us and notified of factual updates to our contract and our engagement with you for those purposes)

Provide post-sales support and deal with any complaints, refunds or other ticketing or travel issues

✓