Privacy Policy Thalys. April 2018

Transcription

1 Privacy Plicy Thalys April 2018

2 At Thalys 1 we respect yur privacy. We are cmmitted t prtecting and prcessing yur persnal data in strict cmpliance with data prtectin, and in full transparency. Take a minute t familiarise yurself with ur cmmitments t the prtectin f yur persnal data. If yu want t knw mre abut the use and prtectin f yur data, we invite yu t read ur Privacy Plicy Thalys belw. Our cmmitments t prtecting yur privacy We use yur data t prvide yu with a unique train travel experience in Eurpe. We need t cllect and stre yur data, such as yur name, address, and trip details. We share yur data with ur trusted partners t prvide yu with better quality services. We use the data yu share with us and ur distributrs t prvide yu with yur travel tickets, t let yu knw if there are changes t yur trips, r t prvide yu with ther infrmatin abut yur itinerary. And by listening t what yu - ur custmers - tell us, we can prvide yu with new and better services - nline and n ur trains. We use yur data t prvide yu with services that suit yu better. We analyse the travel data f ur passengers t develp innvative and generus sales ffers t suit all the prfiles f ur passengers: leisure passengers and prfessinals, yung peple, senirs, families and grups. If yu chse t receive marketing s frm Thalys this gives yu the pprtunity t be the first t knw abut ur prmtins, ur service prpsals, ur cntests fr winning trips, gifts, and mre, and ur partners' sales ffers. Please nte that in this case, yur data will nt be shared with these partners. Yu have cntrl f yur data. If yu n lnger wish t receive marketing ffers frm us, yu can view and change yur preferences at any time by clicking n the unsubscribe link at the bttm f each . If yu want t btain mre infrmatin abut the data we have abut yu r if yu want t exercise yur rights f rectificatin, prtability, erasure f yur data and yur rights t bject and limit prcessing, simply cntact ur Custmer Service: custmerinfrmatinflw@thalys.cm r ur DPO: data.prtectin@thalys.cm. Security is a pririty fr us. Cllecting, prcessing, string and sharing yur data securely is a pririty. T prvide yu with ur prducts and services, we share yur data with ur service prviders and make every effrt t ensure that they are just as careful when prcessing yur data. 1 This Privacy Plicy represents the plicy adpted and fllwed by THI Factry and Thalys Internatinal. Thalys Privacy Plicy 1/10

3 Privacy Plicy Thalys he purpse f this Privacy Plicy is t infrm yu, in the mst clear and cncise way pssible, hw we prcess yur persnal data when yu use ur website. (Thalys.cm) and/r Thalys services and prducts. It explains: 1. Wh is "respnsible fr prcessing"? Wh is the "DPO" and preferred cntact persn? Wh is cncerned? 2. What data d we cllect? 3. Fr what purpses and n what legal basis is yur data prcessed? 4. Hw d we prtect yur data? 5. Wh is yur data transferred t? 6. Hw is yur payment data managed? 7. What are yur rights and hw can yu exercise them? 8. Where can yu make a cmplaint abut the prcessing f yur data by Thalys? 9. Hw lng d we keep yur data? 10. Hw d we use ckies? 11. Hw can yu stay infrmed abut changes t this Privacy Plicy? 1. Wh is "respnsible fr prcessing"? Wh is the "DPO" and preferred cntact persn? Wh is cncerned? "THI Factry" 2 and "Thalys Internatinal" 3 (hereinafter "Thalys") are respnsible fr prcessing yur persnal data available t them. This means that we, Thalys, determine the purpses and means f prcessing f this data and that we are yur interlcutr and that f the supervisry authrities (the Belgian Data Prtectin Authrity and the ther Eurpean supervisry authrities) fr any questins relating t its use. We designated a Data Prtectin Officer r "DPO") as a single pint f cntact within ur cmpany with the fllwing details: Data Prtectin Officer data.prtectin@thalys.cm Our Privacy Plicy applies t all individuals whse persnal data is prcessed, whether yu are a simple user f the website r a custmer (with r withut a Thalys accunt). On the ther hand, legal persns d nt fall under the scpe f this ntice. 2 The cmpany "THI Factry" is a SA with headquarters at 4, Place Marcel Brdthaers Brussels, Belgium and registered in the Register f Legal Persns f Brussels, under the VAT number BE The cmpany "Thalys Internatinal" is an SCRL with headquarters at 4 Place Marcel Brdthaers - Brussels, Belgium and is registered in the Register f Legal Entities f Brussels, under the VAT business number BE Thalys Privacy Plicy 2/10

4 2. What data d we cllect? Yur persnal data (hereinafter "yur data") is data that allws yur identificatin either directly (data such as yur name and surname allws yur immediate identificatin), r indirectly (data such as yur pstal cde, yur phne number r yur cntract number allws yur identificatin indirectly). During ur interactins with yu, we may have t cllect different data depending n the types f prducts / services cncerned: Identificatin data (surname, first name, address, telephne number, address, etc.) Demgraphic data (such as gender, language, age) Prfessinal data Special features f the passenger Lifestyle and cnsumptin f gds and services Recrding f images and sunds Yur purchase histry and yur financial infrmatin, such as yur credit/debit card number r ther billing infrmatin (nly t make a refund) Online ID and passwrd Identifier f yur trip ("PNR" r "Passenger Name Recrd") Business prfile (preferred prducts and services, preferred mdes f cmmunicatin, etc.) Gelcatin data, including yur IP address r physical lcatin nly when yu request gelcatin-based services Infrmatin relating t navigatin and behaviur n ur website (depending n the pages viewed, the prducts viewed, searches perfrmed, etc.) In certain circumstances, we may als have t prcess particular categries f data, including data n passengers with reduced mbility and data n minrs. We treat this data with special care. a) Data f passengers with reduced mbility If yu are a passenger with reduced mbility, we are likely t prcess sme f yur data as part f the executin f yur transprt cntract, t prvide yu with a seat adapted t yur situatin as a persn with reduced mbility, as well as with assistance in barding the train. The prcessing f this data will be dne nly with yur explicit prir cnsent and fr the purpses t which yu have cnsented. Access t this data is limited t thse wh need it fr the perfrmance f their tasks in relatin t the abve purpse. b) Data f minrs (Kids Cnnectin) We are likely t prcess data f a minr (age 4 t 14) as part f ur "Kids Cnnectin" prgramme, t prvide fr the presence f a prfessinal attendant fr the entire trip f this minr wh wuld be travelling alne. In additin t the identificatin data f the minr, Thalys cllects the identificatin data f the peple wh bring and pick up the minr at the statin (including their identity card numbers), t verify their identity. Thalys Privacy Plicy 3/10

5 3. Fr what purpses and n what legal basis is yur data prcessed? We prcess yur data fr varius purpses. Fr each type f prcessing, nly the data relevant t achieving the purpse in questin is prcessed. The prcessing cnsists f any peratin (manual r autmated) n any persnal data. A. General Infrmatin In general, we use yur data: when we have yur cnsent. In this case, we prcess yur data nly fr the purpses t which yu have agreed, specified n the cnsent frm n ur website. In particular, when cncluding cntracts with Thalys, yu can explicitly cnsent via an pt-in t receiving cmmunicatins frm Thalys and/r Thalys partners (withut transferring data t these partners). If yu accept it, Thalys will electrnically send yu newsletters cntaining cmmercial infrmatin abut new services and prducts, prmtins and benefits, the pprtunity t participate in quizzes. etc. If yu d nt wish t receive ur Newsletters, yu can withdraw yur cnsent at any time via the link integrated directly int the Newsletter. Yu can find mre infrmatin abut this under the pint Withdrawing yur cnsent As part f the executin f yur cntract r fr the actins taken in rder t cnclude the cntract, t: Allw yu t purchase a trip (purchases r bkings frm the Thalys.cm website and n the sites f ur distributrs 4 ) r ther prducts/services ffered by Thalys Prvide and track the prducts r services purchased Manage yur cmplaints and guarantee yu quality after-sales service Be able t deal with yur questin, message r request and t respnd t it Check the validity f yur ticket Prvide yu with infrmatin abut yur trip (text message if yur train is delayed, r ther infrmatin abut yur itinerary, such as the cancellatin f yur train) Make a refund, if applicable Enable yu t create a Thalys custmer accunt and access yur rder histry and yur data fr managing yur accunt Give yu access t ur image database Allw yu t access ur Wifi n bard ur trains. We need t cllect sme f yur data t execute yur cntract. If yu chse nt t share this data with us, it may render the perfrmance f the cntract impssible. t cmply with all legal and regulatry bligatins t which we are subject, including: preventin and detectin f terrrist ffences and ther serius frms f crime; implementatin f legislatin (such as the GDPR); tax and accunting bligatins f Thalys. 4 In the rail cntext, a "distributr" refers t the entity that will take care f the sale f tickets t passengers. Thalys Privacy Plicy 4/10

6 fr purpses that are in ur legitimate interest, in which case we seek t preserve a prprtinate balance between ur legitimate interest and respect fr yur privacy. In this cntext, yur data can be prcessed in rder t: Prtect Thalys prperty Prevent abuse and fraud Disclse any abuse that may r may seriusly prejudice the financial status, results and/r reputatin f Thalys Cntrl the regularity f ur peratins Maintain safety n bard and near ur trains Exercise, defend and preserve ur rights, fr example during litigatin, as well as t cmpile the prf f a pssible vilatin f ur rights Sanctin certain irregularities (n valid ticket) thrugh payment f a fine Manage and imprve ur relatinship with yu Cntinuusly imprve ur website and ur prducts/services (in particular by cnducting satisfactin surveys and analysing data cllected via ckies) Cnduct market research n ur prducts/services r t develp new prducts/services Adjust ur prducts and services that are available t yu and adapt them t yur needs, in particular by ffering tailred services that culd interest yu based n the custmer prfile created fr yu Analyse data, establish sales and sales activity reprts, frequency f visits and establish marketing prfiles Analyse whether yu are eligible fr ur Thalys Inside prgramme (based n yur number f trips purchased) B. Specifics related t the Chatbt When yu use ur "chatbt" 5 n ur website, yur data is prcessed in rder t: - T answer yur questins in an autmated manner - T manage yur refund and cmpensatin requests (in this case, we use yur PNR and the date f yur trip) - T prcess yur cmplaint (in this case, we use yur credentials and yur address) - T imprve ur "chatbt" (self-learning tl) It is in ur legitimate interest t ffer yu an efficient and quick way t cntact us and t manage yur requests and cmplaints. Please nte that t use ur "chatbt", we nly need t cllect yur PNR t answer yur questins and manage yur refund requests, and yur credentials and address t prcess yur cmplaint. If yu cmmunicate unslicited data t ur chatbt, yu agree with the use f this data t imprve ur chatbt (machine-learning tl). C. Specifics related t " Abandned Cart" s We send yu "Abandned Cart" s. This means that when yu have started the prcess f rdering a trip withut cmpleting the purchase ("abandn cart"), we will cntact yu t remind yu t cmplete yur rder. In this cntext, we use yur address t send yu a reminder inviting yu t finalise the rder that was started, if yu have given us yur details using the rdering tl. 5 A "chatbt" is a virtual cnversatinal agent using artificial intelligence t interact with a human being n a messaging system. Thalys Privacy Plicy 5/10

7 It is in ur legitimate interest t cntact yu t help yu finalise yur rder. The reminder is sent t yu n the same day f the unsuccessful rder, except in exceptinal cases invlving technical prblems. The retentin perid f yur befre deletin is 7 days maximum. D. Prfiling T better meet yur needs and expectatins, and ffer yu the best services and the mst suitable rates: We determine general r specific custmer prfiles, including: The type f passenger yu are Yur prfile, which is a summary f the infrmatin yu have shared with us, and/r the prducts/services yu have used We examine the verview f the prducts and services yu have purchased We measure yur (sub) ptimal use f a prduct r service. It is in ur legitimate interest t d this prfiling t imprve yur custmer experience. We reassure yu that this prfiling is nt intended fr autmated decisin making with negative cnsequences fr yu. 4. Hw d we prtect yur data? Thalys is cmmitted t maintaining the cnfidentiality and security f yur data and t implementing apprpriate security measures t prevent the lss, destructin, misuse, unintentinal mdificatin r disclsure f yur data: By updating security measures as the technlgy evlves, as needed By ensuring that yur data are nt accessible t unauthrised persns By requesting a prf f identity befre being able t prvide yu with any persnal infrmatin abut yu as part f the security prcedures By perfrming peridic back-ups and string this data n secure servers; By deleting r annymising yur data at the end f the legal r cntractual perid r if Thalys des nt need it any mre fr the fr the purpses fr which the persnal data was cllected. 5. Wh is yur data transferred t? Thalys undertakes nt t sell r rent yur data t third parties. In rder t prvide certain services and prducts, Thalys may cmmunicate yur data t third parties and t its prcessrs. Thalys Privacy Plicy 6/10

8 A. Third parties If we are bliged t d s by virtue f a cntractual r legal bligatin r if a legitimate interest justifies it, Thalys may transfer sme f yur data t third parties, inter alia, fr the fllwing purpses: T Thalys partners (fr example, htels, car rental cmpanies, carriers 6 ) fr the management and executin f yur travel cntract r transprt cntract. T the cmpetent authrities, in the cntext f legal prceedings. These third parties act as "data cntrllers" when perfrming this data prcessing. We draw yur attentin t the fact that these third parties have a privacy plicy that may deviate frm urs. Fr mre infrmatin abut this prcessing, we als refer yu t the applicable privacy plicy f these third parties. B. Prcessrs n behalf f Thalys T manage ur cmpany and help us prvide yu with certain prducts and services (fr example: running ur website, cnducting satisfactin surveys, etc.), we use specialised partners wh act as prcessrs and are related cntractually t us. They must then fllw ur instructins and respect the cnfidentiality f the data received n behalf f Thalys and may under n circumstances use them fr any purpse ther than the perfrmance f services n behalf f Thalys. Thalys ensures that these subcntractrs: Only have data that are necessary fr the perfrmance f their tasks and, undertake, vis-à-vis Thalys, t treat this data in a secure and cnfidential manner and t use them nly fr the perfrmance f their tasks. C. Transfers abrad Exceptinally, in the cntext f certain prcessing activities, data may be transferred t prcessrs lcated utside the Eurpean Ecnmic Area. In this case, in accrdance with the legislatin in frce, we take care t increase the level f security required in the cntracts t be cncluded with ur subcntractrs, t guarantee an adequate prtectin f yur data. If yu wish, yu can btain a cpy f the adapted cntractual clauses by cntacting ur DPO: data.prtectin@thalys.cm. 6. Hw is yur payment data managed? All the financial transactins that yu make n the Thalys website with yur means f payment are made n a secure server ('Secure Server Technlgy') which allws: Authenticatin that verifies yur identity and ensures secure brwsing and access t yur data Encryptin that ensures the cnfidentiality f yur data by mdifying it s that it cannt be read by thers Data integrity that cntrls whether the transferred data has been tampered with. 6 In the railway cntext, carrier refers individually and cllectively t the railway undertakings that perate the Thalys transprt service and with which the transprt cntract is cncluded. Thalys Privacy Plicy 7/10

9 Payment is made via the payment system f ur distributrs. In this case, yur payment-related financial data is managed by ur distributrs and stred at the distributrs. 7. What are yur rights and hw can yu exercise them? In accrdance with the law, yu have a right f access, a right f rectificatin, a right f erasure and a right t prtability f yur data. In certain cases, yu als have the right t bject t r restrict its prcessing. These rights are free and can be exercised at any time. A. General rights - Right f access: Yu have the right t access the data cncerning yu and t receive a cpy. - Right f rectificatin: We take all reasnable steps t ensure that the data we hld is up-t-date and t delete data that is incrrect r n lnger required fr prcessing. We encurage yu t access yur accunt (if applicable) frm time t time t view yur data t ensure it is up t date. If yu find that yur data is inaccurate r incmplete, yu have the right t ask us t crrect it. - Right t erasure ("right t be frgtten"): in certain circumstances (fr example when yu withdraw yur cnsent r when the prcessed data is n lnger necessary fr the purpse f the prcessing), yu have the right t ask us t delete yur data. - Right t restrict the prcessing: yu may request the limitatin f the prcessing f yur data, in which case yur data will n lnger be prcessed (but will be retained). - Right t data prtability: yu have the right t the data yu have prvided being transmitted t yu in a structured frmat, r being transmitted directly by Thalys t anther cntrller. - Right f ppsitin: When the prcessing f yur data is based n a legitimate interest, yu have the right t bject t it at any time. Hwever, be aware that in this case, Thalys has the right t present yu with its legitimate reasns justifying the cntinuatin f prcessing. Yu always have the right t bject, at any time and withut charge, t the prcessing f yur data in the cntext f direct marketing and n exceptin can be ppsed by Thalys. It als includes the right t bject t prfiling as it relates t direct marketing. B. Withdrawing yur cnsent When the prcessing by Thalys is based n yur cnsent, yu can withdraw it at any time. This withdrawal will nt affect the legality f the prcessing f yur data during the perid preceding yur withdrawal f cnsent. In the cntext f direct marketing, this means that yu can unsubscribe at any time frm newsletters and ther Thalys cmmercial cmmunicatins. Yu will be put in "pt-ut". Yu can unsubscribe by cntacting Custmer Service (custmerinfrmatinflw@thalys.cm) r ur DPO (data.prtectin@thalys.cm) r by clicking n the unsubscribe link at the bttm f each . Yu can als unsubscribe via yur Thalys accunt. Hwever, please nte that when yu exercise yur right t bject t the sending f direct marketing, this nly applies t the given address. If yu receive cmmercial mailings n several addresses, the Thalys Privacy Plicy 8/10

10 unsubscriptin prcedure must be repeated as many times as necessary, either via "my Thalys accunt" (if applicable) r via the "unsubscribe" link in each . If yu unsubscribe by pst, yu will need t specify the e- mail addresses yu want t disable. C. Wh can yu cntact? T exercise yur rights, simply cntact ur Custmer Service (custmerinfrmatinflw@thalys.cm) r ur DPO (data.prtectin@thalys.cm). When yu send us an applicatin relating t yur rights, please prvide us with yur full cntact details (name, surname, (s), full pstal address) and please attach cpy f the frnt and back f yur card t prevent abuse and t ensure the security f yur data. 8. Where can yu make a cmplaint abut the prcessing f yur data by Thalys? If yu believe that there is a vilatin f the privacy legislatin, yu have the right t ldge a cmplaint abut the prcessing f yur data with the Data Prtectin Authrity, whse cntact details are as fllws: Autrité de Prtectin des Dnnées Rue de la Presse Brussels Tel: cmmissin@privacycmmissin.be 9. Hw lng d we keep yur data? When yur data is cllected based n yur cnsent, we use it nly until yu withdraw yur cnsent. Frm the withdrawal f yur cnsent, yur data will be kept fr the minimum amunt f time necessary t accmplish the necessary technical measures t delete r annymise yur data. When yur data is used t prvide yu with ur services (e.g. management f yur trip, respnding t yur questins and requests, etc.), this data is kept fr a reasnable perid limited t the accmplishment f the bjective pursued during its cllectin, including fr the minimum amunt f time necessary t perfrm the technical measures necessary t delete r annymise yur data. In any case, yur data is kept fr the statutry limitatin perid r any ther perid f retentin that wuld be required by law. 10. Hw d we use ckies? Regardless f whether yu are a custmer r a simple visitr t the site, when yu use ur website, we place "ckies" n yur cmputer. A "ckie" is a small file sent by ur server t the hard disk f yur cmputer, tablet r smartphne that identifies yur navigatin device and cllects certain persnal data. We use different types f ckies: - "Strictly necessary ckies and functinal ckies": fr instance, they allw us t identify yur cuntry and the language yu prefer t use, t make the use f ur site as simple and pleasant as pssible; - "Perfrmance ckies": they allw us t cllect traffic statistics frm ur site t make it mre user-friendly and t ffer cntent better suited t yur needs; Thalys Privacy Plicy 9/10

11 - "Cmmercial ckies": they allw us t prpse ffers t yu that are tailred t yur interests. Hwever, this type f "ckie" will nly be installed n yur cmputer if yu have cnsented. Yu may refuse t install "ckies" n yur cmputer, but such a refusal may result in decreased functinality r slw-dwn, r may even prevent access t certain services n the site. Fr mre infrmatin n "ckies", we invite yu t read ur specific "Ckie Plicy". 11. Hw can yu stay infrmed abut changes t this Privacy Plicy? In a changing wrld where technlgies are cnstantly evlving, we draw yur attentin t the fact that this Privacy Plicy is subject t change. We therefre invite yu t regularly cnsult the latest nline versin f this Plicy and we will infrm yu via the website r thrugh ther usual channels f cmmunicatin (fr example, by ) f any changes t the Privacy Plicy. Thalys Privacy Plicy 10/10