Menu Close
/ Register

Privacy policy

Journey details

  • Under 5s travel free

  • Add another railcard

Why CrossCountry trains?

Buy tickets for any train journey in Britain. We cross more of the country than any other train company.

Choose date & time

Going
departing after

Looking for dates further in the future?

Train operators can only release tickets for sale up to 90 days in advance.

But don't worry, you don’t have to miss out - Be the first to hear when tickets are available with our FREE ticket alert.

E-mail me when tickets become available Back to calendar

Station Finder

1. Executive Summary
2. Privacy Policy
       2.1. What personal data do we collect?
       2.2. Cookies
       2.3. How do we use your personal data and what is the legal basis for such processing?
       2.4. Sharing Your Information 
       2.5. Data Retention
       2.6. Information Security 
       2.7. Transferring Information Internationally
       2.8. Updates to this Privacy Notice
       2.9. Your Data Protection Rights
       2.10. Questions about this Privacy Notice


1. Executive Summary

CrossCountry (”We”) are committed to protecting and respecting your privacy.

This policy (together with our Website Terms of Use (www.crosscountrytrains.co.uk) and any other documents referred to in it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.  Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting our website (either www.crosscountrytrains.co.uk  or  www.buytickets.crosscountrytrains.co.uk ) or providing your information in the circumstances described below, you are accepting and consenting to the practices described in this policy.

For the purpose of Data Protection Legislation, the data controller is XC Trains Limited (known as CrossCountry), Admiral Way, Doxford International Business Park, Sunderland, SR3 3XP

2. Privacy Policy

2.1. What personal data do we collect?

Information provided by you.

You may give us information about you by filling in forms on our site www.crosscountrytrains.co.uk  or www.buytickets.crosscountrytrains.co.uk or that you email to us by corresponding with us by phone, e-mail or otherwise. This includes when you subscribe and/or register for any service that we may provide via our site or when you complete transactions or respond to surveys. This also includes information you provide when you register to use our sites, download our app, subscribe to our services, purchase tickets, register to receive email updates, register with us to use our on-train WiFi service, enter a competition, promotion or survey, when you contact us via our social media channels and when you report a problem with our sites or make a complaint.

The information you give us may include:

  • your name
  • address
  • e-mail address
  • phone number
  • financial and credit card information
  • personal description
  • geographical location
  • IP or MAC address
  • details regarding your mobile phone or PC (especially when you register to use our on-train WiFi service)

Passive collection of information

We may collect and process anonymous information about your use of the Website or Booking Service, such as some of the pages you visit and some of the searches you perform. Such information is used by us to help us improve the contents of the Website or Booking Service and to compile, for internal market research purposes, aggregate statistics about individuals using it. This kind of anonymous information can be obtained by our use of "cookies" as well as other means. Please see Section 2.2, 'Cookies' for more information on our use of cookies. We may also share anonymous information about your use of the Booking Service with third parties for analytical purposes.

Information we collect about you.

With regard to each of your visits to our sites or when you register to use our on-train WiFi services we may automatically collect the following information:

  • Information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our sites (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.
  • Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data and the resources that you access (this is used to help track the performance of our website).
  • We may also collect information about your computer, including where available your IP address, operating system and browser type for system administration, to improve the structure and content of our site and to report aggregated information to our advertisers and marketing agencies. This is statistical data about your browsing actions and patterns which in turn enables us to track the performance of our site and advertising efforts. It also allows us to serve relevant advertising that is likely to be of interest to you and does not identify any individual. For this reason, we may collect this information even if you do not register with us on our website

Information we receive from other sources.

We may receive information from other sources if you have provided permission for this to happen or if there is a legal reason for it to occur.

We may receive information about you if you use our website. We are also working closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them.

Sensitive personal data

We will not intentionally or systematically seek to collect, store or otherwise use information about you classed as ‘special categories of data' or 'sensitive data'.

If you require any extra assistance to help you make your journey, we offer our JourneyCare service, this may involve you providing us with sensitive personal data.

2.2. Cookies

Our site uses cookies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our site and also allows us to improve our sites. For detailed information on the cookies we use and the purposes for which we use them see our Cookie policy at https://www.crosscountrytrains.co.uk/cookie-policy.

2.3. How do we use your personal data and what is the legal basis for such processing?

The collection of the personal data described above is usually mandatory and, if such personal data is not provided, we will not be able to provide the information, products and services to you.  Where the collection of any personal data is not mandatory, we will inform you of this prior to collection, as well as the consequences of failing to provide the relevant personal data.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. 

However, we will normally process your personal information only:

  • where we have your consent to do so;
  • where the processing is necessary to perform our contract with you; or
  • where the processing is in our legitimate interests or those of a third party and such interests are not overridden by your data protection interests or fundamental rights and freedoms; and
  • where we have a legal obligation to process your personal information.

2.3.1. Information provided by you. We use your personal information as follows:

Information provided by you for Safety purposes

Area Purpose of processing Legal basis for processing

Accidents, Incidents, Assaults, or Dangerous Occurrences

 

To meet our statutory obligations for the reporting of accidents, incidents, assaults or dangerous occurrences.

For the reporting and investigation of safety related events for the purpose of preventing, or reducing the risk of their recurrence. Sharing with other organisations with a direct responsibility for maintaining, or improving railway safety.

The processing of the personal information is necessary for compliance with a legal obligation set by Office of Rail and Road Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR)
Claims To handle your claim in accordance with Claim Allocation and Handling Agreement (CAHA) for losses, property damage or personal injury

Necessary for the performance of the contract.

Licence obligations of the Office Rail and Road – Claim Allocation and Handling Agreement (CAHA)

 Information provided by you as a Customer or Stakeholder

Area

  Purpose of processing

Legal basis for processing

Purchase of tickets

Provision of your tickets to use our services.

Performance of a contract

Sending marketing information to customers

Collecting, updating and using contact details such as email address, SMS and postal address to inform you about promotions, news, ticket offers and destination ideas that may be of interest to you

Consent provided by you

Pre and post travel information

Issuing pre and post travel information, including destination ideas and booking information

Consent provided by you

Tracking and improving the performance of website

Details of your visits to our site including, but not limited to, traffic data, location data, weblogs and other communication data and the resources that you access (this is used to help track and improve the performance of our website)

Legitimate interest

Performance tracking for targeted advertising

Information about your computer, including IP address, operating system and browser type for website performance and improvement. This allows us to track performance and serve relevant advertising likely to be of interest to you and does not identify you as an individual.

Legitimate interest

Information provided by customers to us

Information you provide to us by filling in forms on our site or that you email us. This includes when you subscribe or register for any service that we may provide via our site or when you complete transactions

Performance of contract

Research and surveys

As part of customer research and surveys

Legitimate interest

Common law or statutory obligations 

Complying with any common law or statutory obligations, such as in the prevention of fraud

Legal obligations

Service updates

Providing customers with updates to train services and / or strike information

Performance of contract

Social media 

Handling customer social media enquiries

Legitimate interest

Marketing communications

Personal information such as your name and contact details when you register for an account or sign-up for marketing communications

Consent provided by you

Data analysis

Profiling and selection customers in order to send relevant, targeted communications and information and improve services

Consent provided by you

Interactions with our website and our app

Website visits and online behaviour, including app usage

Legitimate interest

Email analysis

Email engagement statistics

Consent provided by you

Customer research panel

Feedback via our customer Research Panel

Legitimate interest

Customer ressearch panel

Joining our customer Research Panel

Consent provided by you

Social media

Your messages to us via social media channels

Legitimate interest

Competition entry

Competition entry winners

Consent provided by you

Catering purchases on board

To receive electronic receipts for Catering purchase made on board the train

Consent provided by you

Stakeholders - keeping you informed

To provide you with information about our goods and services that may interest you or them

Consent provided by you

Stakeholders - supporting Rail Partnerships

To support Community Rail Partnerships

Consent provided by you

Stakeholders - supporting community causes

To support causes within the community

Consent provided by you

 Information provided by you in relation to the provision of Customer Services

Area

Purpose of processing

Legal basis for processing

Travel Assistance - Journey Care

To arrange and carry out extra assistance for your journey

Equality Act 2010, working with other Rail Industry partners to ensure compliance where complimentary services are supplied under contract. Please see our Disabled Persons Protection Policy.

Compliments, Suggestions, Complaints and Appeals

To respond, investigate and make the necessary enquiries regarding your initial correspondence.

To respond, investigate and make the necessary enquiries regarding the appeal.

Performance of a contract.

Processing is necessary to protect the vital Interests

Claims for Compensation and Refunds

To provide compensation in line with our Delay Repay Scheme

To handle the claims for compensation and refunds.

To provide compensation in line with our Passenger Charter and National Rail Conditions of Travel

Revenue Protection & Prosecutions Policy

Preventing and reducing the fare evasion and offenses of violence against its workforce, and may involve prosecution of perpetrators.

For fare evasion - National Conditions of Travel and National Railway Byelaws (2005) Regulations of Railways Act 1889,

For serious and systematic fare evasion or revenue fraud - Fraud Act 2006

For Assault against our employees is an offence - Criminal Justice Act 1988, Offences against the Person Act 1861 , Public Order Act 1986.

Please see our Prosecutions Policy

Information provided by you to our Human Resources Department

Area

Purpose of processing

Legal basis for processing

Recruitment

For pre-appointment assessment for either job vacancies, apprenticeships, placements or our graduate training program.

Necessary for the performance of a contract with you or to take steps to enter into a contract.

Information provided by you in relation to Subject Access Requests

Area

Purpose of processing

Legal basis for processing

Subject Access Request

To process and investigate any complaint, subject access request and other general requests under the General Data Protection Regulation.

Consent provided by you. Legal obligation to process your personal information – General Data Protection Regulation (GDPR)

Information provided by you in relation to you visiting a CrossCountry location

Area

Purpose of processing

Legal basis for processing

Visitors

To enable visitors to gain entry/access into CrossCountry location

Performance of a contract

2.3.2. Information we collect about you. We use your personal information as follows:

Information we collect about you for Safety purposes

Area

Purpose of processing

Legal basis for processing

CCTV Cameras and Body Worn Cameras

Images are recorded for the purpose of Customer, Security, Staff Security, Crime Prevention and Public safety on train, at stations, on platforms or at office accommodation.

Necessary for the Legitimate interest, public interest task and/or legal obligation (prevention and detection of crime).

Information we collect about you as Customer or Stakeholder

Area

Purpose of processing

Legal basis for processing

Purchase of tickets

Transactional information (such as your payment details when you buy tickets, the purchase and usage of WiFi)

Performance of contract

Marketing communications

Personal information such as your name and contact details when you register for an account or sign-up for marketing communications

Performance of contract

Targeted communications

Profiling and selection customers in order to send relevant, targeted communications and information and improve services.

Consent provided by you

Behaviour

Website visits and online behaviour, including app usage

Legitimate interest

Engagement

Email engagement statistics

Consent provided by you

Customer research panel

Feedback via our customer Research Panel

Legitimate interest

Social media

Your messages to us via social media channels

Legitimate interest

Competitions

Competition entry winners

Consent provided by you

Customer experience

To gauge the experience and use feedback for service improvements such as Surveys

Consent provided by you

2.3.3 Information we receive from other sources.

We may combine this information with information you give to us and information we collect about you. We may use this information and the combined information for the purposes set out above (depending on the types of information we receive).

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “Questions about this Privacy Notice” heading below.

Information we receive from other sources for Safety purposes

Area

Purpose of processing

Legal basis for processing

Accidents, Incidents, Assaults, or Dangerous Occurrences

 

To meet our statutory obligations for the reporting of accidents, incidents, assaults or dangerous occurrences

The processing of the personal information is necessary for compliance with a legal obligation set by Office of Rail and Road Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR)

CCTV Camera and Body Worn Cameras

Images are required for evidential purposes  in legal or disciplinary proceedings

Necessary for the Legitimate interest, public interest task and/or legal obligation (prevention and detection of crime).

Safety Claims

To handle your claim in accordance with Claim Allocation and Handling Agreement (CAHA) for losses, property damage or personal injury

Necessary for the performance of the contract.

Licence obligations of the Office Rail and Road – Claim Allocation and Handling Agreement (CAHA)

Information we receive from other sources as a Customer

Area

Purpose of processing

Legal basis for processing

Guest Checkout

You can use our booking service without logging in or registering as a new user on our mobile site or website.  Guest transactions are not displayed within your account, even if you’re already a registered user of our booking service and you book a ticket as a “guest” without logging in.

Consent provided by you.

Guest Bookings

All personal data collected when guest bookings are made will be used in accordance with this Privacy Policy, including if you are not a registered user.

Consent provided by you.

Information we receive from other sources for the provision of Customer Services

Area

Purpose of processing

Legal basis for processing

Travel Assistance

To carry out assistance for your journey

Peformance of a contract

Compliments, Suggestions, Complaints and Appeals

To respond, investigate and make the necessary enquiries regarding your initial correspondence.

To respond, investigate and make the necessary enquiries regarding the appeal.

Performance of a contract

Processing is necessary to protect the vital interests

Claims for compensation and refunds

To assist with the Customer Delay repay claim by sharing the information with the appropriate Other Train Operators. 

To provide compensation in line with our Passenger Charter and National Rail Conditions of Travel

Revenue  Protection & Prosecutions Policy

To support investigations

National Conditions of Travel and National Railway Byelaws

 Information we receive from other sources in our Human Resources Department

Area

Purpose of processing

Legal basis for processing

Recruitment

We may receive references from previous employers or assessment We may also receive reports from external suppliers for pre-employment testing or medicals reports

Necessary for the performance of a contract with you or to take steps to enter into a contract.

 Information we receive from other sources in relation to Subject Access Request

Area

Purpose of processing

Legal basis for processing

Subject Access Request

Processing and investigating of Data Protection complaints received from the Information Commissioner’s Office

Consent provided by you. Legal obligation to process your personal information – General Data Protection Regulation (GDPR)

2.4. Sharing Your Information

We may disclose your personal data to the following categories of recipient for the purposes described in this Privacy Notice:

Sharing your information for Safety Purposes

  • With Rail Safety and Standard Board, Rail Accident Investigation Branch, Office of Rail and Road, Government appointed enquires, legal representors and other Rail Industry Partners to meet our statutory obligations for the reporting of accidents, incidents, assaults or dangerous occurrences.
  • With British Transport police, legal, other Rail Industry Partners, CCTV images required for evidential purposes in legal or disciplinary proceedings.
  • With Solicitors, Transcare Law, Office of Road and Rail, consumer watchdogs, and other Rail Industry Partners in accordance with Claim Allocation and Handling Agreement (CAHA) for losses property damage or personal injury.

Sharing your information as Passenger/Member of the Public or Stakeholder

Service providers:

  • We use third party service providers to carry out many of the activities listed in the sections above, “How we use your personal data and the legal basis for such processing”. This includes our Customer Relationship Management (CRM) provider Acteol and Trainline.com, as well as digital agencies and services such as Google to provide digital advertising, activities and analytics.
  • Our service providers act on our instructions, and we ensure that they take measures to keep your personal data safe.
  • We don’t allow our service providers to use your personal data for any purpose other than carrying out the service in question, and we only provide them with those parts of your personal data that they actually need.
  • All payments for ticket purchase through Visa and MasterCard are processed by Trainline.com Limited.

Other UK Rail Operators:

  • We share your personal data with some operators for ticket fulfilment purposes
  • We may share your email address or phone number with some operators so that they can contact you with service messages, for example if a train is cancelled.
  • We may also need to share some of your personal data with any other transport carriers or other service providers who provide you with any part of the services that you’ve booked through us.

The Authorities:

  • In some circumstances we have a legal obligation to share parts of your personal data with police or customs authorities, regulatory authorities, government & law enforcement agencies. This may include, but is not limited to, fraud prevention and detection.
  • We may also disclose your personal data to any competent law enforcement body, regulator, government agency such as Rail North, the Department for Transport (DfT) or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation; (ii) to exercise, establish or defend or legal rights; or (iii) to protect your vital interests or those of any other person;

Sharing your information for the provision of Customer Services

  • To carry out assistance for your journey we work closely with Office of Road and Rail, Rail Delivery Group, Rail Industry partners, and Taxi companies in order to continually improve the levels of service we offer customers who require such assistance when making a journey.
  • To allow complaints and appeals to be processed by the appropriate company in accordance with the Railways Passenger Charter.
  • To provide compensation for delays in line with our Passenger Charter and National Rail Conditions of Travel.
  • Preventing and reducing the fare evasion and offences of violence against its workforce, which may involve prosecution of perpetrators in accordance with National Conditions of Travel and National Railway Byelaws.

Sharing your information – Human Resources Department

  • For external suppliers to support us in our pre-appointment assessment for either job vacancies, apprenticeships, placements or our graduate training program.

Sharing your information in relation to Subject Access Request

  • Information Commissioner Office – for the purposes of reporting, processing and investigating of Data Protection complaints received from the Information Commissioner's Office.

Other

  • Companies within the Arriva Group for the performance of any contract we enter into with them or you.
  • We may also transfer your personal data to a buyer or potential buyer (and its agents and advisers) in connection with any reorganisation, restructuring, merger or sale, or other transferring of assets provided that we inform any receiving party it must use your personal information only for the purposes disclosed in this Privacy Notice.
  • We operate CrossCountry franchise under arrangements with the Department for Transport and the franchise operations may pass to a successor operator. We may disclose your personal data to the relevant franchising authority and/or any successor operator and any successor operator must only use this personal data for the purposes disclosed in this Privacy Notice.

Finally, we may disclose your data to any other person to whom you request us to make disclosure or if you consent to such disclosure.

2.5. Data Retention

We will not retain your personal data for longer than is necessary to fulfil the purposes for which we collected that personal information, unless the law permits or requires that we retain it for longer.

The table below explains in more detail how long CrossCountry will store different types of information for:

Data Retention - Safety purposes

Customer information

Retention Period

Accidents, incidents, assaults or dangerous occurrences

As per the Statutory provisions.

CCTV Cameras and Body Worn Cameras

Maximum 30 days dependant of system capabilities from record creation, unless there is a specific request relating to the CCTV/camera footage. Where there is a specific request which includes crime. Terrorism and HM Coroner relating to the CCTV/camera footage, the footage will be kept for the duration of the claim matter, plus an additional six years after the claim is closed.

Safety claims

For the duration of the claim, plus an additional 6 years after the claim is closed.

Data Retention relating to the provision of Customer or Stakeholder

Customer information

Retention Period

For customers who have not made a on line transactions in the last 6 years

We will keep customer details and marketing preferences for 3 years since their last interaction with any CrossCountry communication.

If a customer has not interacted with any CrossCountry communication in the last 3 years, we will anonymise all of their personal data and marketing preferences.

For customers who have made a on line transactions in the last 6 years

We will keep marketing preferences for 3 years since a customer’s last interaction with any CrossCountry communication.

We will keep customer information and transactional data for 6 years since a customers’ last transaction. After that point, we will anonymise all personal data and marketing preferences

Anonymised website data

We will keep anonymised website data (including but not limited to traffic data, location data, operating systems and browsing information) for 38 months. This data helps us with the ongoing improvement and development of our website and does not identify users individually (for example through a MAC address, IP address or cookie data).

Stakeholder – General

For no longer than the necessary for the purposes for which the personal data was collected.

Stakeholder – community Rail

For no longer than the necessary for the purposes for which the personal data was collected.

Stakeholder – Cause

For a period of 6 years after the support is provided.

Data Retention relating to the provision of Customer Services

Customer information

Retention Period

Travel Assistance

For a period of 2 years (as advised by Rail Delivery Group)

Complements, Suggestions, Complaints and Appeals

For no longer than the necessary for the purposes for which the personal data was collected (maximum period of 6 years)

Compensation & Refunds

For no longer than the necessary for the purposes for which the personal data was collected (maximum period of 6 years).

Revenue Protection & Prosecutions Policy

For a period of 6 years following the end case completion

 Data Retention – Human Resources Department

Customer information

Retention Period

Recruitment/Pre Boarding

 Job application and interview notes for unsuccessful candidates is held for 6 months

 Data Retention - Subject Access Requests

Customer information

Retention Period

Subject Access Request

 We hold the data for 2 years

2.6. Information Security

We apply appropriate administrative, technical and organisational security measures to protect your personal data that is under our control from unauthorised access, collection, use, disclosure, copying, modification or disposal.  All information you provide to us is stored on secure servers.  We are part of the Arriva plc Group, which trains its employees regarding our data privacy policies and procedures and permit authorised employees to access personal data on a need to know basis, as required for their role.  We also take steps to ensure that any service provider that we engage to process personal data on our behalf takes appropriate technical and organisational measures to safeguard such personal data.

 2.7. Transferring Information Internationally

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident.  These countries may have data protection laws that are different to the laws of your country. However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Notice. These safeguards include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information to our third party service providers and further details can be provided upon request.

2.8. Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.  We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws.

You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice. 

2.9. Your Data Protection Rights

You have the following data protection rights:

  • If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting us at any time at XCDataProtection@crosscountrytrains.co.uk.
  • In addition, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us at XCDataProtection@crosscountrytrains.co.uk.

If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. . You can update your consent preferences in our Preferences centre, Please note that it may take up to 48 hours for this information to be updated.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

2.10. Questions about this Privacy Notice

If you have any question, concerns or complaints about this Privacy notice or our handling of your personal data, you can contact us by email on XCDataProtection@crosscountrytrains.co.uk or by post to the following address:

CrossCountry, 5th Floor, Cannon House,18 The Priory Queensway, Birmingham, B4 6BS

If you are unsatisfied with the response, you can contact Arriva plc's Data Protection Officer at data.protection@arriva.co.uk.

You have the right to complain to a data protection authority about our collection and use of your personal information.  If you are based in the European Economic Area, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries are available on the EU Commission's website via the following link): http://ec.europa.eu/justice/data-protection/article-29/structure/data-protection-authorities/index_en.htm).

Did you find this page useful?