Privacy Policy

This policy covers personal information RailOnTrak collects through this website, our mobile apps, and our customer support channels. It does not cover how the rail carrier handles information once a booking is passed to it — the carrier is an independent controller of that data and publishes its own privacy notice.

We collect the following categories of information:

• Booking details — traveller names, origin and destination stations, travel dates, seating and accessibility preferences, and your reservation number.
• Contact details — email address, phone number and postal address.
• Payment information — processed by our PCI-DSS compliant payment provider. We receive a token, the card brand and the last four digits; we never store the full card number or security code.
• Account information — your login credentials, saved travellers and stored preferences, if you create an account.
• Technical and usage data — IP address, device and browser type, pages viewed and searches run, collected through cookies and similar technologies.
• Support correspondence — messages, call notes and recordings where we tell you a call is recorded.

Where you give us accessibility requirements or details of a medical need for your journey, that is sensitive information. We use it only to arrange the assistance you have asked for, and we pass it to the carrier solely for that purpose.

• To search fares, issue tickets and confirm your reservation.
• To service your booking — changes, cancellations, refunds and disruption notices.
• To answer your questions and provide customer support.
• To take payment and to detect, prevent and investigate fraud.
• To meet legal, tax and accounting obligations.
• To improve the site — which routes are searched, where booking journeys fail, which pages load slowly.
• To send you service messages about a booking you hold. These are not marketing and you cannot opt out of them while the booking is live.
• To send marketing about fares and offers, only where you have opted in.

Where data protection law requires a legal basis, we rely on: performance of a contract for everything needed to make and service your booking; legitimate interests for fraud prevention, service improvement and securing our systems; legal obligation for tax and record-keeping; and consent for marketing, non-essential cookies, and any sensitive information you choose to give us.

You can withdraw consent at any time without affecting a booking you already hold.

• The rail carrier operating your service, so your ticket can be issued and honoured.
• Payment processors and our acquiring bank, to take payment and handle chargebacks.
• Technology suppliers who host our systems, send our email, or provide customer support tooling — each under contract and only on our instructions.
• Professional advisers, auditors and insurers where they need it.
• Law enforcement or regulators where we are legally required to disclose, or to establish or defend legal claims.

We do not sell your personal information, and we do not share it with third parties for their own marketing.

Booking and payment records are kept for seven years after travel to meet tax and accounting requirements. Account details are kept while your account is open and for 24 months after you last use it. Support correspondence is kept for 24 months. Marketing consents are kept until you withdraw them, plus a suppression record so we do not contact you again by mistake.

Technical logs are kept for 12 months. After these periods we delete the data or irreversibly anonymise it.

We encrypt data in transit with TLS and at rest, restrict access to staff who need it for their role, require multi-factor authentication on internal systems, log administrative access, and test our systems regularly. No system is perfectly secure, but where a breach is likely to put you at risk we will notify you and the relevant regulator within the timeframes the law requires.

Depending on where you live, you may have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw consent. California residents additionally have the right to know what is collected, to delete it, to correct it, and not to be discriminated against for exercising those rights.

To exercise any of these, write to [email protected]. We will verify your identity and respond within 30 days, or tell you if we need longer. You can also complain to your local data protection authority.

RailOnTrak operates from the United States and your information is processed there. Where we transfer data out of the UK, EEA or Switzerland, we use Standard Contractual Clauses or another approved transfer mechanism, together with supplementary safeguards where they are needed.

RailOnTrak is not directed at children and we do not knowingly collect information from anyone under 13 except as part of a booking made by an adult. If you believe a child has given us information directly, contact us and we will delete it.

Write to our privacy team at [email protected], call +1 (800) 240-6993, or post to RailOnTrakPrivacy, 1100 Market Street, Suite 1400, Philadelphia, PA 19107.