Privacy policy

ON THE MOVE: THIS IS WHAT YOU NEED TO KNOW

But just in case you’re on the move or do not have time to read it in full we have summarised the key points for you in our 'speed read' section below.

• South Western Railway (SWR, we, our or us) is a trading name of First MTR South Western Trains Limited. We are registered as a data controller with the Information Commissioner's Office and our registration number is ZA259128.
• We have appointed a Data Protection Officer. They are responsible for our approach to data protection and protecting your privacy. You can contact them at SWRailway.DPO@firstgroup.co.uk
• We process (i.e. handle) your personal data to provide our services to you. Under data protection laws, we are only permitted to process your personal data where we have a legal basis for doing so. We will only ever process your personal data in compliance with applicable law.
• We may share your personal data with our third party suppliers, including payment processors and data analysts, to enable the efficient and secure provision of services to you. Except as explained in this privacy policy, we will not share your data with third parties without your consent unless required to do so by law.
• We will keep your personal data for as long as we need it. How long we need your personal data depends on what we are using it for, whether that is to provide services to you, for our own legitimate interests (described below) or so that we can comply with the law. We will actively review the information we hold and when there is no longer a customer, legal or business need for us to hold it, we will either delete it securely or in some cases anonymise it.
• We may transfer your personal data to a recipient located outside of the United Kingdom (UK). If we do this, we will ensure that the transfer mechanism provides an adequate level of protection, which has been recognised by the United Kingdom.
• You have important rights under laws aimed at protecting your personal data. This policy sets out your rights and how can you exercise them. For more information, click here. You also have the right to make a complaint to the Information Commissioner's Office if you are unhappy with how we have handled your personal data. For more information click here.

CONTENTS

1. ABOUT SOUTH WESTERN RAILWAY

2. ABOUT THIS PRIVACY POLICY

3. WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU?

4. HOW IS YOUR PERSONAL DATA COLLECTED?

5. PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

6. COMMUNICATIONS

7. WHO WILL HAVE ACCESS TO YOUR PERSONAL DATA?

8. WHO ELSE MIGHT WE SHARE YOUR PERSONAL DATA WITH?

9. HOW DO WE PROTECT YOUR PERSONAL DATA?

10. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

11. WHAT ARE YOUR RIGHTS?

12. COOKIES

13. WHO CAN YOU ASK FOR MORE INFORMATION?

1. ABOUT SOUTH WESTERN RAILWAY

2. ABOUT THIS PRIVACY POLICY

3. WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU?

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity Data includes first name, surname, username or similar identifier, marital status, title, date of birth, gender and CCTV footage.
• Contact Data includes billing address, delivery address, postcode, email address and telephone numbers.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details as to your journeys, details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
• Profile Data includes your username and password, purchases or orders made by you, any interests communicated to us to enable the personalisation of services, travel preferences, feedback and survey responses.
• Usage Data includes information about how you use the Website, products and services.
• Health Data includes information relating to your mobility and disability status to enable us to provide assisted travel and ensure that you receive the correct pricing and any information detailed within any accident reports that relates to personal injury or receipt of medical attention.
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data is not considered personal data in law as this data does not directly or indirectly reveal your identity. An example of Aggregated Data would be where we use your Usage Data to calculate the percentage of users accessing a specific Website feature. If the Aggregated Data is combined with other personal data to directly or indirectly identify you, we will treat this combined data as personal data and in accordance with this privacy policy.

Special Category Data includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data. We do not seek to collect or otherwise process your Special Category Data, except where:

• we have obtained your explicit consent prior to processing your Special Category Data (e.g. you consent to us processing your Health Data to provide travel assistance services to you);
• the processing is necessary for compliance with a legal obligation;
• the processing is necessary for the detection or prevention of crime (including the prevention of fraud) to the extent permitted by applicable law;
• you have manifestly made those Special Category Data public;
• the processing is necessary for the establishment, exercise or defence of legal rights; or
• processing is necessary for reasons of substantial public interest and occurs on the basis of an applicable law that is proportionate to the aim pursued and provides for suitable and specific measures to safeguard your fundamental rights and interests.

4. HOW IS YOUR PERSONAL DATA COLLECTED?

Direct interactions:

• register to use our Website or app;
• update or add personal data to your “My Account”;
• buy train tickets or other products or services;
• use our Wi-Fi on-board or at stations;
• enter a competition, promotion or survey; or
• report a problem with our Website or give us feedback.

We may process personal data that you manifestly choose to make public, including via social media (e.g. we may collect information from your social media profile(s), to the extent that you choose to make your profile visible).

Automated technologies or interactions:

• web usage information (e.g. IP address), your login information, browser type and version, time zone setting, operating system and platform; and
• information about your visit, including the full Uniform Resource Locators (URLs) clickstream to, through and from our Website (including date and time); time on page, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs).

Where we collect information about you in the ways described above, we do so on the basis that it is in our legitimate interests to collect and process this data. In most situations this will be anonymised but we collect and process this data to ensure that our site is functioning properly and that our customer experience is to the standard that you and we expect.

The Website may, from time to time, contain links to and from the websites of advertisers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

We also use cookies on our Website. Please see this section for more information.

We use automated decision making to calculate the validity and value of Refunds and Delay Repay claims made through our website. When you receive notification of the outcome of your claim, you can appeal the decision.

• All appeals for Delay Repay will follow an automated process and will either be deemed successful and payment will be made in due course or will be forwarded to a member of the Delay Repay team for manual review. If you remain dissatisfied, you can appeal the outcome of your claim via the Customer Relations team.
• If you are unhappy with the outcome of your refund claim, you can contact our Customer Relations team and ask them to review your case.

Information we receive from other sources:

We may receive information about you if you use any other website we operate or the other services we provide. We are also working closely with third parties, (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them, in particular where you purchase any of our products or services through such third parties. In addition, we may receive information about you from third parties who provide it to us (e.g. your employer, our customers and law enforcement authorities).

When we receive information from other sources, we rely on them having the appropriate provisions in place telling you how they collect data and who they may share it with. We carefully check our sources to ensure that we only receive your information when it is lawful for us to do so.

CCTV and Body Worn Video:

We employ CCTV and Body Worn Video (BWC) cameras (BWC include audio recording capabilities) to capture, record and monitor what takes place at our offices, stations, car parks and on our trains in order to help provide a safe environment for both our employees and customers, reduce the number of assaults on our employees, provide an accurate record of certain interactions and prevent, deter and detect crime.

For further information on CCTV and retention periods, please contact us using the details provided in this section (section 13) below.

5. PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

• you have given us consent to do so for the specific purposes which we have told you about - for example, we will need your consent to process any health information you provide to us, such as information relating to mobility;
• it is necessary for us to do so to enable us to provide you with the services that you have requested from us - for example, contacting you about your journey;
• it is necessary in order to fulfil our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; or
• the law otherwise permits or requires it.

We have set out below a list of all the ways we may use your personal data and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate.

In some cases we may use more than one legal basis for processing your personal data; this will depend on the specific purpose for which we are using your personal data. Please contact us if you have any queries about the specific legal basis that we rely on for processing your personal data.

6. COMMUNICATIONS

Marketing communications:

We can only use your personal information to send you marketing messages if we have either your consent or a ‘legitimate interest’. A ‘legitimate interest’ is when we have a business or commercial reason to use your information, for example contacting you with pre-departure information ahead of a journey you have booked with us. It must not unfairly go against what is right and best for you.

The personal data we have for you is made up of what you tell us, and the data we collect about you when you use our services, or data provided to us from third parties we work with. We study this to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

We want to ensure that you are informed and aware of the best products, services, promotions and events that we can offer you. By consenting to receive additional communications (by mail, telephone, SMS, text/picture/video message, app push notifications or email) from us and any named third parties that feature at the point of obtaining consent in respect of such information, we will process your personal data in accordance with this privacy policy.

If you have provided your consent to receive marketing communications from us and you change your mind, you can change your preferences and unsubscribe at any time by unsubscribing from the relevant communication channel, changing your preferences in your “My Account” or by contacting us at customerrelations@swrailway.com. If you choose not to receive this information we will be unable to keep you informed of new products, services and promotions that may interest you.

Whatever you choose, you'll still receive booking confirmations and other important information, for example service communications.

Service communications

As detailed in the table at section 6, we may send you communications such as those which relate to any service updates (e.g. service disruption or cancellations) or provide customer satisfaction surveys. We consider that we can lawfully send these communications to you as we have a legitimate interest to do so, namely to effectively provide you with the best service we can and to grow our business.

7. WHO WILL HAVE ACCESS TO YOUR PERSONAL DATA

We take your privacy seriously and have implemented appropriate physical, technical and organisational security measures designed to secure your personal data against accidental loss, destruction or damage and unauthorised access, use, alteration or disclosure.

8. WHO ELSE MIGHT WE SHARE YOUR PERSONAL DATA WITH

We may share your personal data with you, and where appropriate, your family, your associates and your representatives.

We may share your personal data with any member of our group which means our subsidiaries, our ultimate holding company (FirstGroup plc) and its subsidiaries as defined in section 1159 of the UK Companies Act 2006. For example, where we facilitate the ability to book corporate travel through our Business Direct platform, your personal data may be accessible by another member of our group which also makes use of the platform.

We may disclose your personal data to the British Transport Police or any other law enforcement agency or court to the extent necessary for purposes including preventing, investigating, detecting, and prosecuting criminal offences; preventing threats to public security in accordance with applicable law; or validating a claim.

We may share your personal data with the following third-parties who assist us with administering the provision of our services to you:

• business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you;
• analytics and search engine providers that assist us in the improvement and optimisation of our site;
• other rail industry bodies including the Office of Rail and Road, other Rail Operators, Network Rail, Transport Focus, the Department for Transport, Transport for the North and London TravelWatch, in order to comply with our regulatory obligations and to help resolve complaints or other issues; and
• agents we engage to perform functions on our behalf including fulfilling order deliveries, repaying compensation claims for delay, sending customer communications, analysing data, providing marketing assistance, processing payments, issuing and obtaining payment for penalty fares or fines, researching customer satisfaction, and providing customer service. They have access to personal data needed to perform their functions, but may not use it for other purposes.

We may share your data with third party advertising platforms (such as Sky Media) for the purpose of building a 'lookalike audience'. The advertising platform will match the data we hold about our customers with their own customer data in order to identify similar groups of people. This matching activity allows us to undertake non-targeted advertising campaigns to an audience which is similar to that of our customers. Once the lookalike audience has been built, the advertising platform will delete our customer data and are not permitted to use the data for any other purpose.

We may also pass Aggregated Data on the usage of our site (e.g. we might disclose the median ages of visitors to our site, or the numbers of visitors to our site that come from different geographic areas) to third parties but this will not include information that can be used to identify you personally.

If a business transfer or change of business ownership takes place or is envisaged or if our rail franchise is awarded to another company in the future, we may transfer your personal data to the Secretary of Statement for Transport and/or the new owner (or a prospective new owner) or the new franchisee. If this happens, you will be informed of this transfer.

9. HOW DO WE PROTECT YOUR PERSONAL DATA?

We take your privacy seriously and are committed to maintaining the privacy and security of the personal data you provide to us, and the choices you have regarding our collection and use of your personal data

Once we have received your personal data, we follow strict security procedures as to how your personal data is stored and used, and who sees it, to help stop any unauthorised access.

Any payment transactions will be encrypted. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our site, you are responsible for keeping this password confidential. You should not share this information with anyone.

The information that we collect from you may be transferred to, and stored at, a destination outside the United Kingdom (UK). When we transfer and store your personal data outside of the UK we will ensure that it is adequately protected by using appropriate safeguards as further detailed below.

Staff operating outside the UK who work for us, or one of our suppliers, may process the information. Such staff may be engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services.

Where your personal data is transferred from the UK to a recipient outside the UK in a country not recognised by the United Kingdom as providing an adequate level of protection for personal data, such transfer shall be covered by a framework recognised by the relevant authorities or courts as providing an adequate level of protection for personal data including but not limited to:

• Standard Contractual Clauses (the agreement in the form annexed to the European Commission's decision of 5 February 2010 on Standard Contractual Clauses for the transfer of personal data to processors established in third countries which can be found here);

Unfortunately, the transmission of your personal data via the internet is not completely secure and although we do our best to protect your personal data, we cannot guarantee the security of your data transmitted to us over the internet and you acknowledge that any transmission is at your own risk.

10. HOW LONG DO WE KEEP YOUR PERSONAL DATA?

We will keep your personal data for no longer than is necessary for the purposes for which it was obtained. The criteria for determining the duration for which we will retain your personal data are as follows:

(1) we will retain your personal data in a form that permits identification only for as long as:

(2) the duration of:

(3) in addition, if any relevant legal claims are brought, we may continue to process your personal data for such additional periods as are necessary in connection with that claim.

During the periods in paragraphs (2)a and (2)b above, we will restrict our processing of your personal data to the storage of, and maintaining the security of, those data, except to the extent that those data need to be reviewed in connection with any legal claim or obligation under applicable law.

After this period your personal data will be anonymised so that you are no longer identified or identifiable from such information, or securely deleted/destroyed.

Any third parties that we engage will keep your data stored on their systems for as long as is necessary to provide the relevant services to you or us. If we end our relationship with any third party providers, we will make sure that they securely delete or return your personal data to us.

The retention periods for CCTV and BWV vary depending on the location and system in use. Such periods tend not to exceed 30 days and will always be reasonable or as long as is required by law. For more information please contact us using the details provided in in this section.

We may retain personal data about you for statistical purposes (for example, to help us better advertise our services). Where data is retained for statistical purposes it will always be anonymised, meaning that you will not be identifiable from that data.

11. WHAT ARE YOUR RIGHTS?

• provide you with a copy of the information we hold about you;
• update any of your personal information if it is inaccurate or out of date;
• delete the personal data we hold about you - if we are providing services to you and you ask us to delete personal data we hold about you then we may be unable to continue providing those services to you;
• restrict the way in which we process your personal data;
• stop processing your data if you have valid objections to such processing; and
• transfer your personal data to a third party.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

As explained in the section on Communications above, even if you consented to the processing of your personal data for marketing purposes (by ticking the relevant box or by requesting information about services), you have the right to ask us to stop processing your personal data for such purposes. You can exercise this right at any time by unsubscribing from the relevant communication channel, changing your preferences in the preference centre or by contacting us at customerrelations@swrailway.com.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

12. COOKIES

13. WHO CAN YOU ASK FOR MORE INFORMATION?

Post: SWR CUSTOMER RELATIONS

Email: Use our contact form

Telephone number: 0345 6000 650

Alternatively, you can contact us through the Contact Us section of the Website.

We have appointed a Data Protection Officer. They are responsible for our approach to data protection and protecting your privacy. You can contact them at SWRailway.DPO@firstgroup.co.uk

If you are unsatisfied with our response to any data protection issues you raise with us or our DPO, you have the right to make a complaint to the Information Commissioner’s Office (ICO). The ICO is the authority in the UK which is tasked with the protection of personal data and privacy.