Coronavirus (Covid-19) - Travel advice and guidance - please visit here for more information
Timetable updates - please visit here for more information
We’ll only collect your data where it’s needed, access your data on a need-to-know basis and only store it for as long as we really need it.
The protection of your data is important to us and we will never sell your data or share any information that personally identifies you with advertisers.
When you use CrossCountry Services there are generally two different types of information that we collect;
We apply appropriate administrative, technical and organisational security measures to protect your personal data that is under our control from unauthorised access, collection, use, disclosure, copying, modification or disposal. All information you provide to us is stored on secure servers. We are part of the Arriva plc Group, which trains its employees regarding our data privacy policies and procedures and permit authorised employees to access personal data on a need to know basis, as required for their role. We also take steps to ensure that any service provider that we engage to process personal data on our behalf takes appropriate technical and organisational measures to safeguard such personal data.
We want to provide a service that is customer focused and innovative, that you can trust to meet your needs.
We therefore collect the data you provide to be able to fulfill our services to you, but also use anonymised data for example on how the website and app are used, so that we can look to always improving our service to you.
We will not intentionally or systematically seek to collect, store or otherwise use information about you classed as ‘special categories of data' or 'sensitive data'. If you require any extra assistance to help you make your journey, we offer our Passenger Assist service, this may involve you providing us with sensitive personal data. However, it is stored securely, for no more than 2 years, and is only shared with Industry Partners to enable the fulfillment of the Assist service.
We want you to feel in control of your data. You therefore can take action to use any of your rights in line with the GDPR, and we have set out an overview of the rights you have here.
If you wish to access, correct, update or request deletion of your personal information, you can do so by contacting Customer Relations.
In addition, you can object to the processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us here.
We respond to all requests wishing to exercise their data protection rights in accordance with applicable data protection laws.
When we collect your data we do so either because we have a legal basis for doing so (for example when you purchase a ticket) or for some of the data we collect we require your consent (for example marketing preferences).
If you have previously given your consent to collect data you can withdraw your consent at any time. You can update your consent preferences in our Preferences centre, please note that it may take up to 48 hours for this information to be updated.
If you wish to withdraw consent from marketing communications, or close your online account with CrossCountry, please contact us at any time at email@example.com Please note this may take up to 5 working days.
If you have any question, concerns or complaints about this Privacy notice or our handling of your personal data, you can contact us by email on XCDataProtection@crosscountrytrains.co.uk.
You can also contact Arriva plc's Data Protection Officer at firstname.lastname@example.org.