Privacy Policy

This Privacy Policy applies to personal data processed in connection with:

1. visiting the TrainCompass website,
2. creating and using an account,
3. searching routes and timetables,
4. making and managing bookings,
5. receiving ticket delivery emails and transaction communications,
6. contacting support by email, chat, voice, or forms,
7. using My Trips and passenger profile features,
8. security, fraud prevention, and service improvement.

This Policy does not replace any operator-specific privacy information that may apply to the underlying rail service where relevant.

Depending on how you use TrainCompass, we may collect the following categories of personal data:

We process personal data only where we have a valid legal basis under applicable data protection law. The appropriate legal basis depends on the purpose of processing. A valid legal basis is required under GDPR, and the legal basis chosen affects which rights apply in a given situation.

Providing some personal data is necessary for us to provide bookings or support.

For example:

1. without booking and passenger details, we may be unable to process a booking,
2. without an email address, we may be unable to deliver your ticket or confirmation,
3. without certain transaction details, we may be unable to investigate payment issues.

Where data is optional, we will generally indicate this.

We may share personal data with the following categories of recipients, only where necessary:

1. rail operators, booking partners, or ticketing partners involved in fulfilling the journey,
2. payment processors and payment service providers,
3. hosting and infrastructure providers,
4. email delivery providers,
5. customer support and communications providers,
6. analytics, monitoring, and security providers,
7. legal, accounting, tax, or compliance advisers where necessary,
8. public authorities or courts where required by law.

Where third parties process personal data on our behalf, we require them to act under appropriate contractual and legal safeguards.

If you believe that your personal data is being processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych – UODO).

You may also contact us first at letsride@traincompass.com, and we will do our best to address your concerns.

TrainCompass may use cookies and similar technologies to:

1. ensure the website functions properly,
2. maintain sessions and preferences,
3. remember language or currency settings,
4. improve performance and usability,
5. support analytics,
6. support fraud prevention and security,
7. support marketing or advertising where permitted and configured.

For more information, please see our Cookies Policy, including details on cookie categories, retention, and how to manage cookie preferences.

If you contact us through support channels such as email, chat, forms, or voice tools, we may process the information you provide, including:

1. your contact details,
2. booking details,
3. support messages,
4. troubleshooting information,
5. transcripts of support interactions where applicable,
6. technical metadata relating to the interaction.

Please do not send sensitive payment details such as full card numbers, CVV codes, passwords, or one-time codes through support channels.

Where voice support is used, the interaction may involve transcript processing and related technical event logs for service delivery, quality assurance, debugging, or security purposes.

If audio recording is ever enabled separately, we will clearly communicate the applicable conditions and legal basis.

Payments are typically processed by third-party payment service providers. We do not intentionally collect or store full payment card details in our support systems.

We may process limited payment-related metadata necessary for:

1. confirming transaction status,
2. reconciling bookings,
3. investigating payment issues,
4. preventing fraud,
5. handling chargebacks or disputes.

This may include transaction references, payment status, timestamps, and in limited cases the last 4 digits of a card where needed for tracing or support.

TrainCompass is not intended for independent use by children without the involvement of a parent or guardian where such involvement is required under applicable law.

We do not knowingly collect personal data directly from children in a manner that violates applicable law. If you believe that personal data has been provided unlawfully by a child, please contact us at letsride@traincompass.com.

We take appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, loss, or destruction.

These measures may include, where appropriate:

1. access controls,
2. encryption in transit,
3. secure hosting practices,
4. monitoring and logging,
5. provider due diligence,
6. least-privilege internal access,
7. fraud and abuse prevention measures.

No internet-based system can be guaranteed to be completely secure, but we aim to apply security measures proportionate to the risks involved.

TrainCompass may integrate with or link to third-party services, including rail operators, payment providers, communication tools, or other platforms.

Where you interact directly with a third-party service, that third party may process your data under its own privacy practices and terms. We encourage you to review their policies where relevant.

TrainCompass may use automated processes to support fraud detection, routing logic, technical diagnostics, service optimization, or booking workflows.

However, we do not intend to rely on solely automated decision-making that produces legal effects concerning you or similarly significantly affects you unless the legal conditions for doing so are met and the required safeguards are provided.

We may update this Privacy Policy from time to time, including due to:

1. legal or regulatory changes,
2. changes to our services or business model,
3. new technical solutions or providers,
4. clarification of our processing practices.

The updated version will be published on the website with an updated effective date and last updated date.