Trainline's Terms and Conditions Decoded

The document states it is effective from June 25, 2025, which is a future date. This means the current terms are not yet in effect.

The document states that personal data of third parties (travel companions) can be provided, and the user confirms authorization to do so. It places the burden of obtaining consent on the user, which may be problematic if not properly obtained.

The legal basis for processing credit card data for fraud prevention is stated as "legitimate interest of Trainline." This could be contested as the primary basis should be contractual necessity or legal obligation, and legitimate interest assessments may not always override data subject rights.

For marketing communications, the legal basis is stated as "our legitimate interests or your consent." Relying on legitimate interest for direct marketing, especially after a transaction, may not comply with strict opt-in requirements under regulations like GDPR without clear prior consent.

The AI Travel Assistant section states the legal basis is user consent when interacting with the assistant. However, it is unclear how this consent is obtained, especially if the assistant is a default or integrated feature.

The document mentions sharing personal data with travel operators for fraud prevention as a legitimate interest. This broad sharing for fraud prevention may not always be proportionate or necessary.

For Season Tickets, data sharing with UK rail operators via ATOC and RSP is stated as necessary for contract performance and the legitimate interests of the operators. The combination of legal bases may be ambiguous.

The document states that if Trainline stops selling Season Tickets, customer data will be transferred to the relevant rail operators based on legitimate interests. This could be problematic if not explicitly consented to by the user.

For market research, the legal basis is stated as legitimate interests or consent for specific activities. Relying on legitimate interest for contacting users for market research may not be compliant without prior consent.

The document mentions using device numbers and IP addresses for load balancing, content delivery, and estimating location for personalization under legitimate interest. Using precise location data requires explicit consent, which is noted, but the use of IP for location estimation under legitimate interest may be intrusive.

Login via social media accounts involves third-party cookies and data collection by those platforms. The document states Trainline has no control over these actions, potentially exposing users to third-party privacy practices beyond Trainline's responsibility.

International data transfers outside the European Economic Area are mentioned, with assurances of safeguards. However, the specific countries or adequacy decisions are not detailed, which could lack transparency.

The rights section mentions the right to data portability, rectification, restriction, access, erasure, and objection. However, the process for exercising these rights is only via email, which may not be the most accessible or user-friendly method.

The document provides an email address and postal address for the Data Protection Officer. While contact methods are given, there is no specified response time for queries or requests, which could lead to delays.

The document references a separate Cookies Policy for details on cookie use and preferences. Important information about tracking and personalization is fragmented, requiring users to consult multiple documents.

The document includes a mix of Italian and English terms, which may cause confusion for users not proficient in both languages, despite the language selector at the top.

The footer states "Copyright © 2026 Trainline.com Limited," which is a future date, creating inconsistency with the effective date of the policy.