Skip to main content

NUS Banner

No Grand Central service Saturday 29 February and Sunday 1 March - Click here for information

nus Save 25% with TOTUM by NUS extra today! - See how

Arriva QTT

Buy tickets to anywhere in Great Britain

Page Title

Privacy policy

Last updated November 22nd 2019

Grand Central is committed to protecting your privacy. This privacy policy explains what personal data we collect about you, how and why we use it, and how we protect your privacy. To make it easy to use this privacy policy we have outlined the key sections in the table below which you can use to navigate the policy.

Grand Central Railway (“Grand Central”) are committed to protecting and respecting your privacy.

This notice (together with our Terms and Conditions and any other documents referred to in it) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by Grand Central or our processing partners. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting or or providing your information in the circumstances described below, you are accepting and consenting to the practices described in this policy.

  1. Who is responsible for your data?
  2. What personal data do we collect?
  3. Cookies
  4. How we use your personal data and the legal basis for such processing?
  5. Who do we share your information with?
  6. Data Retention
  7. Information security
  8. Transferring Information Internationally
  9. Updates to this Privacy Policy
  10. Your Data Protection Rights
  11. Questions about this Privacy Policy
  1. Who is responsible for your data?

For the purpose of the Data Protection Laws, the data controller is Grand Central Railway Company Ltd (“Grand Central”) and the data processor is {insert here}.

Individuals are advised that when using the “Website” those pages with a web address prefixed by these pages are managed by Grand Central as the data controller, (a company registered in England and Wales with registration number 03979826 and registered to 1 Admiral Way, Doxford International Business Park, Sunderland SR3 3XP).

  1. What personal data do we collect?

Information provided by you

You may give us information about you by filling in forms on or This includes information you may provide when you:;

  • Register and consent to receive marketing information
  • Register to buy ticket(s) or open a Grand Central account
  • Purchase ticket(s)
  • Enter a competition
  • Provide answers to a promotion or survey
  • Make a complaint
  • Claim compensation
  • Request a refund
  • Book passenger assistance
  • Report a problem with our sites

The information you may give us may include:

  • First name and last name
  • Date of birth
  • Address details including postcode
  • Email address
  • Phone number – mobile, home or work
  • Disability details (Passenger assistance)
  • Transaction meta data (e.g. journey details)
  • Relevant rail discount or loyalty cards
  • Limited amount of personal data of any other passengers you are booking tickets for
  • Personal descriptions and photographs
  • Reason for travel

Information you may provide via our website(s)

  • Geographical location – you will be asked if you wish to provide your location
  • IP or MAC address or details regarding use of your mobile device or PC


We may collect and process anonymous information about your use of the Website or Booking Service, such as some of the pages you visit and some of the searches you perform. Such information is used by us to help us improve the contents of the Website or Booking Service and to compile, for internal market research purposes, aggregate statistics about individuals using it. This kind of anonymous information can be obtained by our use of "cookies" as well as other means. Please see Section 3, 'Cookies' for more information on our use of cookies. We may also share anonymous information about your use of the Booking Service with third parties for analytical purposes.

Information we collect about you

With regard to each of your visits to either or or if you register to use our Wi-Fi services we may automatically collect the following information;

  • Technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, time zone setting, browser plug-in types and versions, and platform.
  • Device: what type of device you are using (TV, smartphone, laptop, desktop)
  • OS (Operating system): what operating system your device has (iOS, Android, Windows, Linux, Mac OS)
  • Browser & browser version: which web browser you are using (Internet Explorer/Edge, Opera, Chrome, Firefox, Safari)
  • Information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our sites (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number

Information we receive from other sources

We may receive information about you if you use any of the other websites we operate or the other services we provide. We are also working closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them.

  1. Cookies

Our site uses cookies to distinguish you from other users of our site. This helps us to provide you with a good experience when you browse our site and also allows us to improve our sites. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.

  1. How we use your personal data and the legal basis for such processing?

The collection of the personal data described in Section 2, “What personal data do we collect?” is usually mandatory and, if such personal data is not provided, we will not be able to provide the information, products and services to you. Where the collection of any personal data is not mandatory, we will inform you of this prior to collection, as well as the consequences of failing to provide the relevant personal data.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.
However, we will normally process your personal information only:

  • Where we have your consent to do so
  • Where the processing is necessary to perform our contract with you
  • Where the processing is in our legitimate interests or those of a third party and such interests are not overridden by your data protection interests or fundamental rights and freedoms
  • Where we have a legal obligation to process your personal information.

Information provided by you

We use your personal information as follows:

Purpose of processing

Legal basis for processing

Account registration – Website

Performance of a contract

Account registration – Booking Service

Performance of a contract

Registration for Wi-Fi and email confirmation

Performance of a contract

Email confirmation of Booking Service registration

Performance of a contract

Email confirmation about your tickets for train services purchased

Performance of a contract

Provision of your tickets to use our services

Performance of a contract

Fraud checks – automated

Performance of a contract related to Ticket purchase

Email and completion of rail travel surveys

Legitimate interest

Recording customer phone calls and retaining the recordings for a period of three months

Legitimate interest

When you report a problem with our sites Legitimate interest

Emails about service changes, such as timetable changes, engineering works or strike information

Performance of a contract

Consent to receive marketing emails


Competition entries


Information we collect about you

We use your personal information as follows:

Purpose of processing

Legal basis for processing

IP address to infer approximate location for our booking service (we will ask for permission to use this)

Legitimate interest to provide relevant journey information based on your current location – you will be asked to confirm via your browser if you wish this information to be known

Using your IP address for Fraud checks

Legitimate interest

Data related to your use of the Website or Booking Service through the use of cookies

Consent - Please see our Cookie Policy for details on how to block or choose preference for cookies

Information we receive from other sources.

We may combine this information with information you give to us and information we collect about you. We may use this information and the combined information for the purposes set out above (depending on the types of information we receive).

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under Section 11, “Questions about this Privacy Policy”

  1. Who do we share your information with?

We may disclose your personal data to the following categories of recipient for the purposes described in this Privacy Policy.

Third parties who process your personal data on our instructions:

Service Providers

  • We use third party service providers to carry out many of the activities listed in Section 4, “How we use your personal data and the legal basis for such processing”. This includes our Customer Relationship Management (CRM) provider Acteol.
  • Fraudulent payment detection. We use a US based payment provider who is PCI DSS Level 1 accredited who may interrogate your payment data. Your payment data is used only for the transaction and your data is not retained any longer than is required for payment processing, fraud detection/prevention and auditing
  • All payments for ticket purchase through Visa and Mastercard are processed by Silverrail.
  • Apptentive, Inc for the purpose of managing feedback in respect of the Grand Central app
  • Chiltern Railways and group bookings/carnet ticket sales
  • Whoosh Media and Wi-Fi portal provision
  • Icomera and Wi-Fi provision

Other UK Rail Operators

  • We share your personal data with some operators for ticket fulfilment purposes
  • We may share your email address or phone number with some operators so that they can contact you with service messages, for example if a train is cancelled.
  • We may also need to share some of your personal data with any other transport carriers or other service providers who provide you with any part of the services that you’ve booked through us.

The Authorities

  • In some circumstances we have a legal obligation to share parts of your personal data with police or customs authorities, regulatory authorities, government & law enforcement agencies. This may include, but is not limited to, fraud prevention and detection.
  • We may also disclose your personal data to any competent law enforcement body, regulator, government agency such as Department for Transport (DFT) or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation; (ii) to exercise, establish or defend or legal rights; or (iii) to protect your vital interests or those of any other person;


  • We may also transfer your personal data to a buyer or potential buyer (and its agents and advisers) of Grand Central in connection with any reorganisation, restructuring, merger or sale, or other transferring of assets provided that we inform any receiving party it must use your personal information only for the purposes disclosed in this Privacy Policy.
  • We may disclose your data to any other person to whom you request us to make disclosure or if you consent to such disclosure.
  1. Data Retention

We will not retain your personal data for longer than is necessary to fulfil the purposes for which we collected that personal information, unless the law permits or requires that we retain it for longer.

The table below explains in more detail how long Grand Central will store different types of customer information for:

Passenger information

Passenger details (e.g., name, address of customer etc.)

(ii) Current passenger

(ii) Lapsed passengers

For the duration of the passenger's registration with Grand Central and then for the period specified for lapsed passengers.

For a period of 6 years following the end of the year in which you last purchased Grand Central's services.

Passenger data

For the duration of the passenger's registration with the Customer and then for a period of 6 years following the end of the year in which the passenger last purchased the Customer's services.

Passenger consents to customer terms and conditions

For the duration of the processing of the Personal Data ad up to 6 years thereafter.

Passenger service enquiries

3 years

Statistical reports/marketing data

6 years

Register of complaints

Review after 10 years

Correspondence and papers including emails

Review after 6 years (or 10 years if the documents relate to a complaint or investigation)

Wi-Fi registration

Once you have created an account to use WiFi services, then the account information you provide will be retained for a period of one year. At the end of the one year period you will be asked to re-confirm your details when you log in to use and if necessary update your details to continue receiving WiFi services.

Registration information

Prospective customers then the information regarding customers (below) will apply. We will review account information on an annual basis and we may contact you to ask if you still wish to retain your account.

Customers we will keep your account for up to six years following the end of the year in which you last purchased Grand Central’s services.

Marketing information

Marketing permissions and preferences

If you have given Grand Central permission to send email marketing messages to you then we will retain your marketing preferences until you notify us that you no longer wish to receive marketing emails by updating your marketing preferences in our preference centre. We will review marketing preferences annually and may contact to you to ask if you wish to still continue receiving marketing emails.

  1. Information Security

We apply appropriate administrative, technical and organisational security measures to protect your personal data that is under our control from unauthorised access, collection, use, disclosure, copying, modification or disposal. All information you provide to us is stored on secure servers. Grand Central is part of the Arriva plc Group, which trains its employees regarding our data privacy policies and procedures and permit authorised employees to access personal data on a need to know basis, as required for their role. We also take steps to ensure that any service provider that we engage to process personal data on our behalf takes appropriate technical and organisational measures to safeguard such personal data.

  1. Transferring Information Internationally

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.

Specifically, we may use third party service providers located in Ireland, Germany, Sweden, Tunisia, and the US. This means that, when we collect your personal information, it may be processed in these countries. However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Policy. These safeguards include implementing the European Commission’s Standard Contractual Clauses for transfers of personal information to our third party service providers and further details can be provided upon request.

  1. Updates to this Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.

  1. Your Data Protection Rights

You have the following data protection rights:

  • If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting Grand Central, or via our preference centre.
  • Please note: We retain personal information from deactivated accounts to comply with law, prevent fraud, collect any fees owed, resolve disputes, assist with any investigations, enforce our terms and conditions, and take other actions otherwise permitted by law. We may also retain some pseudonymous data for analytics purposes so we can understand, for example, how many visitors we have had to the Website or Booking Service.
  • In addition, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us at [email protected] or the postal address below.
  • If we have collected and processed your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. You can update your consent preferences at any time by logging into your account. Please note it can take up to 48 hours for this information to be updated.
    We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.
  1. Questions about this Privacy Policy

If you have any question, concerns or complaints about this Privacy Policy or our handling of your personal data, you can contact us by email using [email protected]  or by post to the following address:

Grand Central Railway
3rd Floor, Northern House
Rougier Street

If you are unsatisfied with the response, you can contact Arriva plc's Data Protection Officer at [email protected].

You have the right to complain to a data protection authority about our collection and use of your personal information. If you are based in the European Economic Area, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries are available on the EU Commission's website via the following link):

The controller of your personal data is Grand Central Railway.