Serco Caledonian Sleepers Limited
Serco Caledonian Sleepers Limited ( “Caledonian Sleeper”, “we” or “us”) is committed to ensuring that your personal information is protected and that we are being transparent about the information we hold about you.
2. Who We Are
Caledonian Sleeper operates the Caledonian Sleeper franchise, an overnight rail sleeper service running between Scotland and England, with registered offices at Basement and Ground Floor Premise, 1-5 Union Street, Inverness, IV1 1PP.
3. Principles Of Data Protection
- used lawfully, fairly and in a transparent way;
- collected for lawful reasons that have been clearly explained to you;
- relevant to the purposes you have been told about and limited only to those purposes;
- kept accurate and up to date;
- shared only as has been explained to you, when you ask us to or when legally required to;
- kept only as long as necessary for the purposes you have been told about; and
- kept securely and protected.
Our websites may provide links to third party websites. Caledonian Sleeper is not responsible for the conduct of third party companies linked to the websites and you should refer to the privacy notices of these third parties as to how they may handle your personal information.
4. How Your Personal Data Is Collected
The circumstances in which we may collect personal data about you includes, when:
- The personal data is provided to us by you (e.g. when you agree to sign up to our new trains newsletter or receive direct marketing);
- The personal data is collected in the normal course of our relationship with you (e.g. when you are booking to travel with us via telephone or on the website);
- The personal data has been made public by you (e.g. contacting us via a social media platform) or obtained from a publicly accessible source (e.g. Companies House);
- The personal data is received by us from third parties (e.g. third party booking websites, competition partners where you consent to us receiving this information, suppliers with which we have a contractual relationship related to delivery of services);
- The personal data is collected via our IT systems, such as:
- automated monitoring of our websites, on station Wi-Fi services and other technical systems including our computer networks and connections;
- CCTV which operates in our Inverness lounge and will be in operation on our new Caledonian Sleeper MK5 carriages;
- email and instant messaging systems; and
- the call recording system for calls received into our Guest Service Centre.
- The personal data is created by us, such as records of your communications with Caledonian Sleeper if you wish to submit a ‘Delay Repay’ claim or make an enquiry.
5. Personal Data Collected
The personal information about you which we may collect and use includes:
- Personal Details: title, full name, date of birth, age and age band, sex or gender, business or home address, telephone numbers, email address, nationality, marital status, language/dialect spoken, job role, travel assistance requirements.
- Family and Friends Information: children and dependents contact details, work and friend’s details.
- Public Identifiers: signatures, passport details, driving licence details, social media handles, railcard details, photographs, voice recordings, registered weapon details, video recordings (identifying physical characteristics).
- Internal Company Identifiers: discount, promotional and voucher codes, prize letter details, Flexipass details, booking reference and reservation numbers.
- Financial Details: purchase transaction history, card payment details (in accordance with PCI DSS).
- Travel Information: travel and on-board accommodation itinerary information.
- Correspondence: responses to competitions, promotions and surveys (some details of which may be anonymised), social media postings, general correspondence.
- Preferences: consents, permissions, or preferences that you have specified, such as whether you wish to subscribe to our mailing list or agree to our terms and conditions.
- Hobbies: information about hobbies, including cycling and golf, pet ownership.
- Incident History: health and safety accidents, security incidents, accident information, complaints communications, insurance claims history.
- Special Category Information: health and medical information, racial or ethnic origin, religion, sexual orientation, philosophical beliefs, political opinions.
- Website Access Details: your computers unique identifier (e.g. IP Address), the date and time you accessed the website, passwords to access alerts preferences.
If you do not provide certain personal information which we ask for we may not be able to permit you to book and travel with us.
Caledonian Sleeper complies with the Payment Card Industry Data Security Standards (PCI DSS). We have in place robust controls surrounding the storage, transmission and processing of cardholder data that we handle.
|Processing purposes||Our reasons|
|Provision of services: to provide the requested services to you including communicating with you in relation to those services including contacting you if an issue arises when providing those services.||
|Fraud detection: to prevent and detect fraud against you or Caledonian Sleeper such as providing proof of identity if you request a copy of your data.
|Safety: ensuring safe working practices and working environment and for staff administration.||
|Security: for security purposes, such as preventing unauthorised access and modifications to systems and protecting our staff, premises and vehicles with the use of CCTV recordings and call recordings.||
|IT and website operations: for the operation and management of our websites and IT systems, providing content to you and communicating and interacting with you on our website.||
|Marketing: to promote our services via by email, telephone, social media, post or in person or otherwise but ensuring that such communications are provided to you in compliance with applicable law.||
|Claims and complaints handling: investigating whether there is an incident, including taking witness statements.||
|Internal compliance: ensuring business policies are adhered to, such as policies covering security and internet use.||
|Investigations: detecting, investigating and preventing breaches of policy and criminal offences.||
|Legal compliance: gathering and providing information required by or in relation to audits, enquiries or investigations by regulatory bodies.||
|Quality assurance: operational reasons, such as improving efficiency, training and quality control including by reviewing call recordings for training purposes.||
|Record maintenance: Updating and enhancing customer records||
|Research: Conducting market or customer satisfaction research, statistical analysis to help us manage our business such as analysing travel usage, engaging with you to obtain your views on our products and services, this can include interview at our stations or being contacted||
|Risk management: audit, compliance, controls and other risk management.||
6. How And Why We Use Your Personal Information
Data protection and privacy laws requires companies to have a “legal basis” or “lawful ground” to collect and handle your personal information. We will only collect, use and share your personal information where we are satisfied that we have an appropriate legal justification to do this, for example:
- it is necessary in connection with the performance of our contract with you or to take steps at your request prior to entering into a contract with us;
- to comply with our legal and regulatory obligations;
- for our legitimate interests or those of a third party; or
- where you have given your prior consent.
A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. Managing third party products and services sold through our website or apps, including the opportunity to upgrade your travel options, in conjunction with our third-party partners, including Seatfrog.
7. Children’s Data
Our services are intended for users aged 18 or older and we do not knowingly collect personal information relating to individuals under the age of 18 unless provided by the parent or guardian. We do not knowingly collect or solicit personal information from anyone under the age of 18 or knowingly allow such persons to provide us with their personal information without parent or guardian consent.
If you are under the age of 18, please do not send any information about yourself to us, including your name, address, telephone numbers, or email address, unless you have your parent’s or guardian’s permission.
In the event we learn that we have collected personal information from anyone under the age of 18, and do not have a parent or guardian’s consent, we will delete that information as quickly as possible.
If you have any concerns, please contact us at GSC@sleeper.scot or call us on 0330 060 0500 (UK) or +44 141 555 0888 (Overseas).
9. When Is Special Category Information Collected?
Special category personal information is particularly sensitive personal information as defined by the GDPR including information which reveals racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or data concerning health or sexual orientation.
Caledonian Sleeper does not collect special category personal data as a matter of course, however we may on occasion handle such data where, for example, the passenger may: (i) require assistance for a disability; (ii) wish to declare specific medical conditions or dietary requirements; or (iii) share sensitive details in their communications with us.
Where special category personal information is involved, we will handle that information in accordance with applicable law, including where:
- we have your explicit consent – including where you voluntarily provide us with that information;
- the law permits us to do so, to comply with our legal obligations or to exercise specific legal rights;
- you have clearly made the information public;
- processing is necessary for the establishment, exercise or defence of legal claims; or
- processing is necessary for reasons of
- substantial public interest.
10. Direct Marketing
We may use your personal information to send you updates (by email, text message, telephone or post) about our services including exclusive offers, promotions or products that we believe will be of interest to you.
We have a legitimate interest in processing your personal information for promotional purposes (see above ‘ “How And Why We Use Your Personal Information’). This means we do not always need your consent to send you promotional communications. However, where consent is needed, we will ask for this consent separately and clearly.
You can subscribe to our marketing list by selecting the option to receive marketing communications when booking on our website . You may also choose to receive promotional information from us when entering third party competitions and explicitely consent to being contacted by us.
We will always treat your personal information with the utmost respect and never sell your information, or share with other organisations without your prior permission for marketing purposes. We will take steps to limit direct marketing to a reasonable and proportionate level and only send you communications which we believe may be of interest or relevance to you.
Where applicable, you may opt out of receiving marketing communications by:
- using the unsubscribe option included on all Caledonian Sleeper marketing correspondence;
- writing to us at Marketing Department, Caledonian Sleeper Limited, 1 Union Street, Inverness, IV1 1PP; or
- sending us an email to email@example.com. Please ensure your correspondence is marked ‘Unsubscribe: Marketing Contact List’ and include your full name, email and telephone number to ensure your details are fully deleted from our direct marketing system.
11. Call Recording
We may record telephone conversations of calls which come into the Guest Service Centre telephone system on either (0330 060 0500 (UK) or +44 141 555 0888 (Overseas). The system does not currently record the content of any telephone conversations outside of this system.
We advise all incoming callers to the Guest Service Centre by recorded message that they are being recorded.
We record calls based on the following legitimate purposes:
- to provide you with the services you want to reserve;
- to establish the facts in the event of a complaint, claim or query from a caller and to monitor compliance with our customer service standards;
- to assist in ensuring compliance with regulatory procedures and to provide evidence for any regulatory investigation;
- to help protect Guest Service Centre staff from abusive or nuisance calls;
- to assist in identifying any training requirements or coaching needs for Guest Service Centre staff;
- to assist in internal Caledonian Sleeper disciplinary actions; and
- to detect and prevent crime.
- Call recordings will be stored for up to 12 months from the date of their recording unless there is a relevant incident, complaint, investigation, legal proceedings or legal obligation which requires us to retain the recording for longer. The recordings shall be stored securely, with access to the recordings controlled and managed by the Guest Experience Director and Guest Service Centre Manager. Access to the recordings is only permitted to satisfy a clearly defined business need and reasons for requesting access must be formally authorised by the Guest Service Centre Manager. Browsing of recordings without valid reason is not permitted.Please note that calls received by the Guest Service Centre via the Caledonian Sleeper digital information totems available at some stations will not be recorded.
12. Call recording
Live Chat We store transcripts of your live chat conversations with us for 14 days after the interaction. This system is utilised by us to respond to general enquiries, we advise that only minimal data be shared with us via live chat.
We currently have closed circuit television (CCTV) operating in our lounge in Inverness for the primary legitimate purposes of: (i) public and staff safety, (ii) crime prevention, detection and deterrence; and (iii) to assist and improve customer service. For these reasons, the information processed may include visual images, personal appearance and behaviours of staff, guests and general members of the public who were in the immediate vicinity of the area under surveillance.
There may be CCTV operating at other lounges, at the stations we use and at other sites where we might operate, however we are not the data controllers for those systems and you will need to contact those operators for details about their CCTV privacy policies.
We display signs in the lounge to inform guests and other individuals that they are under surveillance and may be video recorded. This information is kept in secure environments and access is restricted to Caledonian Sleeper designated security trained staff and any use shall be in compliance with the Caledonian Sleeper security and privacy policies.
We retain CCTV recordings centrally for up to 30 days, and for a longer period if they are relevant to an incident, complaint, investigation, legal proceedings for as long as legally required by regulatory bodies and law enforcement agencies.
14. Sharing Your Personal Information With Others
We will only disclose personal information to a third party in very limited circumstances, or where we are permitted to do so by law. The third parties we may share your personal data with include:
- other organisations within the Serco group of companies, where such disclosure is necessary to provide you with our services or to manage our business;
- the Scottish Ministers, which may include for the purposes of contract management review guest satisfaction information and details about complaints received;
- third parties we use to help deliver our products and services to you, e.g. banks and payment providers,
- other third parties we use to help us run our business (e.g. marketing agencies, IT support service providers, station operators, analysis experts, communication platform providers);
- third parties approved by you (e.g. when you request your details to be transferred);
- our professional advisers (e.g. law firms, insurers and brokers); and/or
- Government, regulatory and law enforcement bodies where we are required in order:
- a) to comply with our legal obligations;
- b) to exercise our legal rights (e.g. pursue or defend a claim); and
- c) for the prevention, detection and investigation of crime.
Less commonly, we may process and share your personal data with third parties where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent.
We also impose data protection obligations on contracted third parties to ensure they can only use your data to provide services to Caledonian Sleeper for the purposes listed above. The third parties cannot pass your details onto any other parties unless instructed to by Caledonian Sleeper.
15. Transferring Your Personal Information Globally
The personal information that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”) (for example, in the USA). It may also be processed by staff operating outside the EEA who work for us or for one of our service providers.
We will take appropriate steps to ensure that transfers of personal data are in accordance with applicable law and carefully managed to protect your privacy rights and interests. Transfers are limited to countries which are recognised as providing an adequate level of legal protection or where we are satisfied that alternative arrangements are in place to protect your privacy rights. To achieve this:
- we ensure transfers within Serco Group are covered by an intra-group data sharing agreement entered into be all entities within Serco Group, which contractually obliges each member to ensure that personal information receives an adequate and consistent level of protection.
- we will, when transferring personal data to third parties outside the EEA:
- put in place binding corporate agreements,
- which will include the standard contractual clauses approved by the European Commission for transferring personal information outside the EEA, to ensure that your information is safeguarded; or
- ensure that the country in which your personal information will be handled has been deemed “adequate” by the European Commission or is registered and compliant with a Privacy Shield regime.
- we carefully validate any requests for information from law enforcement or regulators before disclosing the information.
We will always co-operate with any regulators as required by law to ensure that we remain transparent about the way we handle your personal information.
16. Security Of Your Personal Information
Caledonian Sleeper takes precautions including administrative, technical and physical measures to safeguard your personal information against loss, theft and misuse, as well as against unauthorised access, modification, disclosure, alteration and destruction. We protect personal data using a variety of security measures including:
- password access;
- data back-up;
- destroying personal information if it is no longer needed for the purposes it was collected;
- placing confidentiality requirements on employees and service providers and providing training to ensure that your personal data in handled correctly; and
- secure physical storage units for hard copy files with appropriate security restrictions, preventing damage, and unauthorised access to your personal information.
Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our websites; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.
17. How Long Do We Keep Your Personal Information?
18. Your Legal Rights In Respect of Your Personal Information
You have legal rights in connection with personal information. Under certain circumstances, by law you have the right to:
- Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Portability of the personal information you provided us, in certain situations.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing.
- Object to processing of your personal information by us or on our behalf for direct marketing (including profiling) and in certain other situations (such as processing carried out for legitimate interests).
- Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
- Withdraw Consent to processing where the legal basis for processing is solely justified on the grounds of consent (please refer to section 10 for details about withdrawing consent to marketing).
If you would like to exercise any of these rights, please submit your requests to the Data Protection Champion at the following details:
Data Protection Champion
1 Union Street,
Inverness, IV1 1PP
Email: GSC@sleeper.scot Telephone: 0330 060 0500 (UK) or +44 141 555 0888 (Overseas)
Please note, to ensure security of personal information, we may ask you to verify your identity before proceeding with any such request.
19. Requests About Your Child’s Information
We hold very little data about children under the age of 18 and do not actively market to them. Children have the same rights over their own personal information as adults. However, as young children may not understand these rights or are not capable of exercising these rights, in some cases their parents may do so on their behalf.
Caledonian Sleeper takes the protection of children’s personal information very seriously and needs to be very careful about disclosure. If we are in any doubt as to whether the parent or guardian is entitled to make a request on their child or ward’s behalf, then we may refuse to comply with their request.
20. Data Protection Officer
Data Protection Officer
18 Bartley Wood Business Park
Alternatively, please email firstname.lastname@example.org or call +44 (0)1256 745900.
You also have the right to contact the Information Commissioner’s Office and file a complaint ( https://ico.org.uk/concerns/ or telephone: 0303 123 1113). The Information Commissioner’s Office will then investigate your complaint accordingly.
We ask that you please attempt to resolve any issues with us first, although you have a right to contact the Information Commissioner’s Office at any time.
Get the latest offers
Want to stay informed about the latest developments with Caledonian Sleeper? Don’t worry, we won’t bombard you with emails, and you can unsubscribe at any time, but our e-newsletter will keep you up-to-date every step of the way.