Privacy Policy

Last updated - December 2023

Basic information about the processing of Personal Information

Data Controller	AMADEUS IT GROUP, S.A. will be the data controller for data processing activities related to this App ("Amadeus Rail Onboard App").
Purpose of Personal Information Processing	Amadeus will be the data controller for processing your personal data for the purposes of making the App available to you, as well as for any processing of personal data carried out based on the Terms and Conditions, specific forms made available to you and/or the sending of commercial communications as well as for the purposes of improving the App (as applicable).
Legal Grounds for Processing	The legal basis by which we will process your personal data is: (i) the performance of a contract with you, governed by the Terms and Conditions, by specific forms used when collecting your data; (ii) your consent when subscribing to our commercial communications (if applicable) and/or; (iii) Amadeus' legitimate interest for the purposes of research, analytical and statistical improvements.
Information Amadeus collects from you	Account information (username and password) IP address. Information collected through cookies (as applicable) If shared by you: (1) Name and surname; (2) Gender; (3) Age (4) E-mail address; (5) Phone number; (6) Address and country; (7) Travel itinerary and travel details Other information you may share with us based on specific forms.
Recipients of the Personal Information	We may share personal data with Amadeus affiliates, who, due to the nature of the services Amadeus provides as a global travel technology supplier, may be in any location around the world. We may also disclose your information to third parties, business partners, suppliers, subcontractors, and service providers for the performance of any contract we enter into with them.  If necessary or legally required we may disclose your personal data to public and government authorities, including public and government authorities outside your country of residence.
International Transfers of Data	Amadeus may share your personal data with its affiliates and third-party service providers, this may involve transferring personal data outside the European Economic Area. When personal data is transferred to a third country, it will continue to receive adequate protection through contractual or other arrangements put in place with Amadeus´ affiliates and third-party service providers.
Retention Period	Amadeus retains personal data for as long as necessary to fulfil the purposes it was collected for, including for the purposes of satisfying any legal requirements.
Your rights	You have the right to access, rectification, erasure, to object to and/or to restrict processing of personal information and the right to lodge a complaint with a supervisory authority (Spanish Data Protection Authority). You may exercise your rights via e-mail: dataprotection@amadeus.com or by sending your request to our registered office at Calle Salvador de Madariaga, 1, 28027 Madrid (Spain).
Additional information	More information about privacy and data protection is available below.

Last Updated: December 2023

Data Controller

This App is operated by AMADEUS IT GROUP, S.A. with registered office at Calle Salvador de Madariaga, 1, 28027 Madrid (Spain).

Amadeus will be the data controller for processing your personal data for the purposes of making the App available to you, as well as for any processing of personal data carried out based on the Terms and Conditions, specific forms made available to you and/or the sending of commercial communications as well as for the purposes of improving the App (as applicable).

Purpose of Personal Information Processing

This Privacy Statement (''Notice") is applicable to all the information collected by Amadeus from you for the purposes of making the App and its features available to you. This Notice does not address the collection, use, or disclosure of information through any other means other than the App. This Notice does not apply to the personal data that Amadeus may process about you as a traveler. If you are interested in learning more about these other processes, please follow this link.

Personal information you share with us and that we collect about you during your navigation through the App will be used, transferred and disclosed (if applicable) (''processed") as permitted by local law, to:

• Fulfill requests made by you through specific features of the App;
• Obtain your feedback and respond to questions made by you;
• Send you information regarding the App such as changes to our Terms and Conditions, policies, notices and/or other administrative information;
• Conduct data analysis, audits, developing new products, enhancing our App, improving our services, and identifying usage trends;
• Detect, prevent, or otherwise address security or technical issues in connection with this App. 

Legal grounds for processing

We process your personal data based on:

• The performance of a contract on the basis of the Terms and Conditions and/or specific forms used when collecting your personal data.
• Your consent to send you commercial communications related to Amadeus' product and/or services (if you request us to do so).
• Amadeus' legitimate interest for research, analytical and statistical activities for the purposes of improving the App. 

Information Amadeus collects from you

This Notice covers any personal information that we may collect during your navigation through the App:

• Account information (username and password)
• Name and surname
• Gender
• Age
• E-mail address
• Phone number
• Address and country
• Travel itinerary and travel details
• IP address.

We may process additional personal data that you share with us through specific forms, additional privacy and data protection disclosures will accompany any such forms as applicable.

If you intend to provide us with personal data of a third party, it is your responsibility to obtain consent from that third party prior to passing the personal information to us.

You are responsible for the content of the information you provide to us and you must ensure it is legal, truthful, accurate and not misleading in any way and does not infringe on any third party's rights or is not otherwise legally actionable by such third party.

Recipients of personal information

We may share personal data with Amadeus affiliates, who, due to the nature of the services Amadeus provides as a global travel technology supplier, may be in any location around the world. These Amadeus affiliates may process personal data for the purposes described in this Notice. A link to the complete list of Amadeus affiliates and their locations can be found here.

In addition, we may also disclose your information to:

• Third parties, business partners, suppliers, subcontractors, and service providers for the performance of any contract we enter into with them;
• Analytics providers that assist us in the improvement and optimization of our App;
• Affiliates or other third parties in the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets or stock (including without limitation in connection with any bankruptcy or similar proceedings); and
• If necessary: (a) under applicable law, including laws outside your country of residence; (b) to comply with legal processes; (c) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of our affiliates; (f) to protect our rights, privacy, safety, property, and/or that of our affiliates, you, or others; and (g) to permit us to pursue available remedies or limit the damages that we may sustain.

Where such disclosures take place Amadeus requires the appropriate technical and organizational security measures to be in place to protect personal data, and for personal data to be processed lawfully.

Amadeus only allows affiliates and third-party service providers to use personal data for specified purposes and in accordance with Amadeus' instructions. Any sharing of personal data using third party platforms would be governed by the terms of the third-party platform used. 

International Transfer of Personal Data

When Amadeus shares your personal data with its affiliates and third-party service providers who process personal data on behalf of Amadeus, this may involve transferring personal data outside the European Economic Area (''EEA"). When personal data is transferred to a third country, it will continue to receive adequate protection through contractual or other arrangements put in place with Amadeus´ affiliates and third-party service providers. For these transfers, at least one of the following appropriate safeguards will be implemented:

• Personal data will be transferred to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission;
• Standard contractual clauses as approved by the European Commission which, together with supplementary measures, will ensure personal data transferred will retain the same protection it has in EEA; or
• Any other lawful transfer mechanism as foreseen in applicable laws and/or as approved by the European Commission or relevant Data Protection Authority.

Further information on the appropriate safeguards used when transferring personal data outside the EEA can be requested through the contact details set out below in the section legal rights. When requesting this information please make a reference to the transfer of personal data outside the EEA.

Retention Period

Amadeus retains personal data for as long as necessary to fulfil the purposes it was collected for, including for the purposes of satisfying any legal requirements.

Security and Integrity of Personal Information

We use reasonable organizational, technical and administrative measures to protect personal information under our control. Unfortunately, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure. Please do not send us sensitive information through e-mail. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), you must immediately notify us of the problem by contacting us in accordance with the contacting section of this policy. Please note that e-mail communications will not necessarily be secure; accordingly, you should not include health or financial information in your e-mail correspondence with us.

When Personal Data is processed on behalf of Amadeus, access is limited to those who have a business need to know. Personal Data will be processed in accordance with the instructions of Amadeus and those who have access are subject to a duty of confidentiality. 

Amadeus has procedures in place to deal with any suspected personal data breach and will notify individuals and any applicable regulator of a breach where they are legally required to do so.  

Your rights

You may exercise your rights of access, erasure, to object, to rectification, data portability and/or to restrict the processing of your personal data by sending a request via email: dataprotection@amadeus.com or by sending your request to the applicable registered office.

Although Amadeus intends to carefully address any request and/or claim from you, as well as carefully process your Personal Data, you are entitled to file any claim or complaint before the relevant data protection authorities.

Contacting Us

If you have any questions regarding this Notice, please contact us at dataprotection@amadeus.com.