Privacy Policy

Version: 2.0.1

Last reviewed: 24 June 2025

Legal entities processing data: Choo Choo (t/a Clever Sausage Enteprises Limited), registered at Gothic House, Barker Gate, Nottingham, NG1 1JU (referred to as 'us' in this document) and our Ticket Issuing System, Raileasy Ltd, registered at 10 Station Parade, Wanstead E11 1QF

As a responsible company, the stewardship of your personal data provided to us is a top priority. We detail what data of yours we handle, why we need it, and—most importantly—how we keep it safe.

What data is collected, and why?

Core booking and service data

To fulfil your booking with a Raileasy-powered brand, we may need to collect the following Personal Identifiable Information (PII) from you:

Data Type	Why we need it/Basis for processing	Who handles this
Full name Full physical address Phone number	• Assist with payment processing • Pass through to our fulfilment provider for Ticket on Departure (ToD) fulfilment • Assist with support requests • Assist with Delay Compensation	• Us • Raileasy • Third-party fulfilment providers • Third-party support providers • Third-party payment provider
Email address	• User account management • Send service emails (booking confirmations, e-tickets, disruption notifications) • Newsletter-based marketing (if opted in) • Assist with support requests • Collect customer reviews • Assist with Delay Compensation	• Us • Raileasy • Third-party fulfilment providers • Third-party support providers • Third-party payment provider
Payment details	Assist with payment processing	Third-party payment provider (We do not handle or hold raw card details ourselves, in accordance with PCI-DSS guidelines)
Technical data (IP address, browser version, device details)	• Stop bot traffic • Debug technical issues • Statistical analysis	• Us • Raileasy • Our analytics provider • Our CAPTCHA service provider
First name Booking reference Product descriptor (e.g. 'Train tickets from x to y')	• Assist with Delay Compensation • Collect customer feedback to improve the service	• Us • Trustpilot A/S (registration number 30276582), Pilestraede 58, 5th Floor, 1112 Copenhagen K, Denmark

Analytics and behavioural data

We use Google Analytics 4 (GA4) on our website and mobile applications to understand how users interact with our services and to improve your experience. Google Analytics collects information including number of users, session statistics, approximate geolocation, and browser and device information.

Google Analytics data collection includes:

Automatically collected data:

User metrics: Number of users, session duration, pages viewed, bounce rate
Device information: Browser type and version, operating system, screen resolution, device type (mobile, tablet, desktop)
Location data: Approximate geographical location based on IP address (country, region, city level)
Traffic sources: How users found our website (search engines, direct visits, referrals, social media)
Website interactions: Page views, clicks, form submissions, time spent on pages

Business intelligence data we collect:

User journey mapping: Path users take through our website, entry and exit pages
Conversion tracking: Booking completions, abandoned bookings, payment completion rates
Search behaviour: Internal search queries, search results clicked
Feature usage: Which features and tools users interact with most
Error tracking: Technical errors encountered, failed transactions
Performance metrics: Page load times, application responsiveness
Marketing effectiveness: Campaign performance, attribution data
Customer segmentation data: User behaviour patterns, repeat vs. new customers

Enhanced measurement events (when enabled):

Scrolling behaviour, outbound link clicks, site search, video engagement, file downloads

Identifiers and cookies

For websites:

Google Analytics stores a client ID in a first-party cookie named _ga to distinguish unique users and their sessions
The _ga cookie typically expires after 2 years
We also use additional Google Analytics cookies (ga*, _gid) for session management and user identification

For mobile applications:

Google Analytics for Firebase SDK automatically generates and assigns an app-instance identifier to each instance of your app

On iOS: May collect Advertising Identifier (IDFA) if available and consented to, otherwise uses Vendor Identifier

On Android: Collects Advertising ID by default (can be opted out in Android Settings)

Data sharing with google

When you use our services, we share certain data with Google Analytics for the purposes described above. This data is processed according to Google's Privacy Policy and their Analytics Terms of Service. For detailed information about how Google uses data from sites that use their services, visit: How Google uses information from sites or apps that use our services.

Third-party authentication services data

If you choose to use third-party authentication providers such as Apple or Google for signing in to your Choo Choo account:

We only receive limited information from the authentication provider
Any data you provide directly to these platforms remains under their own data protection policies
For Apple Sign-in, you may choose to hide your email address using Apple's private relay service

Cookies and similar technologies

We use cookies and similar technologies for:

Essential functionality: User authentication, security, remembering your preferences
Analytics: Google Analytics cookies as described above
Performance: Monitoring website performance and user experience
Marketing: With your consent, for personalised advertising and remarketing

You can control cookie settings through your browser preferences. Note that disabling certain cookies may affect website functionality

Your choices and controls

Opt-out options

Google Analytics:

Install the Google Analytics Opt-out Browser Add-on
Use your browser's "Do Not Track" setting
Disable cookies in your browser settings

Marketing communications:

Unsubscribe links in our marketing emails
Update preferences in your account settings
Contact our support team

Mobile app permissions:

Adjust permissions in your device settings
Control advertising preferences through your device's privacy settings

Data subject rights

Under UK GDPR, you have the right to:

Access: Request a copy of your personal data (Subject Access Request)
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your personal data
Portability: Receive your data in a structured, machine-readable format
Restriction: Limit processing in certain circumstances
Objection: Object to processing based on legitimate interests
Withdraw consent: Where processing is based on consent

To exercise these rights, please contact us at support@choochoo.co.uk

Data security and storage

Your personal data is controlled by a UK-based company, so comes under UK GDPR laws and ICO guidelines. Like Raileasy, we may use trusted cloud storage providers with global locations (such as Google's Cloud Platform and Amazon's Web Services). All PII is stored within the UK/EEA
We implement both physical and digital protections to keep your personal data safe, including:

Regular security reviews and monitoring of our digital infrastructure
Encryption of data in transit and at rest
Access controls and authentication measures
Regular security assessments and updates

Data retention

Booking and transaction data: Retained for 7 years for legal and accounting purposes
Google Analytics data: Automatically deleted after 26 months (can be configured)
Marketing data: Until you unsubscribe or request deletion
Technical logs: Typically retained for 12 months
Support communications: Retained for 3 years

You can request earlier deletion of your data by contacting us.

App permissions

In order to provide features, Choo Choo may request access to the following iOS and Android app permissions:
Location: If access is granted, your location information is used to display nearby train stations. Your location information is only ever checked locally against a local database of train station locations; your location is not uploaded to our servers.
For information on managing Location access:

iOS: https://support.apple.com/en-gb/HT207092
Android: https://support.google.com/accounts/answer/6179507?hl=en

Calendars: If access is granted, access to your calendars is used to add events for journeys to a calendar. Choo Choo never reads information from your calendars, access is only ever used to add events to them.

For information on managing Calendar access:

International transfers

While our primary data processing occurs within the UK/EEA, some third-party services (including Google Analytics) may transfer data internationally. These transfers are protected by:

Adequacy decisions where applicable
Standard contractual clauses
Other appropriate safeguards as required by UK GDPR

Contact and complaints

If you have concerns about how we handle your personal data, please contact our support team at support@choochoo.co.uk. We will aim to resolve issues within one calendar month. If we're unable to resolve your concerns to your satisfaction, you have the right to make a complaint to the ICO (Information Commissioner's Office).

Changes to this policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or through our website. The "Last reviewed" date at the top of this policy indicates when it was last updated.

Clever Sausage Enteprises Limited is registered in England and Wales. Company number: 16314091. Registered address: Gothic House, Barker Gate, Nottingham, Notts, United Kingdom, NG1 1JU.

Main page