How SNCB/NMBS processes your personal data

We understand that your privacy is important to you and we do all we can to respect this. We would like to reassure you immediately! Your personal data will only be used by SNCB/NMBS, public limited company (Rue de France / Frankrijkstraat 56, 1060 Brussels, Belgium). We do not provide your personal data to third parties who wish to promote their own products and services. Below, you can read in detail how we will use your personal data.

When you decide to provide us with your personal data (for example, by completing an application form for a discount card), you confirm that you have read through these privacy conditions.

Which data do we use, for what, to whom may we provide it and how long will we keep the data?

Which data we use, what we will use the data for and how long we will keep the data is determined by the reason for processing the data. You can find more information below.

I would like to buy a ticket or travel pass for a domestic trip
I would like to buy a ticket for a trip abroad
I would like to buy rail season tickets or an individual ticket
I use a MOBIB card
I would like to take advantage of a specific discount or permit
I travel by train
I call or email the contact centre with a question or complaint
I have lost an object on the train or in the station and I would like to get it back
I have agreed to receive commercial offers about the products of SNCB/NMBS and surveys
I have opened a MySNCB/NMBS account
I have been given a fine
I am a supplier of SNCB/NMBS or a contact person of a professional client of SNCB/NMBS
I am the victim of an accident on the platform, in the station or on the train
I (regularly) visit the SNCB/NMBS website and app

I. 1. I would like to buy a ticket or travel pass for a domestic trip

Unless you have purchased your ticket or travel pass via a machine or at the ticket window, SNCB/NMBS collects and processes the following personal data

Last name, first name and address

In principle, we process at least your last name and first name, as well as an address where we can contact you or where we can send you the product you have requested (postal address or email address).

Age or date of birth

If it is necessary to be able to deliver you the right product, we will also ask you for your age or date of birth (for example, tickets for seniors or young people).

Data concerning the method of payment used

For electronic purchases (online, via a machine or at the ticket window with a bank card) we will also process data concerning this method of payment.

National registration number

If you choose to link your ticket to your electronic identity card, SNCB/NMBS will ask for your national registration number in order to make this link possible.

What do we use your data for?

If you conclude a contract with us by, for example, purchasing a train ticket or travel pass, we will process your data in order to be able to carry out this contract. We then use your data to be able to provide you with the ticket to make the train travel possible but also to be able to handle your questions, messages or requests and to be able to offer you the service you desire and provide after-sales service.

We also process your data in order to comply with the statutory obligations of SNCB/NMBS. This includes, of course, ensuring the safety in the trains and at the stations and also the transfer of your data to competent authorities in the context of threatening or pending legal procedures. These third parties act as "processors" when carrying out this and other processing of the personal data. For more information about this processing, we refer you to the applicable privacy policy of these third parties.

We also process your data in order to constantly improve our services, to carry out market studies, to prevent fraud and to develop new products. It is possible that your data is processed in the context of internal audit activities. These activities correlate to the legitimate interest of SNCB/NMBS. In this, we make sure to always give as much attention to your interests as we do to those of SNCB/NMBS.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task. At the moment, only our subsidiary company YPTO NV that manages our systems and data banks, has access to your personal data.

In addition, we are sometimes required to provide your data to the competent authorities.

In principle, we only provide your personal data to natural persons or entities that are located in a country that offers a level of protection for your personal data that is at least equal to what you have in Belgium. If we are to deviate from this, we will inform you of this and ask for your consent.

How long will we keep your data?

If we no longer need your data for other processing as stated in the privacy conditions, we will keep your data as collected according to online purchases for six months to be calculated from the date of purchase. We store national registration numbers for four weeks.

I. 2. I would like to buy a ticket for a trip abroad

Except in certain cases in which the international train operator allows anonymous travel, SNCB/NMBS collects and processes the following personal data

Last name, first name and address

Age or date of birth

If it is necessary to be able to deliver you the right product (for example, tickets for seniors or young people) or if the foreign rail company that operates your journey requires this for on-board ticket control, we will also ask you for your age or date of birth

Data concerning the method of payment used

For electronic purchases (online, via a machine or at the ticket window with a bank card) we will also process data concerning this method of payment.

What do we use your data for?

If you conclude a contract with us by, for example, purchasing a train ticket or rail season tickets, we will process your data in order to be able to carry out this contract. We then use your data to be able to provide you with the ticket to make the train travel possible but also to be able to handle your questions, messages or requests and to be able to offer you the service you desire and provide after-sales service.

To whom may we provide your data?

We provide your data to the various train operators that you use in your route so that they can offer you the desired service. They will inform you about what they will use your data for.

If the features of the purchased travel require it, for example, because you also purchased other services along with your train ticket offered by one of our partners, we will also share your personal data with that partner (for example, the requested hotel, car transport or the travel agent you used).

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

In addition, we are sometimes required to provide your data to the competent authorities.

How long will we keep your data?

If we no longer need your data for other processing stated in these privacy conditions, we will keep the data for twelve months, calculated from the date of purchase.

I. 3. I would like to buy a rail season ticket

Because rail season tickets are always by name, SNCB/NMBS collects and processes the following personal data:

Last name, first name and address

Date of birth

To ensure that we sell you the correct rail season tickets and can distinguish you from other clients with the same name, we may also ask for your date of birth.

Data concerning the method of payment used

For electronic purchases (online, via a machine or at the ticket window with a bank card) we will also process data concerning this method of payment.

Personnel number

When the rail season tickets are entirely or partially refunded by your employer, we will also process your personnel number.

What do we use your data for?

If you conclude a contract with us by, for example, purchasing a rail season ticket, we will process your data in order to be able to carry out this contract. We then use your data to be able to provide you with the ticket to make the train travel possible but also to be able to handle your questions, messages or requests and to be able to offer you the service you desire and provide after-sales service.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

In addition, we are sometimes required to provide your data to the competent authorities.

How long will we keep your data?

If we do not need to have your personal data for a processing that requires a longer storage period, we will store your personal data for eight years to be calculated from the end of the of the rail season tickets. This enables us to meet our tax obligations.

I. 4. I use a MOBIB card

If you request a MOBIB card or use one as a train/rail company for tickets of SNCB/NMBS, SNCB/NMBS collects and processes the following personal data:

Last name, first name and address

Date of birth

In order to distinguish you from other clients with the same name, we may also ask for your date of birth.

Data concerning the method of payment used

For electronic purchases (online, via a machine or at the ticket window with a bank card) we will also process data concerning this method of payment.

National registration number

In order to make a MOBIB card for you, SNCB/NMBS will ask for your national registration number. This way, SNCB/NMBS can print your photo on the card and SNCB/NMBS can verify the submitted identity.

MOBIB card number

If you upload SNCB/NMBS tickets onto your MOBIB card, we will process the MOBIB card number. This is also the case when our train conductors check your ticket as based on your MOBIB card.

What do we use your data for?

When you request a MOBIB card from SNCB/NMBS, we will process your data in order to be able to carry out this contract. We then use your data to be able to provide you with the ticket, so that you can upload tickets on this card later, to make the train travel possible as based on tickets booked onto the card and also to be able to handle your questions, messages or requests and to be able to offer you the service you desire and provide after-sales service.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

Because the MOBIB card can be used as a ticket that is valid on the network of several Belgian public transport operators, personal data is exchanged between the operators concerned. This concerns personal data of the MOBIB card holder and information about the MOBIB card and the uploaded ticket. Thanks to this exchange, the operator concerned can manage the tickets, and carry out the after-sales, fraud management, technical management and client management. The statutory obligations concerning the protection of privacy are complied with during this exchange. During the exchange, the operators concerned act as processors of this data in their system, in accordance with their privacy policy. For additional information, we refer you to the current privacy policy available on the respective websites of these public transport operators.

In addition, we are sometimes required to provide your data to the competent authorities.

How long will we keep your data?

If we need your personal data for a processing that requires a longer storage period, we will store the personal data stated above for the duration of validity of the MOBIB card plus one year.

I. 5. I would like to take advantage of a specific discount or permit

Which data do we process?

Because discount cards and specific travel permits (e.g. free carer, Priority Seating Card) are by name and their allocation is subject to a series of conditions, SNCB/NMBS processes the following data:

Last name, first name and address

In principle, we process at least your last name and first name, as well as an address where we can contact you or where we can send you the authorization to use the discount or permit you have requested (postal address or email address).

Date of birth

To ensure that we sell you the correct discount and can distinguish you from other clients with the same name, we may also ask for your date of birth.

Specific personal characteristics

Discount cards and specific travel permits are linked to specific characteristics of the traveller. Depending on the type of discount card, we may ask for info concerning your profession (for example, member of the military or journalist), and your medical status (for example, physical disability or pregnancy).

Without this information, SNCB/NMBS cannot check whether you are eligible for the discount or permit.

In certain cases, we will ask for evidence of the characteristic that is linked to the discount or permit. If we request medical certificates we will always ask your consent before we process these.

What do we use your data for?

We process your personal data to evaluate if you are eligible for the requested discount or permit. Without this data, this would be impossible for us and the discount or permit cannot be granted.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

In addition, we are sometimes required to provide your data to the competent authorities.

How long will we keep your data?

If we do not need to have your personal data for a processing that requires a longer storage period, we will keep the personal data stated above for the duration of the transport contract to which a discount or permit is linked, extended with a period of thirteen months.

I. 6. I travel by train

In order to check the validity of your ticket during train travel, we process the following personal data:

Personal data stated on your rail season tickets
MOBIB card number
Personal data stated on the discount card you use
Personal data stated on your identity card

Our train conductors have the right to verify your identity as based on your valid identity document. At that moment, we will check the information on the identity card against the information found on your ticket. Here, we pay particular attention to the photo, your last name and first name, and address. If you travel with children who benefit from a discount based on their age, our train conductors have the right to check the childrens’ age by means of a valid identity document or any other official document that may attest to their age.

What do we use your data for?

We process your personal data in order to determine whether you are travelling with a valid ticket.

To whom may we provide your data?

For this purpose (checking your ticket), your data is not provided to third parties.

How long will we keep your data?

If we do not need to have your personal data for a processing that requires a longer storage period, the data acquired during the ticket check is deleted daily, unless an irregularity is established.

I. 7. I call or email the contact centre with a question or complaint

In order to handle your questions or feedback, we collect and process the following personal data

Last name and first name

In principle, we process your last name and first name at the very least.

Telephone number or address

So that we can respond to your question or notification, we also collect the address where we can contact you (postal address of email address) or your telephone number.

Data concerning the method of payment used

If you request compensation or reimbursement, we will also ask for information about the method of payment you would like to use for this.

Other information

If the specific characteristics of your question or feedback require us to have additional personal data or you voluntarily supply us with it, we will use this data.

What do we use your data for?

We use your data to handle your question or feedback and, if applicable, to make the requested repayment. Without this data we cannot evaluate your question or feedback.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

In addition, we are sometimes required to provide your data to the competent authorities.

If you have a question or feedback concerning international train travel in which other train operators are also involved, we will provide the latter with the personal data that the other train operator needs to be able to handle your question or feedback.

How long will we keep your data?

If we do not need to have your personal data for a processing that requires a longer storage period, we will store the personal data stated above for up to two years after the full settlement of your question or feedback.

I. 8. I have lost an object on the train or in the station and I would like to get it back

If one of our employees on the train finds a lost object with personal data on it which enables us to identify the owner of the lost object, SNCB/NMBS shall process this data. In addition, SNCB/NMBS shall also process your personal data when you contact us requesting to receive information about a lost object or if you wish to pick this object up at SNCB/NMBS. SNCB/NMBS collects and processes the following personal data for this:

Last name, first name and address

Date of birth

To be able to distinguish you from persons with the same last name and first name, we also process your date of birth.

Telephone number or email address

If we find this information on the lost object or if you submit this information to us along with your request, we may use it to inform you that we have found the lost object on the train.

Information concerning your bank account (IBAN number and BIC Code)

If the lost object concerns money, if we found it, and you wish to be reimbursed, we will process the details of your bank account so that we are able to carry out the payment.

Other information

If the lost object shows specific characteristics or if you deliberately mentioned specific characteristics of the object in order to facilitate our search for this object, we will use this data.

What do we use your data for?

We use your information to handle your question, message or request and, if possible, to return the lost object to you. Without this information, we cannot fully process your request.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

If you have lost an object during an international train trip in which other train operators are also involved, we shall provide the latter with the personal data they need in order to search for your lost object and, if possible, get it to you.

How long will we keep your data?

If we do not need your personal data for a processing that requires a longer storage period, the data stated above will be stored for fifty days starting from the day on which we found the object or from the day on which you provided us with this data.

I. 9. I have agreed to receive commercial offers and surveys about the products of SNCB/NMBS

When you have indicated that you would like to receive commercial offers from us, we will use your personal data to provide you with our newsletters and advertising campaigns. SNCB/NMBS collects and processes the following personal data for all of these:

Last name and first name

In principle, we process your last name and first name at the very least.

Telephone number or (email) address

We process this information in order to be able to deliver commercial offers and surveys which you have agreed to receive.

In order to make offers to you that are relevant to you, we also use your age information.

Gender

We process your gender information to be able to address you correctly.

Order history

Based on the purchases you have made in the past or the item you have loaded into your shopping cart when purchasing tickets online, we may make personalised commercial offers to you. For this reason, we also store this data.

What do we use your data for?

Your personal data is used to provide you with commercial offers for our products and services.

We also use your data to adapt the content of our advertising campaigns and, in the future, even to adapt the content of our website according to your preferences and characteristics. We apply profiling to achieve this: based on the information that we have about you, we assign you to one of the marketing segments we use. This profiling has no other legal consequences or impact on you: only the advertising that you are shown or shall receive will be adapted to fit the segment you belong to.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

How long will we keep your data?

If we do not need your personal data for a processing that requires a longer storage period, the data stated above will be stored by us until you let us know that you no longer want us to use your data for direct marketing.

I. 10. I have opened a MySNCB/NMBS or MyTrain account

To create a MySNCB/NMBS account, we need the following information:

Last name, first name and address

Email address

This is used to identify you and to distinguish you from other users.

Date of birth

This is used to identify you and to distinguish you from other users.

Gender

We process your gender information to be able to address you correctly.

To create a MyTrain account (for booking and managing international rail journeys), we need the following information:

Last name and first name

Email address

This is used to identify you and to distinguish you from other users.

Date of birth

This is used to identify you and to distinguish you from other users.

Country
This is used to adapt our international services to your location.
Gender

We process your gender information to be able to address you correctly.

What do we use your data for?

We use your information to create a MySNCB/NMBS or MyTrain account and to ensure that this account is unique.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

In addition, we are sometimes required to provide your data to the competent authorities.

How long will we keep your data?

If we do not need your personal data for a processing that requires a longer storage period, the data stated above will be stored by us until you delete your MySNCB/NMBS account.

I. 11. I have been given a fine

If you have violated one of our transport conditions, we process the following information:

Last name, first name and address

If you are a minor, we will also process the identity information of your parent(s) or guardian.

Your identity document and the information on your identity document

This includes your nationality, the national registration number, your date of birth and your gender

Camera images or photos

If there are camera images of your violation, we will also process these as evidence of your violation.

Precedents

If the storage period for this information has not expired, we will also process your personal data concerning a prior violation.

Your telephone number or email address

In order to contact you to follow up on the (payment of the) sanction for the violation, we will use your telephone number or email address.

What do we use your data for?

We use your information to establish the violation and to further process this, including the fulfilment of the payment of the sanction related to the violation, including all correspondence we must carry out in this respect.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

In addition, we are sometimes required to provide your data to the competent authorities.

How long will we keep your data?

If we do not need your personal data for a processing that requires a longer storage period, for example, to enable us to receive full payment of the outstanding sums to be received or because we need to complete the processing of a legal dispute that has arisen as a result of the violation, the information stated above will generally be stored for five years and 10 years if the violation concerns travelling without a valid ticket, to be calculated from the date of the incident.

I. 12. I am a supplier or professional client of SNCB/NMBS or a contact person of a supplier or professional client of SNCB/NMBS.

When you, as a physical person, are a supplier or professional client of ours, or you act as contact person for a supplier or professional client of ours, we collect and process the following information:

Last name, first name and address

In principle, we process your last name and first name at the very least.

Telephone number or email address

We process this information in order to be able to contact you.

Gender

We process your gender information to be able to address you correctly.

Results of, and personal data included in a credit worthiness evaluation

To accept you as a supplier, we are sometimes required to carry out a credit worthiness evaluation.

What do we use your data for?

We use your information in order to be able to carry out the contract we have with you or the supplier or professional client for whom you act and to keep you or the latter informed on important information, including commercial information that is necessary for carrying out the contract.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

In addition, we are sometimes required to provide your data to the competent authorities.

How long will we keep your data?

If we do not need to have your personal data for a processing that requires a longer storage period, we will keep your personal data throughout the duration of the contract with you, as a professional client or supplier or with the supplier or professional client for whom you act as contact person plus one year.

I. 13. I am the victim of an accident on the platform, in the station or on the train

If you were the victim of an accident on a location owned or managed by SNCB/NMBS, we process the following information:

Last name, first name and address

If you are a minor, we will also process the identity information of your parent(s) or guardian.

Your identity document and the information on your identity document

This includes your nationality, the national registration number, your date of birth and your gender

Camera images or photos

If there are camera images of your accident, these will also be processed as evidence of the accident.

Your telephone number or email address

In order to contact you to follow up on the (payment of the) sanction for the violation, we will use your telephone number or email address.

The specific characteristics of your accident and the damage

In order to be able to follow up on your damage, for example, with our insurer, we will also process the specific characteristics of your accident or damage you have suffered, including the physical damage. If we process your medical information, we will ask for your explicit consent to do so unless high urgency, e.g. providing first aid, should prevent us from doing so in order to guarantee your vital interests.

What do we use your data for?

We use your information to make a detailed assessment of the accident and to make following up possible and to reimburse you if you are entitled to reimbursement for damage suffered, possibly with the intervention of our insurer.

To whom may we provide your data?

We may provide your personal data to other natural persons or entities that act as subcontractors for SNCB/NMBS. In this case, they only have access to the data they need for their task.

We shall also provide your data to our insurer.

In addition, we are sometimes required to provide your data to the competent authorities.

How long will we keep your data?

We will keep your information until the file has been completely settled plus one year. If the handling of your file cannot be completed on short notice, we will keep your information for a period of thirty years and six months if you have suffered damage to your property and 20 years and six months if you have suffered physical damage. With damage to objects combined with physical damage, a longer storage period applies.

I. 14. I (regularly) visit the SNCB/NMBS website or regularly use the SNCB/NMBS app

When you visit our websites and use our apps, you provide certain personal data to SNCB/NMBS, even by only opening these websites.

A) Area of application

Read this section of our Privacy Statement to learn more about how we collect and process your personal data on our websites (particularly www.sncb.be, www.nmbs.be, www.belgianrail.be, www.sncb-interntional.com, www.nmbs-internationaal.com, www.b-europe.com and hereinafter referred to as the "Website") and, as the case may be, by downloading the apps (mobile applications under the name ‘SNCB/NMBS’ on smartphones and tablets via app stores, hereinafter referred to as the ‘Apps’).

By purchasing tickets for domestic and/or cross-border trips by train and related products, by reserving services via the Website and the Apps, by using the Website and/or Apps and by sharing personal data, you confirm that you have read through the stated conditions below under which SNCB/NMBS collects, processes and shares personal data.

B) Collection, processing and purposes of personal data on the Website and the Apps

With each visit to the Website or use of the Apps, various kinds of personal data is shared and log files about you are collected, particularly your IP address, the website from which you were linked to the Website, the date and duration of your visit, your browser, your operating system, your surfing behaviour and especially the pages you visit.

We only use this information for statistical purposes and to analyse and optimise the use and functioning of the Website and the Apps. For this, we utilise the services of third parties with whom we share this information for this purpose.

When your visit is not limited to a general request for information and, more specifically, when you purchase a ticket or related product via the Website and/or Apps

when you purchase a ticket or related product,
when you pay a fixed online indemnity concerning an irregularity,
reserve a service or assistance,
contact SNCB/NMBS,
register for a MySNCB/NMBS account,
participate in a competition,
agree to receive our newsletter and/or other information about our products and services,
with your consent to activate certain services upon downloading the Apps, such as localisation, use of contacts and/or calendar [DRM1] ,

other information will also be requested and/or collected, including, as the case may be, your gender, name, email address, your current job, password, order history (if applicable), telephone number, address information and language preference.

We use such information

to supply a ticket, a related product or service and, if necessary, to further inform you about it, to deliver the purchased products or services to you and to follow-up, and to guarantee you a quality after-sale service;
to be able to handle and, if necessary, answer your question or respond to your communication or request;
to enable you to pay fixed indemnities in relation to an irregularity;
to enable you to benefit fully from all the advantages of having your MySNCB/NMBS account, including My Train Info rail season tickets (sms text message upon delay of one of your preferred trains if you possess a valid train ticket), simplifying certain actions (online assistance for persons with limited mobility, the purchase of validations for your train ticket or MOBIB card, etc., the payment of a fixed indemnity for an irregularity), access to your order history and your data in order to manage it, as well as for personalised marketing purposes;
to allow you to participate in a competition and to keep you informed on the outcome and results of the competition;
to send you newsletters;
to improve the services we offer you, and adapt these to fit your needs, more specifically tailored to you, as based on the created client profiles, and offer adapted services that may interest you;
to keep you informed, allow you to participate in market studies and to carry out satisfaction surveys about our products and services;
to allow you to benefit from the additional services on the Apps, such as mapping out the nearest station, saving a travel route in your calendar or informing others of your travel route [DRM2] ;

and this may be passed onto third parties or subcontractors for this purpose.

C) Specific processing upon purchase of tickets

To prevent possible fraud with the purchase of tickets, SNCB/NMBS verifies the information you share with each transaction. SNCB/NMBS shall process that information and, based on that processing, will decide whether to refuse or suspend the purchase of tickets. SNCB/NMBS is not required to inform you in advance if it decides to refuse or suspend your purchase. SNCB/NMBS may decide to refuse or suspend whenever it suspects that a contractual obligation is not complied with and/or fraud or deceit is involved. This suspicion may, for example, be based on doubts about the identity of the client or traveller, the fact that the quantity of the products ordered is unusual or when there have been problems in the past with the payments made by the client or traveller concerned.

Within the context of online ticket orders, SNCB/NMBS uses the “Fraud Expert” tool, linked to a remote processing by a subcontractor of SNCB/NMBS. For this, your personal data shall be provided to and processed by Ingenico e-Commerce Solutions SPRL (hereinafter: “Ingenico”). Ingenico processes your data to prevent and combat fraud (which includes, among others: determining a level of risk associated with the transaction, detection and management of certain warnings arising from this, informing the sales point so they it can decide as based on this information, manually verifying transactions that have a certain risk level, compiling a model as based on scores). Your personal data is provided to the relevant departments of Ingenico, to SNCB/NMBS and to third parties who act as subcontractors for Ingenico or SNCB/NMBS to make the payment process and the offered services possible.

Fraud can lead to our personal data being registered in a specific file that Ingenico maintains concerning fraud. The aim of this file is, namely, to store the data concerning fraud in the past to estimate the risk criteria of transactions and to determine the scoring model that is linked to it. When your data is included in that file, it could mean that you will be considered as a higher fraud risk and your order may be refused when you place your next order with SNCB/NMBS or with another seller that is active in the same sector as SNCB/NMBS and also uses the services of Ingenico.

In accordance with the statutory privacy requirements, you have the right to access, inspect and improve the data that Ingenico keeps about you in the framework of the “Fraud Expert” tool, while taking into account the statutory restrictions, the right to oppose the processing of data that is irrelevant or excessive. You can exercise these rights by submitting a written request to: Ingenico e-Commerce Solutions BVBA- Legal Service “protection of privacy”, Woluwelaan 102, B-1200 Brussels (Belgium) or by sending an electronic request via email to: privacy@ecom.ingenico.com. In order to be valid, this request must always be accompanied by a signed copy of a valid identity document.

D) Cookies

The Website uses so-called "cookies", small information files that are temporarily or permanently stored by the server of a website via the browser on your computer or device and that simplify, complete and personalise the use of the website.

In your browser, you can turn off the storage of cookies or delete stored cookies, but this may lead to diminished functionality, delays or the disablement of certain parts of the Website.

For more information about cookies and how you can delete them depending on the type of browser you use, we would like to refer you to the following website: www.allaboutcookies.org.

We use the following cookies:

(i) Strictly necessary cookies

These are cookies that enable you to view the Website, use the functions on the Website (such as your shopping cart with orders) and to gain access to the secured or registered sections. If the use of these cookies is turned off, you will no longer be able to use certain sections of the Website properly.

(ii) Functionality cookies

These are cookies that enable us to keep track of your choices and preferences (such as language choice and such), to enhance the ease of use of the Website and show you relevant information.

(iii) Performance-enhancing cookies

These are cookies whose aim is to collect information about how you use the Website, such as information concerning the pages visited or the number of displayed error messages, for the purpose of analysing and optimising the use of the Website.

Performance-enhancing cookies are also known as analytical cookies. It is possible that the information that is acquired from the use of these cookies is collected by a third party. These third parties act as subcontractors for SNCB/NMBS to provide information to SNCB/NMBS to improve the Website and its services. Below, please find more information about these third parties and how they use the information that is collected via the cookies.

Google Analytics

The Website uses Google Analytics. This web analysis service is offered by Google Inc. (“Google”), and uses analytical cookies. The information that is collected via the cookies about the use of the website by a visitor, together with the visitor's IP address, is sent to Google and stored by Google.

Google may use this information for the following:

Supply reports concerning the advertisement activity to advertisers and websites that host those advertisements and ensure that those website publishers are paid
It helps website and app owners who use Google Analytics to understand how visitors interact with their sites or apps
Detect and combat fraud and other security risks to protect users and partners
Comply with statutory obligations
Improve its products.

For all these activities with the exception of point 2) Google acts as the processor, and the processing of the information that they collect about the use of the Website is Google's own responsibility.

How can you manage which information is sent to Google?

Here are a number of ways you can manage which information is shared by your browser when you visit the Website:

If you do not want Google Analytics to be used in your browser, you can install the browser add-on for Google Analytics. More information about Google Analytics and privacy.

If you are logged on to your Google account, you can - depending on your account settings - view and edit certain information that Google collects from the sites you have visited and apps you have used.
With the incognito mode in Chrome, you can surf the Internet without the web pages and files being stored in your browser history. Cookies are deleted after you have closed all incognito windows and tabs. Your bookmarks and settings are stored until you delete them.
With Advertisement settings you can manage which Google advertisements you will be shown on the Internet. You can find out how advertisements are selected for you, you can sign out from Personalisation of advertisements and block specific advertisers. More information about advertisements.

Firebase Analytics

In the Apps, SNCB/NMBS uses Firebase Analytics, an analytical tool developed by Google. This tools collects statistical information about how users use the app, for example, which functions they use, which information they submit.

The tool works on the basis of the advertisement ID that is linked to the Android or iOS operating system on your smartphone or tablet. This ID is not linked to the telephone number of the smartphone nor the physical user of it. In other words, based on that advertisement ID, it is impossible for SNCB/NMBS to identify you.

In the first phase, the collected information shall only be used to improve the app.

Would you prefer that Firebase not to keep track of how you use the App?

Then you must do the following:

In the settings of an iPhone, you go to ‘Privacy’ and then to ‘Advertisement’ (at the bottom). Click on 'Reset Advertisement ID' and slide the 'Limit advertisement tracking' to 'On'.

For an android phone, you go to 'Settings', then 'Google' and 'Advertisements'. Press 'Reset Advertisement ID'. You then make sure that 'Sign off for personalisation of advertisements' is selected.

Social networks

SNCB/NMBS can store IT applications of third parties on the Website or the Apps that give you the option of sharing the content of the Website with others, let them know that you have consulted the website or to share your opinion on certain content of the Website or Apps with others. This is particularly the case with such buttons as 'Share' and 'Like' of social network sites such as 'Facebook', 'Twitter', 'LinkedIn' etc. Social networks that offer such app buttons may place cookies and identify you based on this button. A social network can possibly also place cookies when you visit the SNCB/NMBS page on the social network. SNCB/NMBS invites you to consult the privacy policy of these social networks to get acquainted with the purposes (including advertising purposes) for which the browse information collected by them in this context may be used.

(iv) Advertising cookies

These are cookies we use to offer you personalised and relevant advertisements, to determine how many times a certain advertisement is displayed, to calculate the effectiveness of a certain advertising campaign, to keep track of past visits and to share the collected information with the third parties involved, such as the advertisers. These are used on the Website and placed on your device by third parties such as the companies that are linked to SNCB/NMBS and the advertisers that are part of the publicity network of the Website.

SNCB/NMBS uses the following publicity cookies:

The Website uses Google Remarketing. This tool places cookies on your device in order to show you personalised advertisements. These advertisements take your earlier visits to the Website into account. In point (iii) above, under Google Analytics, you will find more information about what Google does with the collected information. Additional information can be found via the following link.

The Google Remarketing tool uses Google's Display Advertising network.

You can always turn off these cookies in the settings of your browser, via the following Google link or the link offered by www.youronlinechoice.com.

The Website also uses Facebook Pixel. This is an image not visible to you that is included on the pages of our website and is stored on the servers of Facebook. Every time you open a page on our site where the Facebook pixel is included, this pixel is downloaded onto your device from that Facebook server. In this, the following information is provided to Facebook: your IP address and the specific characteristics of your device (for example: type, operating system, specific software and hardware).

While we cannot link this information to you personally, Facebook can if you also have a profile on Facebook. In this, Facebook acts as processor for the processing. SNCB/NMBS invites you to consult the privacy policy of Facebook to get acquainted with the purposes (including advertising purposes) for which the browse information collected by them in this context can be used.

From Facebook we only receive statistical information and therefore not your personal data.

If you wish not to receive certain advertisements, you can adapt your advertisement preferences in your personalised Facebook page. Via the settings of your mobile device you can also indicate that the machine information is not to be shared with third parties.

Lastly, the Website uses Criteo retargeting cookies that are used to display Criteo personalised advertisements via the advertisers network (based on your earlier visits to the website), regardless of which device you use for your internet connection (computer, tablet or smartphone). By bundling your searches and purchases on various websites, the Criteo retargeting cookies can recognise and identify the same user - even though this person remains anonymous - and this regardless of the browser used. Just like with all other cookies, you can sign out for the Criteo cookies according to the instructions on http://www.criteo.com/deactivate-criteo-banners/. In this case, signing out applies to all devices that you use with an Internet connection.

On which grounds do we process your information?

In most cases, we will process your information so that we can carry out the contract that exists between SNCB/NMBS and you. This is the case, among others, when you book or purchase a train trip and ask for a discount and when you wish to use the after-sales service.

In addition, in certain circumstances, we are legally required to process your personal data. We are required to ensure the safety at the stations, on the trains and on the platforms. For that reason, we may also film you with cameras that can be found in those places and we can also check your identity, establish violations and follow-up on these.

We can also group an amount of processing in the legitimate economic interest of SNCB/NMBS. Examples of this include the combating of fraud, carrying our market research, improving our services and the development of new products. In doing so, we always assess whether your interest in protecting your privacy and your rights concerning your personal data outweigh the interest of SNCB/NMBS. If this is effectively the case, SNCB/NMBS cannot begin this processing and must adapt it so that it is in balance with your interests.

Lastly, we will base some of the processing on your consent. This is, for example, the case with electronic direct marketing and with processing specific categories of personal data, such as medical information. This consent shall, in most cases, be made clear by a positive action that you make (for example, supplying us with your personal data). In specific cases, such as with the processing of medical information, we will ask for your explicit consent.

You can always revoke your consent. The processing that we have done until this consent is revoked does remain valid and justified.

How long will we keep your data?

Whenever the law imposes a minimum storage period, we are always required to store your information at least for this period. Aside from this minimum storage period and when the law does not establish a storage period, we have made a consideration in determining the storage period that weighs your interests and those of SNCB/NMBS whereby the interests of SNCB/NMBS may never outweigh yours, and of the rate at which the data ages and the reasons for processing your data.

If we process your data for various reasons, the longest storage period will always apply. The possibility of the relevant services of SNCB/NMBS using your personal data will, however, be determined by the specific storage period that applies to that service: if the storage period for that service has expired, we will no longer be able to use the data.

After the storage period has expired, your data will be removed from our data banks or be anonymised so that we can no longer link it to you.

More information about the exact storage period of your data can be found above in the information for specific processing.

What can we help you with insofar as your personal data is concerned?

You can oppose the use of your personal data for direct marketing.
We can provide you with an overview of your personal data that we process.
You can ask us to adapt or augment the personal data.
You can ask us to delete certain personal data.
You can ask us to provide you with your personal data in an electronically legible format so that this can be passed on to another train operator.
You can revoke the consent you provided for the processing of your personal data.
You can ask to limit the processing of your personal data to certain purposes.

You can oppose the use of your personal data for direct marketing.

You can, at any moment, oppose the processing of your personal data for direct marketing purposes. This applies both to the regular processing as for the profiling that is used for this direct marketing.

We can provide you with an overview of your personal data that we process.

You have the right to view your personal data that we process. This overview can help you assess whether you also wish to make use of other rights (for example, your right to change the data).

You can ask us to adapt or augment your personal data.

If you notice that the personal data that we have about you is incorrect or incomplete, you can ask us to adapt it or augment it, respectively. The latter can be useful, for example, when consequences are linked to this personal data, for example, with the assessment of whether you are eligible for a discount.

You can ask us to delete certain parts of your personal data.

Based on the privacy rules, you have the right to ask us to delete certain data. This is only possible when this data is no longer needed to achieve a certain objective. We cannot, for example, delete your personal data as long as you wish to make use of your rail season tickets or if we must still receive payment for outstanding amounts (for example, after a violation).

You can ask us to provide you with your personal data in an electronically legible format so that this can be passed on to another train operator.

Based on the privacy rules, you have the right to the transferability of your data. You can then ask us to receive all of the personal data you have provided us with in a legible electronic format.

You can revoke the consent you provided for the processing of your personal data.

When the processing is based on our consent, you can revoke this consent at any time. An example of this is the processing of medical certificates to assess whether you are eligible for certain discounts. Depending on the time that you revoke your consent, this may mean that we will no longer be able to provide you with certain items. It may then be possible that you will no longer be able to benefit from a discount that is based on the processing of personal data.

You can ask to limit the processing of your personal data to certain purposes.

The privacy rules give you the right to ask us to limit the processing of your data to certain purposes. It will not, however, always be possible for us to meet this request, for example, when we are legally required to process your personal data or to be able to follow up on violations.

How can I do this?

You can oppose the use of your data for direct marketing by clicking on the "sign out" button that you will find in all of the direct marketing documents.

In addition, you can also send a written request with proof of your identity to SNCB/NMBS Customer Service, Hallepoortlaan 40, 1060 Brussels, Belgium or send an email to privacy@b-rail.be.

If you have a My SNCB/NMBS account, you have the option of managing and adapting your own profile information and of choosing to no longer receive any emails or sms text messages from SNCB/NMBS.

How do we protect your data?

We have appointed a Data Protection Officer who advises us about the privacy rules and checks whether SNCB/NMBS complies with the privacy rules.

In addition, we also ensure that only the persons who are effectively required to process your personal data for their professional activities within SNCB/NMBS have access to your data.

For all important existing processes and all new processing operations, we carry out a Data Protection Impact Assessment in which we examine, together with the Data Protection Officer, whether the privacy rules are being complied with and your personal data is always sufficiently protected. When these assessments yield points of improvement for us, these are strictly followed and a solution must be found before the processing can start again.

We are committed to taking all the appropriate technical and organisational measures to protect your personal data against destruction, loss, unintended alteration, damage or disclosure. To guarantee this protection, we periodically make back-ups, among others.

Contact information

National Railway Company of Belgium (SNCB/NMBS), limited liability company under public law, Frankrijkstraat 56, 1060 Brussels, Belgium (RPR Brussels: BE 0203.430.576).

SNCB/NMBS is responsible for the processing of this personal data and ensures the confidentiality and security of this data.

You can contact us at the following address: SNCB/NMBS Customer Service, Hallepoortlaan 40, 1060 Brussels, Belgium or send an email to privacy@b-rail.be.

The Data Protection Office service and the Data Protection Officer of SNCB/NMBS can be contacted via the SNCB/NMBS Data Protection Office, Hallepoortlaan 40, 1060 Brussels, Belgium or via email dataprotectionoffice@b-rail.be.

If you are not satisfied about the way SNCB/NMBS processes your personal data and about the response you received from our customer service and the Data Protection Officer to your complaint, you can submit a complaint to the Data Protection Authority. On the date of this publication, no details were known yet about where and how you can submit a complaint to this authority. While we await this information, we refer you to the website of the Privacy Commission: www.privacycommission.be.

SNCB/NMBS reserves the right to always be able to change this Privacy Policy.

Policy concerning privacy on SNCB websites and apps

How SNCB/NMBS processes your personal data

Which data do we use, for what, to whom may we provide it and how long will we keep the data?

A) Area of application

B) Collection, processing and purposes of personal data on the Website and the Apps

C) Specific processing upon purchase of tickets

D) Cookies

How can you manage which information is sent to Google?

On which grounds do we process your information?

How long will we keep your data?

What can we help you with insofar as your personal data is concerned?

How do we protect your data?

Contact information

Cookie Policy