At Thalys we respect your privacy. We are committed to protecting and processing your personal data in strict compliance with the data protection legislation, and in full transparency.
1. Who is "responsible for processing"? Who is the "DPO" and preferred contact person? Who is concerned?
"THI Factory" and "Thalys International" (hereinafter "Thalys") are responsible for processing your personal data available to them. This means that we, Thalys, determine the purposes and means of processing of this data and that we are your interlocutor and that of the supervisory authorities (the Belgian Data Protection Authority and the other European supervisory authorities) for any questions relating to its use.
We designated a Data Protection Officer or "DPO") as a single point of contact within our company with the following details:
Data Protection Officer
On the other hand, legal persons do not fall under the scope of this notice.
2. What data do we collect?
Your personal data (hereinafter "your data") is data that allows your identification either directly (data such as your name and surname allows your immediate identification), or indirectly (data such as your postal code, your phone number or your contract number allows your identification indirectly).
During our interactions with you, we may have to collect different data depending on the types of products / services concerned:
- Identification data (surname, first name, address, e-mail address, etc.)
- Demographic data (such as gender, language, age)
- Professional data
- Lifestyle and consumption of goods and services
- Hobbies and interests
- Household composition
- The purchases you made in exchange for your miles
- Your comments and suggestions on Thalys products or services
- Recording of images and sounds
- Online ID and password
- Business profile (preferred products and services, preferred modes of communication, etc.)
- Geolocation data, including your IP address or physical location only when you request geolocation-based services
- Information relating to navigation and behaviour on our website (depending on the pages viewed, the products viewed, searches performed, etc.)
3. For what purposes and on what legal basis is your data processed?
We process your data for various purposes. For each type of processing, only the data relevant to achieving the purpose in question is processed. The processing consists of any operation (manual or automated) on any personal data.
In general, we use your data:
- when we have your consent.
In this case, we process your data only for the purposes to which you have agreed, specified on the consent form on our website.
In particular, when concluding contracts with Thalys, you can explicitly consent via an opt-in to receiving communications from Thalys and/or Thalys partners (without transferring data to these partners). If you accept it, Thalys will electronically send you newsletters containing commercial information about new services and products, promotions and benefits, the opportunity to participate in quizzes. etc.
If you do not wish to receive our Newsletters, you can withdraw your consent at any time via the link integrated directly into the Newsletter. You can find more information about this under the point Withdrawing your consent
- As part of the execution of your contract or for the actions taken in order to conclude the contract, to:
- Collect your comments and suggestions on Thalys products or services
- Allow you to participate in online surveys to help Thalys improve its offers
- Allow you to participate in quizzes and games
- Allow you to participate in events organised by Thalys
We need to collect some of your data to execute your contract. If you choose not to share this data with us, it may render the performance of the contract impossible.
- to comply with all legal and regulatory obligations to which we are subject, including:
- prevention and detection of terrorist offences and other serious forms of crime;
- implementation of legislation (such as the GDPR);
- tax and accounting obligations of Thalys.
- for reasons that are in our legitimate interest, in which case we seek to preserve a proportionate balance between our legitimate interest and respect for your privacy. In this context, your data can be processed in order to:
- Protect Thalys property
- Prevent abuse and fraud
- Disclose any abuse that may or may seriously prejudice the financial status, results and/or reputation of Thalys
- Control the regularity of our operations
- Exercise, defend and preserve our rights, for example during litigation, as well as to compile the proof of a possible violation of our rights
- Manage and improve our relationship with you
- Continuously improve our website and our products/services (in particular by conducting satisfaction surveys and analysing data collected via cookies)
- Analyse data, establish sales and sales activity reports, frequency of visits and establish marketing profiles
4. How do we protect your data?
Thalys is committed to maintaining the confidentiality and security of your data and to implementing appropriate security measures to prevent the loss, destruction, misuse, unintentional modification or disclosure of your data:
- By updating security measures as the technology evolves, as needed
- By ensuring that your data are not accessible to unauthorised persons
- By requesting a proof of identity before being able to provide you with any personal information about you as part of the security procedures
- By performing periodic back-ups and storing this data on secure servers
- By deleting or anonymising your data at the end of the legal or contractual period or if Thalys does not need it any more for the for the purposes for which the personal data was collected.
5. Who is your data transferred to?
Thalys undertakes not to sell or rent your data to third parties.
To manage our company and help us provide you with certain products and services (for example: running our website, conducting satisfaction surveys, etc.), we use specialised partners who act as processors and are related contractually to us. They must then follow our instructions and respect the confidentiality of the data received on behalf of Thalys and may under no circumstances use them for any purpose other than the performance of services on behalf of Thalys.
Thalys ensures that these subcontractors:
- Only have data that are necessary for the performance of their tasks and,
- undertake, vis-à-vis Thalys, to treat this data in a secure and confidential manner and to use them only for the performance of their tasks.
In the context of Thalys INSIDE, we do not transfer your data outside the European Economic Area.
6. What are your rights and how can you exercise them?
In accordance with the law, you have a right of access, a right of rectification, a right of erasure and a right to portability of your data. In certain cases, you also have the right to object to or restrict its processing.
These rights are free and can be exercised at any time.
- Right of access: You have the right to access the data concerning you and to receive a copy.
- Right of rectification: We take all reasonable steps to ensure that the data we hold is up-to-date and to delete data that is incorrect or no longer required for processing.
We encourage you to access your account (if applicable) from time to time to view your data to ensure it is up to date. If you find that your data is inaccurate or incomplete, you have the right to ask us to correct it.
- Right to erasure ("right to be forgotten"): in certain circumstances (for example when you withdraw your consent or when the processed data is no longer necessary for the purpose of the processing), you have the right to ask us to delete your data.
- Right to restrict the processing: you may request the limitation of the processing of your data, in which case your data will no longer be processed (but will be retained).
- Right to data portability: you have the right to the data you have provided being transmitted to you in a structured format, or being transmitted directly by Thalys to another controller.
- Right of opposition:
- When the processing of your data is based on a legitimate interest, you have the right to object to it at any time. However, be aware that in this case, Thalys has the right to present you with its legitimate reasons justifying the continuation of processing.
- You always have the right to object, at any time and without charge, to the processing of your data in the context of direct marketing and no exception can be opposed by Thalys. It also includes the right to object to profiling as it relates to direct marketing.
B.Withdrawing your consent
When the processing by Thalys is based on your consent, you can withdraw it at any time. This withdrawal will not affect the legality of the processing of your data during the period preceding your withdrawal of consent.
In the context of direct marketing, this means that you can unsubscribe at any time from newsletters and other Thalys commercial communications. You will be put in "opt-out". You can unsubscribe by contacting Customer Service (firstname.lastname@example.org) or our DPO (email@example.com) or by clicking on the unsubscribe link at the bottom of each email. You can also unsubscribe via your Thalys account.
However, please note that when you exercise your right to object to the sending of direct marketing, this only applies to the given e-mail address. If you receive commercial mailings on several e-mail addresses, the unsubscription procedure must be repeated as many times as necessary, either via "my Thalys account" (if applicable) or via the "unsubscribe" link in each e-mail. If you unsubscribe by post, you will need to specify the e-mail addresses you want to disable.
C.Who can you contact?
When you send us an application relating to your rights, please provide us with your full contact details (name, surname, e-mail(s), full postal address) and please attach copy of the front and back of your card to prevent abuse and to ensure the security of your data.
7. Where can you make a complaint about the processing of your data by Thalys?
If you believe that there is a violation of the privacy legislation, you have the right to lodge a complaint about the processing of your data with the Data Protection Authority, whose contact details are as follows:
Autorité de Protection des Données
Rue de la Presse 35
Tel: +32 2 274 48 00
8. How long do we keep your data?
When your data is collected based on your consent, we use it only until you withdraw your consent. From the withdrawal of your consent, your data will be kept for the minimum amount of time necessary to accomplish the necessary technical measures to delete or anonymise your data.
When your data is used to provide you with our services (e.g. management of your trip, responding to your questions and requests, etc.), this data is kept for a reasonable period limited to the accomplishment of the objective pursued during its collection, including for the minimum amount of time necessary to perform the technical measures necessary to delete or anonymise your data.
In any case, your data is kept for the statutory limitation period or any other period of retention that would be required by law.
Regardless of whether you are a panellist or a simple visitor to the site, when you use our website, we place "cookies" on your computer. A "cookie" is a small file sent by our server to the hard disk of your computer, tablet or smartphone that identifies your navigation device and collects certain personal data.
We use different types of cookies:
- "Strictly necessary cookies and functional cookies": for instance, they allow us to identify your country and the language you prefer to use, to make the use of our site as simple and pleasant as possible;
- "Performance cookies": they allow us to collect traffic statistics from our site to make it more user-friendly and to offer content better suited to your needs;
You may refuse to install "cookies" on your computer, but such a refusal may result in decreased functionality or slow-down, or may even prevent access to certain services on the site.
The company "THI Factory" is a SA with headquarters at 4, Place Marcel Broodthaers - 1060 Brussels, Belgium and registered in the Register of Legal Persons of Brussels, under the VAT number BE 0541.696.005.
The company "Thalys International" is an SCRL with headquarters at 4 Place Marcel Broodthaers - Brussels, Belgium and is registered in the Register of Legal Entities of Brussels, under the VAT business number BE 0455.370.557.