Privacy

• KiwiRail is responsible for the information that we collect, this makes us what is known as a ‘Data Controller’.
• In some instances, we use third parties to process your personal information on our behalf. Some of these parties are based outside of New Zealand.
• We sometimes use your information to provide a more personalised and relevant experience. This involves refining our advertising and marketing strategies across our various channels to better align with your interests.
• We send direct marketing to you but only when we have your permission. If you want us to stop, or want to manage your preferences, you can do so.
• KiwiRail has an obligation to keep your personal information secure and we comply with the New Zealand Privacy Act 2020. You also have several rights over your personal information, including rights of access, correction, and deletion. You can exercise these rights.
• Our websites are not intended for children, and we do not knowingly collect information directly from children.

The types of information we may hold about you will depend on how we have interacted with you and what services or products you have requested from us over time. Information we hold about you could include:

• Information that you, or someone acting on your behalf, provide to us when you engage with us, including when you apply for a job with us. This can include your full name, address, date of birth, phone number, email address, payment card details and any preferences you choose to share with us (including requests for special assistance). Your account login details for our websites, including your username and login history, are securely stored. While we maintain your chosen password, it is encrypted, ensuring we cannot view it.
• Information collected about you by a travel agent. We collect information from them about you, to help us to manage your travel with us.
• Information about you related to the business, corporate or government travel programmes which you belong to. For example, this could include your business contact details, job title, cost centre details and transaction information.
• Your account login details for our websites, including your username, chosen password and your login history.
• Information about whether you want to receive marketing or service communications from us or our partners.
• We may collect CCTV footage of you for safety and security reasons, when you are on or near KiwiRail premises or travelling with us, and when on or near our managed rail crossings, tunnels, bridges, tracks, yards, stations, terminals, trains or ships.
• What you have said or shared with us by email, phone, on social media, in online direct message or in person (e.g., compliments, complaints, concerns or incidents you have shared with our employees). If you contact us by phone, this could also include recordings of your calls with us, as we record calls made to our contact centre.
• Information that you share with us when you participate in market research, surveys, or competitions.
• Information about the products you have purchased and the services that we have provided to you (e.g., if you travel with us, this could include information about your trip including when and where, what you paid, how you paid, the way you used our products and services including lounges).
• Details of the emails and other electronic communications you receive from us, and how you interact with them. For example, whether the communication has been opened, if you have clicked on any links within that communication and the device you used.
• Information from other sources such as specialist companies that provide customer intelligence information. For example, fraud prevention agencies, marketing and research companies, social media providers, as well as information that is publicly available.

You do not have to give us personal information but if you do not, we may not be able to provide you with the goods and services you are requesting.

Our legal basis for processing your personal information

When we process your information, we must have a "legal basis" for what we do. The different legal bases we rely on are:

Consent - You have told us you are happy for us to process your personal information for a specific purpose(s).

Performance of a contract - We must process your personal information to provide you with the products or services you have requested.

Legal obligation - We collect and process your personal information where required to by law.

Legitimate interests - We may process your information as is necessary for us to conduct our business, but only where our interests are not overridden by your interests or rights.

Vital interests - In limited cases it may be necessary for us to use your personal information to protect the health and safety of you or others.

We use your information:

To provide our products and services - we need to use your personal information to make our products and services available to you.

To contact you - we use your personal information to contact you. This could be by email, phone,  text message or by direct message on social media channels. This may be in relation to a service update or to respond to an issue you have asked for help with.

To maintain safety and security - we use your personal information to help provide safe and secure environments for our customers and our employees both online and when you travel or otherwise engage with us, including the prevention and detection of fraud, cybersecurity threats or any other misuse of our networks, websites and systems.

To provide relevant marketing and advertising - we use your personal information to provide relevant marketing communications relating to our products and services. As part of this, tailored online advertising may be displayed on our websites, on other organisations' websites and on online media channels like Facebook or Instagram. We may also use information about how you engage with us to measure the effectiveness of these campaigns.

To understand your needs through analytics and profiling - we use your personal information for statistical analysis and to help us understand more about our customers. That includes understanding things like how often you travel with us and what products and services you use. We use this information to create profiles about you and about our customers more generally. This helps us to serve you better and to find ways to improve our services, loyalty programme, and websites. These profiles also help us to send you offers that are more relevant to you.

To conduct surveys and market research - we love feedback and use surveys and other market research techniques to understand our customers more fully. We use this information to help us deliver on the expectations of our customers and to find ways to improve our services.  We may use testimonials from this research in our marketing.

To manage competitions - we use your information to run competitions and get prizes to the winners. If we use your information for any other purpose, we will let you know when you enter that specific competition.

We share your information with trusted third parties to help us run our business and provide the products and services you request from us. Sometimes these relationships mean that we need to transfer your information outside of New Zealand. When we do this, we take steps to ensure that your information and rights are protected.

By booking a ticket, applying for a job or otherwise engaging with us, you agree that we may disclose your personal information for any of the purposes listed in the above section, but only to the extent necessary to achieve those purposes, to:

Authorised individuals – we may share your personal information with another individual if they are acting on your behalf, or if you have provided your consent. For example:

• if a family member, friend, or work colleague books travel on your behalf, that person will be asked to provide us with the same personal information that we would normally collect directly from you. We consider that person to have your permission to provide us with your personal information; or
• if you have previously provided us with a written authorisation allowing another person (like your partner or personal assistant) to discuss your account with us.

We will only release your information to authorised individuals after following an appropriate security process. If you do not want an individual to be able to obtain information about you or be able to make changes to your booking, please do not share your account or booking reference information with them.

Vendors and service providers – we may provide your information to our trusted vendors and service providers who support us in doing business. For example, this can include:

• companies that help deliver, analyse, monitor, protect, control or support our digital services, systems, information, networks and infrastructure;
• payment service providers that enable us to take payments and give refunds;
• insights and analytics service providers;
• advertising and market research partners;
• companies that support our contact centre;
• logistics providers who enable us to deliver baggage, cargo, and goods that you have ordered;
• security and fraud prevention companies to ensure the safety and security of our customers, employees, business, networks, websites, and systems; or
• our professional advisors, such as lawyers and consultants.

Law enforcement and regulators – information may be shared with government agencies and authorities, law enforcement officials, or law courts on request or otherwise if we believe disclosure is required by applicable law, regulation, or legal process or in the interest of public health and safety and the maintenance of the law.

You consent to the disclosure of your personal information in accordance with this Privacy Statement to the parties listed above.

Marketing and Advertising

We like to get in touch with our customers but only do this where we have your consent, or if we have legitimate business reason to do so. Most of the time we will get in touch by email.

You can control the marketing communications you receive through the following options:

Clicking 'unsubscribe' - If you want to withdraw your consent to receiving our newsletter, you can do this by using the unsubscribe link in the footer of our newsletter email. 

We also use online advertising. This means you may see ads from us when you are on other websites, apps, and social media. We manage this through our digital marketing networks, ad exchanges and a range of advertising technologies. Sometimes we personalise these ads and our websites to make them more relevant to you based on information we hold about you (for example, your previous bookings).

As trusted guardians of your personal information, we respect your rights to manage the personal information about you that we hold. You have the right to:

• request and receive a copy of personal information we hold about you, including, where available, in a digital format;
• correct any inaccurate personal information we hold about you;
• restrict our use of your personal information;
• request that we stop business processing it or stop collecting it (in some circumstances);
• withdraw consent for any consent-based business processing; and
• complain to your data protection regulator. As a New Zealand based company, our primary regulator is the New Zealand Office of the Privacy Commissioner.

To get in touch about your personal information, please email the KiwiRail Privacy Officer at privacy@kiwirail.co.nz or write to Private Bag 92138, Victoria Street West, Auckland 1142. 

KiwiRail will not discriminate against you for exercising any of your privacy rights.  Please note that if you choose to not provide requested personal information, limit how we use your information or withdraw your consent for us to process your information, we may not be able to offer all our services to you.

We only keep your information for as long as we believe is reasonably necessary as required under the New Zealand Privacy Act 2020. We review the information we hold and delete it securely, or in some cases anonymise it, when there is no longer a legal, business or customer need for it to be retained.

We have dedicated privacy and cyber security teams to keep your personal information safe while we are holding it. We have implemented security and privacy measures and processes to minimise the risk of unauthorised use or disclosure of information, such as encryption, firewalls and intrusion detection systems.

We may change this Privacy Statement from time to time and we will tell you about a change in the Privacy Statement.  Any changes to our Privacy Statement will take effect upon being placed on our website.