Privacy Policy

1. we really need. If the result can be achieved with less personal data, then we make sure we use the minimum data required.
2. Transparency: We inform people about the way we use their personal data.
3. We facilitate the exercise of the people’s rights: access to their personal data, rectification and erasure of their personal data and the right to object to the use of their personal data
4. Storage limitation: We retain personal data for a limited period.
5. We ensure the security of personal data, i.e. its integrity and confidentiality.
6. If a third partyuses personal data, we make sure it has the capacity to protect that personal data.
7. If personal data is transferredoutside European Union, we ensure this transfer is covered by appropriate legal tools.
8. If personal data is compromised (lost, stolen, damaged, unavailable…), we notify such breaches to the respective country’s responsible authority and to the person concerned, if the breachis likely to cause a high-risk in respect of the rights and freedoms of this person.

For any questions regarding these ten principles, please contact us at the coordinates indicated in article 7 “Your rights”.

As part of the processing activites described below, we collect the following personal data:

• For Web Users:
  • Title,
  • First name and last name,
  • Email address,
  • Phone number,
  • Country,
  • Guest type (e.g. individual, travel professional, group),
  • Navigation data,
  • Where applicable, any information that you would spontaneously communicate us when contacting us.

• For Agents: the collect of your personal data listed below may be carried out through our partner Accor S.A.
  • First name and last name,
  • Email address,
  • Phone number,
  • Professional loyalty program membership code, if applicable,
  • IATA number.

• For Guests: the collect of your personal data listed below may be carried out through different channels:
  • Either directly from you when you make a booking on our Website, or
  • Either indirectly via the individual booking the stay or itinerary for you, or via our partner Accor S.A when your booking is made through its website all.com.

• Title,
• First name and last name,
• Date of birth,
• Nationality,
• Phone number,
• Where applicable, a copy of a piece of identification,
• The Accor ALL loyalty program number, or of another partner program, and information about your activities within this program,
• Your credit card number (for transaction and reservation purposes),
• Email address,
• Postal address (ZIP code, address, city, country),
• Information related to the booking,
• Information related to your children (first name, date of birth, age),
• Any relevant comments related to your booking that you would spontaneously communicate to us (e.g., smoker or not, type of bedding, print media read, cultural interests, sports, food and drink preferences, etc.),
• You questions/comments during or following your stay/itinerary.

The information collected in relation to persons under 16 years of age is limited to their name, nationality and date of birth, which can only be supplied to us by an adult. We would be grateful if you could ensure that your children do not send us any personal data without your consent (particularly via the Internet). If such data is sent, you can contact our data protection officer (see clause “Your rights” below) to arrange for this information to be deleted.

To simplify the presentation of the data processing’s modalities, we present in the table below the reasons why we process your personal data (purposes), our justifications for the processing (legal bases), as well as the period during which we use them (retention periods).

Your personal data may be shared with internal and external recipients under the following conditions:

1. We share your data with a limited number of authorized staff members and departments within Orient Express, and in particular the business team, marketing team, our customer support as well as our fraud and compliance department.
2. With service providers and partners: your personal data may be transmitted to third parties, in particular to hotels, hospitality trains operated under the Orient Express brands, as well as to our IT service provider in charge of the Website’s hosting, our payment service provider and our call center. Your data may also be transmitted to our partner Accor S.A.
3. Local authorities:we may also disclose your information to local authorities, if required by law or in the course of an investigation and in accordance with local regulations.

For the purposes indicated in Article 3 of this Policy, we may transfer your personal data to internal or external recipients who may be located in countries offering different levels of personal data protection.

Therefore, Orient Express implements appropriate measures to secure the transfer of your personal data to an external recipient located in a country offering a different level of protection from that offered in the country where the personal data is collected.

Data flows to countries that do not offer an equivalent personal data protection are subject to the standard contractual clauses defined by the European Commission. If necessary, we will also implement additional safeguards to these transfers in order to ensure the effective application of the standard contractual clauses.

You may ask more information on the framing of the international transfers we may perform by sending an email at the address specified in Article 7 “YOUR RIGHTS”.

Orient Express takes appropriate technical and organizational measures, in accordance with applicable legal provisions (in particular article 32 of the GDPR), to protect your personal data against destruction, loss or alteration, misuse and unauthorized access, modification or disclosure, whether such actions are unlawful or accidental. To this end, we have implemented technical measures (such as firewalls) and organizational measures (such as a login/password system, physical protection, etc.) to ensure the ongoing confidentiality, integrity, availability and resilience of the processing systems and services.

You have the right to obtain information and access to your personal data collected by Orient Express, subject to the applicable legal provisions.

You also have the right to have your data rectified, erased or have its processing restricted. Furthermore you have the right to data portability and to issue instructions on how your data is to be processed after your death (hopefully as late as possible!). You can also object to the processing of your personal data.

If you wish to exercise any of your rights, please contact the Orient Express data protection officer at the following address : [email protected].

For the purposes of confidentiality and personal data protection, we will need to check your identity in order to respond to your request. In case of reasonable doubts concerning your identity you may be asked to include a copy of an official piece of identification, such as an ID card or passport, along with your request. A black and white copy of the relevant page of your identity document is sufficient.

All requests will receive a response as swiftly as possible and in compliance with applicable law.

You also have the right to lodge a complaint with a data protection authority.