Privacy Policy

Last Updated: 5 November 2026

1. Introduction

Rail Europe SAS (a French company with registration number 401 714 993 and address at Centre d’Affaires Paris Victoire, 52 rue de la Victoire, 75009 Paris, France) (“Rail Europe”) and Omio Corp. (a Delaware Corporation with registration number 4973690, and main address at Warschauer Platz, 10245 Berlin, Germany) ("Omio") jointly operate an internet-based platform (the “Service Site”) and mobile App (the “App”) (together, the “Platform”) under the Rail Europe brand. Rail Europe and Omio form part of the Omio Group, together with their subsidiaries (together, the “Omio Group”, and each separately, an “Omio Group Entity”).

Omio and Rail Europe (“we”, “us”, “our”) respect Your right to privacy, and we take our responsibility to safeguard Your private information very seriously. "You" means the individual accessing or using the Platform.

Together, Rail Europe and Omio provide search and booking functionality services (the “Services”) on the Platform. Rail Europe and Omio are entities part of Omio Group and may have different roles depending on the product and processing activity, as explained in this Privacy Policy. “We”, “us” and “our” refer to the party identified as controller for the relevant activity in this Policy. You can contact us via the Help Center, and our data protection officer at dsb@freshcompliance.de. If the Service Site or the App connect you with third-party online services, you should carefully review the privacy policies of such third-party sites as they are not governed by our Privacy Policy.

We want to inform you about the way we collect and process Your personal data in accordance with the GDPR and the German Federal Data Protection Act (BDSG) and other applicable privacy laws.

The terms “GDPR”, "personal data," "sensitive personal data," "special categories of data," "data subject," "processing," "data controllers," "processors," "independent controller" and "controller" have the meanings assigned by the applicable legislation.

1.1 Who is responsible for Your personal data

The Omio Group Entity responsible for processing Your personal data (the “controller”) may either be Omio Corp. or Rail Europe, as described below and further in the Privacy Policy:

• Use of the Platform and Your account: Rail Europe and Omio act as joint controllers for the personal data processed when You use the Platform and in connection with Your account, which is hosted and managed by Omio on behalf of the Omio Group. For accounts created before November 1st, 2026, Omio will host your account and process your historical booking data on behalf of Rail Europe.
• Bookings: for the personal data processed to make and manage a booking, the controller is the Omio Group Entity acting as Your contractual party for that booking, which depends on the travel service booked (see Section 2 of our T&Cs). It acts as an independent controller.
• Other processing activities: as described in the relevant sections of this Privacy Policy.

Where Rail Europe and Omio act as joint controllers, they have agreed on their respective responsibilities under Article 26 GDPR. You may contact either party with questions about how your data is handled, or contact the Omio Group DPO at the email address listed above. Your rights as a data subject may be exercised against either party. Details of this are set out in Section 7.

2. What kind of data do we collect?

2.1 Automatically generated website visitor information

We collect information and data that is automatically transmitted or generated by Your browser each time you visit our Service Site. Such information includes the IP address, the URLs of the site you visited before accessing our Service Site ("referrer"), the browser used, the browser language, the operating system and user interface, the access device used, date and time of Your access, the pages viewed on our website, and the time you spend on the Service Site. Such data is stored for a period of two years and deleted automatically thereafter. We may use this information to investigate errors, to improve the stability and functionality of the Service Site and the App, and to assist you in completing any interrupted bookings.

2.2 Data provided by you / user accounts

Furthermore, we also collect and use the information you provide to us about Yourself, Your travel companions, and about the planning of Your trip by using the Service Site or the App:

a) When you register on the Service Websites or the App, we request the following data: Personal data: Your name, Your email address, phone number, government-issued identification numbers, emergency contact information, billing address, payment method or credit card information, Your preferred travel connection and – where applicable – information about Your loyalty, bonus or discount cards (e.g. mileage or frequent-flyer programs, railway customer cards).

b) When you book a travel product through our Platform, we ask you to provide Personal Data, e.g. Your name, Your email address, phone number, government-issued identification numbers, emergency contact information, billing address, payment method or credit card information, Your preferred travel connection and – where applicable – information about Your loyalty, bonus or discount cards (e.g. mileage or frequent-flyer programs, railway customer cards). We will ask you for the data that the respective transportation provider requires to complete the booking process. Our forms show what kind of data is required for each respective booking. We cannot process Your booking without provision of the required data. Credit card information will be immediately passed on to the respective payment provider. We only store truncated credit card data (e.g. "5111111111") for reporting purposes and fraud analysis. When you make a booking for someone else (e.g. Your travel companion) through the Platform, we will request Personal Data about such companion or such business. You should obtain the consent of all such individuals before providing their information to us, as those individuals may not be able to independently view their information themselves if it is provided to us under Your account. Additionally, you should obtain consent from your travel companions before opting-in to an ancillary service, such as travel insurance. When you opt-in to these services on behalf of yourself and/or your travel companions, each passenger's data may be shared with the ancillary service provider on the basis of your consent. For more information, see Section 5.2. To the extent that Your companion(s) may need to amend or delete their information, they can reach out to us via our Help Centre.

c) Should you opt to additionally register for a personal profile with us by creating a user account, this data will be stored with us for Your future bookings.

d) If you contact us or our customer support (e.g. by email, telephone or contact form on the Service Site), we use the data you provided (usually Your contact information and Your inquiry) to respond.

e) Call recording: When you make calls to our customer service team, you may be required to confirm that you have an existing reservation with us. Calls to our customer service team may be recorded for quality control and training purposes, which includes using the recordings to process claims and for fraud detection purposes. You can opt-out from the call recording at any time during Your conversation with our customer service team by notifying one of our agents.

f) We may invite you to take part in surveys from time to time. These surveys may help us conduct market research, analyze how to improve Your experience on the Service Site and the App, and improve the functionality and quality of our Products. We will collect the data provided by you when you submit any such survey responses.

g) As a general rule, we do not process sensitive Personal Data or special categories of data, as defined by the applicable legislation, of users subject to this Policy. However, if it is exceptionally necessary to process such sensitive Personal Data or special categories of data to achieve the purposes described in this Policy, or as per its subsequent updates, Omio and Rail Europe will ensure that this activity occurs in compliance with the applicable legal limitations and with appropriate safeguards.

2.3 For how long do we store Personal Data?

We will retain Personal Data collected from you for as long as we have an existing legitimate purpose to do so (such as the purposes set out in paragraphs a) to e) above). In some cases, We may retain Your Personal Data for longer periods, in order to comply with statutory obligations. These include fraud investigations, tax and accounting obligations, or other legal purposes in line with applicable laws.

We determine the appropriate retention period for Personal Data based on the following;

• The purpose for which we process the Personal Data,
• The nature, and sensitivity of Your Personal Data processed,
• The potential risk of harm from unauthorized use or disclosure of Your Personal Data, and
• Any applicable legal requirements (such as statutes of limitation).

Once the legitimate business purpose or legal obligation no longer exists, We will either delete or anonymize Your Personal Data.

2.4 What are Your rights regarding Your Personal Data and how can you exercise them?

In addition, We'd like to remind You that You may have rights in relation to Your Personal Data under applicable law, based on your country of residence. These may include;

• the right to data deletion,
• the right to access Your personal data,
• the right to data portability,
• the right to rectification of Your data, and
• the right to object to processing, amongst others.

You can exercise these rights at any time, subject to any statutory obligations or legal limitations that may apply, by submitting a request via our Help Centre. Please note that in some cases, We may not be obligated to comply with Your request - for instance, where we are required by law to retain certain data, or where the data is necessary to fulfil an upcoming booking you have made with us.

2.5 Personal data belonging to minors

The Service Site and App are intended to be used by adults only. We do not knowingly collect Personal Data from children under the age of 13. In the event that we have knowledge that a child under the age of 13 has submitted any Personal Data to us via the Services Sites or the App, we may use the email address or other contact information provided by the child for the sole purpose of responding to the child's question or carrying out his or her request on a one-time-only basis. We will not use the email address provided by such child for any other purpose, and we will delete such information from our records once their question has been answered or the request has been fulfilled. If we become aware that we have unknowingly collected personal contact information other than an email address from a child under the age of 13, we will delete the information immediately.

2.6 Data collection for the purpose of newsletters and marketing emails

2.6.1 Marketing emails based on consent

If you opt in to receive marketing emails, we will send you marketing emails, including information about the Omio Group, which includes the Rail Europe and Omio brands, together with promotions for offers and services whether provided by us or third-parties (e.g. travel, accommodation), on the basis of Your consent to receive marketing emails from the Omio Group. You can unsubscribe at any time by pressing the 'unsubscribe' button at the footer of each marketing email. If you unsubscribe, and you have an upcoming booking with Rail Europe, you will continue to receive transactional emails related to Your booking.

2.6.2 Marketing emails based on soft opt-in

If you make a purchase with Rail Europe or Omio (depending on the travel service booked), we may send you marketing emails, including promotions for offers and services provided by us, for as long as you continue to use the Services, and for up to 24 months after you stop using them, on the basis of Article 7(3) Gesetz gegen den unlauteren Wettbewerb. You have the option to opt-out of marketing communications at the footer of each marketing email. If you unsubscribe, and you have an upcoming booking with Rail Europe, you will continue to receive transactional emails related to Your booking.

Marketing emails are sent on behalf of the Omio Group by an Omio Group Entity, which may use third-party service providers, such as email delivery providers, to send them. These service providers act as processors on our behalf, on our instructions and under appropriate data processing agreements.

2.7 Data collected by cookies, web beacons and similar technology

Like most other website operators, we use cookies, web beacons, and similar technology (collectively "Tracking Facilities") when you visit or use our Service Site.

Cookies are small text files that are stored by Your browser on Your computer or mobile device and which allow re-identification of Your computer or mobile device, potentially across numerous websites, including the Service Site. Some of the cookies we use are automatically deleted upon expiry of Your session, that is, when you close Your browser (these are referred to as session cookies). Other cookies remain stored on Your device and allow us, or our business partners, to recognize Your browser during subsequent visits (persistent cookies).

Our use of Tracking Facilities allows us to collect information about our users in order to provide simpler and more convenient access to our Service Site, or to enable us to provide certain services at all.

We use Tracking Facilities for the following purposes:

• To save Your user settings such as language and currency while on using the Service Site, and between visits.
• To store Your login status as a registered user (optional), so you do not have to log in again when returning to the Service Site later.
• For the technical assignment of Your visit to certain servers to ensure a safe transition between pages and search queries.
• To monitor the performance of our systems (no user-based evaluation of data).
• Service providers for website analysis, retargeting, and conversion tracking may also use Tracking Facilities (see below).
• To recognise when you are forwarded to the Service Site from one of our loyalty programme affiliate partners, so that you can receive Your loyalty points with the relevant affiliate partner after making a purchase with us.

If you click a link on the Service Site that takes you to the website of a provider (for example when making a booking or to buy a ticket), it is possible that such other websites also store cookies on Your computer. We have no control over these providers' cookies and the data collected in this way and we cannot accept any responsibility for our providers' websites or their tracking practices. We encourage you to carefully review the privacy policies of any website that you visit.

2.7.1 How do we use cookies?

We use different categories of cookies for different purposes (see below);

Category: Necessary for Use

Purpose: We use strictly necessary cookies that are essential for the main features of the website to function correctly, and for You to browse the website properly. Therefore, the use of this type of cookie does not depend on Your consent. If you visit the Service Site through a link provided by one of our loyalty programme partners, you indicate Your desire to receive points from that loyalty programme after making a booking with us. We use necessary cookies to let the provider know that you made a purchase through the link on their site, so that the provider can grant you Your loyalty points after making a booking.

Category: Infrastructure

Purpose: Infrastructure cookies are first-party cookies that are necessary for you to browse the website properly and use its core features. They are essential for Us to provide You with the Services, such as using our platform to search and book travel services.

Category: Security

Purpose: Security cookies are necessary to ensure an adequate level of security of our website such as user authentication for secure payment and fraud prevention. These may include third-party cookies, e.g. security cookies from the payment provider You selected when You are redirected to the payment page.

Category: Functionalities

Purpose: Core functionality cookies are necessary to ensure the proper functioning of our website and its essential features, such as travel service bookings and ticket issuance. These may include third-party cookies from our transportation providers when you are redirected to their website to finalize Your booking.

Non-necessary cookies: We also use cookies and similar technologies that help us understand how you use our website and to improve Your user experience. As such they may include third-party cookies for marketing and personalization purposes. These cookies will be stored in Your browser only with Your consent. You can choose to reject such cookies under "Settings", which might affect Your experience with our website.

Category: Performance and Statistics

Purpose: Performance & Statistics cookies are used to help understand personal and statistical use of our website to improve Your user experience. As such they may include third-party cookies and similar technologies like analytics services. It allows us to gain important insights about the use of our websites and how different settings affect Your user experience.

Category: Marketing

Purpose: Marketing cookies are used to assist our marketing efforts and improve online advertising performance. They allow us to track Your online activity in order to place personalized and relevant advertisements from third-party Ads partners. We may upload Your user identifiers received from these cookies to our Ads partner platform such as Facebook, Google and others to help improve the personalization of the advertisements.

2.8 Retargeting

Our Service Site may use what are known as retargeting tags for presentation of interest-related advertising on third-party websites.

A retargeting tag is the name for a JavaScript element that is placed in our Service Site's source code. If you visit a page on our Service Site that contains a retargeting tag, a provider of online advertising services (each a "Retargeting Provider", e.g. Google, Facebook, etc.) places a cookie on Your computer and allocates it to the corresponding retargeting target group lists. The Retargeting Provider uses the cookie to gather data related to Your interests (e.g. the pages visited on the Service Site or search queries), using pseudonymous identifies. Based on that information, the Retargeting Provider displays interest-based ads on third-party websites. No directly personally identifying data is stored or transmitted, and the usage profiles will not be merged with Your Personal Data. However, the Retargeting Provider can potentially identify you and track Your visits on our website, in particular, if you are a registered user of the particular Retargeting Provider (e.g. if you have a Google or Facebook account).

To learn more about this type of targeted advertising and Your options for preventing it, follow this link: Youronlinechoices.com

If you are a resident in Canada, you can follow this link: https://Youradchoices.ca/

You can object to usage-based online advertising by all or some providers on the same website. To access the preferences manager, click here: http://www.Youronlinechoices.com/de/praferenzmanagement

If you are a resident in Canada, you can click here: http://optout.aboutads.info/?c=3&lang=en

You can also prevent data transfer to all retargeting providers at any time by clicking the following link:

If you click the link above, we will set a persistent cookie that allows us to recognize and observe Your opt-out upon later visits to the Service Site. Please note that it must be re-set when you delete all cookies in Your browser. Opt-out cookies prevent tracking when you visit the Service Site with a specific device, browser and domain. To prevent cookies on different devices or browsers, you must set the opt-out cookie by clicking the opt-out button on all devices/browsers. The same applies if you visit the Service Site under different top-level domains. To prevent tracking in the App, please use the App's opt-out function (see below).

2.9 Conversion tracking

We use advertising partners to advertise our offers on third-party websites. We also use marketing tools to determine the success of our advertising measures ("Conversion Tracking"). We intend to show you advertising relevant to Your interests, to optimize our website, and to achieve a fair calculation of advertising costs.

To that end our advertising partners use cookies and web beacons (see above) to measure certain parameters related to the success of an advertising campaign, e.g. display of an ad or user clicks. The cookies are not intended to personally identify you. For the lifetime of the cookie the advertising partner can identify Your clicks on an ad and Your redirection to a certain landing page (e.g. form input, confirmation page, newsletter subscription). Based on this information, the advertising partner generates conversion statistics. These statistics show e.g. the number of users that have clicked on one of our ads. In addition, the statistics show the number of users that have reached a certain target page that has been marked with a "conversion tag" (remarketing tag, see above). The statistics do not include data that allows us to personally identify you.

We do not collect or use Personal Data in the advertising campaigns ourselves. Our advertising partners only provide us with statistical data, which allows us to identify effective advertising campaigns. We do not receive additional data, in particular no data that would allow us to identify our users.

Due to the Conversion Tracking tools, Your browser automatically connects to the server of the advertising partners. We have no influence on the scope and further use of data collected by the Conversion Tracking tools of our advertising partners. The advertising partners receive the information that you have visited certain pages on the Service Site or clicked on one of our ads. If you are a registered user of the advertising partner (e.g. if you have a Google or Facebook account), the advertising partner can relate Your visits to such account data. Even if you are not a registered user with the advertising partner, or are not logged into Your account, the advertising partner may collect and store Your IP address.

To learn more about this type of targeted advertising and Your options for preventing it, follow this link: Youronlinechoices.com

If you are a resident in Canada, you can follow this link: https://Youradchoices.ca/

You can object to usage-based online advertising by all or some providers on the same website. To access the preferences manager, click here: http://www.Youronlinechoices.com/de/praferenzmanagement

If you are a resident in Canada, you can follow this link: http://optout.aboutads.info/?c=3&lang=en

You can also prevent data transfer to all retargeting providers at any time by clicking the following link:

If you click the link above, we will set a persistent cookie that allows us to recognize and observe Your opt-out upon later visits to the Service Site. Please note that it must be re-set when you delete all cookies in Your browser. Opt-out cookies prevent tracking when you visit our website with a specific device, browser and domain. To prevent cookies on different devices or browsers, you must set the opt-out cookie by clicking the opt-out button on all devices/browsers. The same applies if you visit our website under different top-level domains. To prevent tracking in the App, please use the App's opt-out function (see below).

2.10 Web analytics and statistics

The Service Site use Google Analytics, a web analytics service provided by Google LLC. ("Google"). Google uses cookies (see above), which are stored on the user's computer and allow us to analyze the use of the Service Site. The information generated by the cookie about the use, including the user's current, but truncated EU IP addresses are transmitted to a Google server in the USA and stored there. Since we have activated IP anonymization, Your IP address will be truncated by Google within a European Union member state or a member state of the European Economic Area before transmission to the USA. Only in exceptional circumstances will the full IP address be transferred from the EU and truncated in the USA. Google will use this information on our behalf to evaluate the use of the Service Site, compiling reports on the activities of users of the Services, and to provide other services associated with internet use. In addition, Google may also transfer this information to third-parties if required to do so by law or where such third-parties process the information on Google's behalf. The IP address sent by Your browser to Google Analytics will not be merged with other Google data.

You can prevent the installation of cookies by changing the settings of Your browser. Please note, however, that this may prevent some of our services' feature from working correctly. Alternatively, you can prevent the collection of cookie data and Your website usage data (including Your IP address) by Google and the processing of such data by Google by downloading and installing a browser plugin available at: http://tools.google.com/dlpage/gaoptout.

In addition, you can disable data processing by Google Analytics by clicking on the following link: Deactivate Google Analytics

This sets an opt-out cookie that prevents the future collection of Your data when visiting the Service Site. Please note that it must be reset when you delete all cookies in Your browser.

This website utilizes Google Analytics with the extension "_anonymizeIP()". This extension ensures the processing of truncated IP addresses, so that no direct personal identification via IP addresses is possible.

Personal data associated with cookies, user identifiers (e.g., User-ID) and advertising identifiers (e.g., DoubleClick cookies, Android's Advertising ID, Apple's Identifier for Advertisers) will be deleted automatically after 14 months.

Use of Google Analytics is in accordance with the requirements agreed between the German data protection authorities and Google. Please find additional information here: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001.

Usage terms: http://www.google.com/analytics/terms/de.html,

Privacy policy: http://www.google.de/intl/de/policies/privacy.

Google has incorporated the EU Standard Contractual Clauses, https://policies.google.com/privacy/frameworks?hl=en-US.

The Service Site also uses Amplitude, Inc., 2918 Gilmerton Ave Los Angeles, CA, 90064-4508 United States to analyze customer interactions and improve our digital products and marketing performance. Amplitude acts as a data processor, and processes Personal Data such as IP addresses, device identifiers, and usage events on our behalf to generate aggregated analytics. This processing is based on Omio and Rail Europe's legitimate interests in optimizing services, and where required, your consent for analytics cookies.

2.11 Data collected by Social Plugins

The Service Site use what are referred to as social plugins.

We use the so-called 2-click solution. If you visit the Service Site, no Personal Data is transferred to the plugin provider. You can recognize the plugin provider by the label or logo on the button. We permit you to communicate directly with the plugin provider via the button.

Only if you click the button and activate the plugin, the plugin provider receives the information that you have visited the respective page of the Service Site. In addition, the information mentioned under Sec. 1 above is transferred by Your browser to the plugin provider. If you have an account with the plugin provider, and are logged in, the provider may relate Your visit to the Service Site and Your additional interaction with the social plugin (e.g. clicking on the "Like" button) to Your user account (e.g. Your Facebook account).

We have no influence on the data collected and processed by the plugin provider, nor do we know the full extent of the data processing, purposes, retention terms and deletion of data by the plugin provider. Please find additional information regarding data processing by the plugin provider in their respective privacy policies linked above. These policies also include information regarding Your rights and privacy-related configuration options.

2.12 Data Breaches

In the unlikely event of any unauthorized access or acquisition of Your Personal Data, or if we experience a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Your Personal Data, where such breach poses a significant risk of harm to Your rights and freedoms, we will promptly notify you without undue delay and, where feasible, not later than 72 hours after having become aware of it. In such case, we will also inform governmental authorities of such breach as required by applicable law.

3. How do we protect your data?

We use technical and organisational measures designed to protect personal data, including access controls, security testing, code reviews, monitoring and incident-response procedures. We require service providers that process data on our behalf to protect it and use it only for the contracted services and documented instructions.

4. Additional Personal Data collected by the App

The App is an alternative way to access offers and services provided by Rail Europe and Omio. The App records, processes and utilizes data in the same way as the Service Site, for the same purposes and on the same legal basis. The contents of this section of the Privacy Policy apply specifically to the App.

4.1 Additional use of App-specific data

When using the App, Omio and Rail Europe can access additional data relating to the App and Your mobile device, e.g. the device name, device manufacturer, model, operating system version, App version or SDK (software development kit) version and the device number (IMEI), advertising identifiers (e.g. Android's Advertising ID, Apple's Identifier for Advertisers). If you are using an Android device, the App can also detect what Google services you have subscribed to and can prevent Your device from going into standby while the App is running.

The App, for both Android and iOS, requires Your permission in order to function properly. Once you grant such permission, the App may record Your device's geolocation to use it for processing Your query (e.g., filling in Your location in the search form, to provide location-based services, or to suggest relevant content based on Your location). Your location data is transmitted through an encrypted connection. If you use GPS (global positioning system), the App will detect Your precise location. The data is used to fill in the search form and will not be stored otherwise. You may use Your device's settings menu to disable location data collection at any time.

4.2 Statistics and analytics

We use data analytics services to create statistics and analytics regarding Your use of the App, the Service Site, and our services. Data analytics services also assist when transitioning to our partner's websites or services. We use the IP address and device identifier of Your mobile device for such purposes. In addition, we may use such information to create cross-device, pseudonymous usage profiles ("cross-device-tracking"). You can disable the analytics functionality at any time in the App preferences.

In our apps, we use "Google Analytics" and "Firebase Analytics" as analytics services provided by Google LLC. ("Google"). Google provides SDKs, which are stored on the user's device and allow us to analyze their use of the App. The information generated by the SDKs about such use, including the user's current, but truncated IP address, are transmitted to a Google server in the USA and stored there. Since we have activated IP anonymization, Your IP address, if collected in the EU, will be truncated by Google within a European Union member state or a member state of the European Economic Area before transmission to the USA. Only in exceptional circumstances will the full IP address be transferred and truncated in the USA. Google will use this information on our behalf to evaluate the use of the App, compile reports on the activities of users of our services, and to provide other services associated with internet use. In addition, Google may also transfer this information to third-parties if required to do so by law or where such third-parties process the information on Google's behalf. The IP address sent by Your App to Google Analytics or Firebase will not be merged with other Google data.

If you are using the App, you can disable data processing by Google Analytics or by Firebase by using the switch at the bottom of this page.

This App utilizes Google Analytics with the extension "_anonymizeIP()". This ensures processing of truncated IP addresses, so that no direct personal identification via IP addresses is possible.

Please find additional information regarding Google Analytics here:

Usage terms: http://www.google.com/analytics/terms/de.html,

Privacy policy: http://www.google.de/intl/de/policies/privacy

Google has incorporated the EU Standard Contractual Clauses https://policies.google.com/privacy/frameworks?hl=en-US.

4.3 Push messages

If you have configured Your mobile device accordingly, the App may send you push messages, e.g. to provide updates on Rail Europe or Omio, status updates, marketing campaigns and other news, or to notify you of new services, products, and features. Push messages may also include advertising for Rail Europe, Omio or third-party offers (e.g. travel, accommodation).

You can withdraw Your consent to receive marketing push messages at any time, free of charge, by disabling marketing push messages in the App settings or by deactivating push messages in Your device's operating system preferences.

We use Braze (114 Sansome St Suite 1200, San Francisco, CA 94104) to send newsletters and push notifications based on Your searches. You can find more information regarding data processing by Braze and Your rights and options regarding protecting Your Personal Data here: https://www.braze.com/privacy/

4.4 Retargeting

You can find more information about retargeting above (Sec. 2.8).

We use the following retargeting and attribution providers:

If you are using the App, you can prevent data transfer to all retargeting providers at any time by using the switch at the bottom of this page.

When clicking the opt-out switch at the bottom of this page, we will disable the SDKs that allow us to recognize you. Your opt-out will take effect upon Your first subsequent use our App (i.e., after you restart the App). The opt-out switch prevents tracking when you use the App. To prevent tracking or retargeting on the Service Site, you must set the opt-out cookie by clicking the opt-out button in Your browser settings.

5. With whom do we share Your Data?

5.1 Data sharing within the Omio Group

5.1.1 Account Management

Omio provides technology and operational services for certain Rail Europe activities. If You held an account on www.raileurope.com before [date], Your account, including Your profile details and booking history, has been transferred to the Platform following Rail Europe joining the Omio Group, and is now hosted and managed by Omio Corp. on behalf of the Omio Group. For security reasons, You will be asked to re-authenticate the first time You log in, and to accept this Privacy Policy, which will then govern the use of your personal data by the Omio Group.

If you have not yet re-authenticated your account, Rail Europe SAS remains the Data Controller of your account data for account management purposes. Omio Corp. acts as a data processor on behalf of Rail Europe and provides a technical solution to store historical booking data on Rail Europe’s documented instructions, for the purpose of maintaining your access to past booking information.

Once your account has been re-authenticated, or for new users creating an account after (date), your account is hosted and managed by Omio on behalf of the Omio Group. Rail Europe SAS and Omio Corp. will become joint data controllers of your data for the purposes of managing your account, on the basis of performance of the contract for travel intermediation services with you.

5.2 Other services

Omio Corp. employs Omio Travel GmbH and Omio Services GmbH, (Warschauer Platz 12, 10245 Berlin, Germany) as a service provider to, among other things, operate computer systems, handle order processing and perform customer service. We may share Your information with, and among, our affiliated companies in order to enhance the products and services that we provide. To the extent that affiliates have access to Your information, they will follow practices that are at least as restrictive as the practices set forth in this Privacy Policy.

Omio Travel GmbH and Omio Services GmbH are subsidiaries of Omio Corp. Your Personal Data will be forwarded to Omio Travel GmbH and/or Omio Services GmbH or collected directly by Omio Travel GmbH and/or Omio Services GmbH on behalf of Omio Corp. Omio Travel GmbH and Omio Services GmbH will process Your data solely in compliance with this Privacy Policy and only for the purposes of performing services for Omio Corp., for running the Service Site, the App, related platforms and providing associated services. This privacy information therefore applies to data processing by Omio Travel GmbH and Omio Services GmbH as well. You can contact our data protection officer at dsb@freshcompliance.de.

We contractually oblige Omio Travel GmbH and Omio Services GmbH to observe the provisions of this privacy information, to process Your data for the aforementioned purposes only and to observe all applicable data protection and data security law and regulations.

5.3 Data transmission to travel service providers

5.3.1 Travel service providers

When you make a booking on the Service Site or the App, we will transmit any Personal Data (including loyalty program membership information) required to execute such booking to the respective travel service provider (e.g. airline, railway or coach operator, or accommodation providers such as hotels) so that the travel service provider can process Your booking and/ or produce any personalized tickets or vouchers that may be required. Such a third-party will then process Your Personal Data under its own responsibility and in accordance with its own privacy policies. We therefore strongly recommend that you carefully review the Privacy Policy for each such travel service provider prior to making Your booking. We will also share Personal Data with our travel service providers for the purposes of fraud investigations.

Certain bookings may be handled by a subsidiary of Omio Corp, Omio Voyages SAS. In such cases, we transmit the required data to Omio Voyages SAS, which processes the data on our behalf and only for the purposes of completing the booking process. Bookings for certain countries may be handled by our partner Amadeus IT Group SA (Salvador de Madariaga 1, Madrid, 28027, Spain) and its affiliates. For such bookings, we may transmit Your booking data to Amadeus, which processes the data under its own responsibility according to their data protection policy which we highly recommend you to carefully review on their website before making any such booking (see link here).

To the extent that we participate in a corporate transaction, divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy, we will inform the buyer that it shall only use Your Personal Data for the purposes disclosed in this Privacy Policy. From time to time, we may also share aggregate or anonymous information with third-parties, including advertisers and investors. For example, we may tell our investors the number of visitors that the Service Site receive on a monthly basis, or we may tell advertisers where the most popular travel destinations are each month.

5.3.2 Payment providers

The payment details (credit card information) for bookings made directly on the Service Site or through the App are processed by a trusted internet payment processor, who will transmit Your data directly to the relevant credit card company.

In order to ensure that the credit card is being used by its legitimate owner, and to prevent cases of online fraud, encrypted credit card information is transferred to an external payment security service for auditing purposes. This transfer may also include additional Personal Data.

Your credit card data is processed by trusted and reliable internet payment processors. Your credit card details are encrypted (usually using the SSL protocol) before transmission to the payment processor. Your credit card data will not be disclosed to us by the payment processors.

5.3.3 Accommodation providers

In addition, the basic information of Your query (such as destination and travel time) will be forwarded to the accommodation service providers displayed in the search window (e.g. Booking.com) - but only if the checkbox is selected. You can opt out by deselecting it. The service provider will then present you with non-binding offers matching Your search query in a new window or tab. A transfer of Personal Data (except for the IP address) does not take place on our side.

5.4 Ancillary Service Providers

Should you opt-in to receive an offer from the Omio Group's third-party ancillary service providers (such as insurance providers, or other travel-related service partners), on the basis of your consent, we will provide the following Personal Data to the relevant provider in order for them to deliver the selected service in connection with your journey:

• Name
• Email
• Other personal data categories as necessary

The Omio Group and our ancillary service providers act as independent controllers. For more information on how your data is handled by the relevant provider, including information on how to exercise your rights as a data subject, please consult their privacy policy.

5.5 Other service providers

We may use third party service providers, in particular for technical and business services, tax advisors and legal counsel. This may include hosting providers, including a content delivery network to cache and provide content, statistics and analytics, providers to handle service desk and support data, provision of CRM systems, sending of newsletters/mailings, spam and fraud prevention, IT service and development providers.

In particular, we use third-party tracking tools to monitor how automated systems (including artificial intelligence tools) crawl, interpret, and index our website. For this purpose, limited technical information such as your IP address, the URL path requested (including unique identifiers), and your browser's User Agent string may be shared with AI Tracking Tools. This processing is based on our legitimate interest (Art. 6(1)(f) GDPR) in protecting our content, ensuring proper website indexing, and maintaining the integrity of our digital services. Data is processed only for these purposes, subject to appropriate safeguards, and retained no longer than necessary.

These service providers receive Personal Data solely for the performance of their services for us on our behalf. They are contractually obliged not to use Personal Data for other purposes. Where these service providers are hosted outside of the European Union, additional measures such as the EU Standard Contractual Clauses are taken.

5.6 International transfers

Data processing may result in data transmission to recipients outside of the EU. The data transmission is then based on the EC model contracts http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm.

Personal information may be transferred to third-parties, such as transportation providers, located in non-EU countries, in which the travel is scheduled to take place. The Omio Group cannot provide any further information on the level of data protection offered in non-EU countries. Neither an adequacy decision in accordance with Art. 45 para. 3 GDPR or appropriate safeguards in accordance with Art 46 GDPR are required for such data transfer as it is necessary for the purposes of performance of a contract between you, Rail Europe and Omio or the implementation of pre-contractual measures taken at Your request (Art. 49(1)(b) GDPR); or for the conclusion or performance of a contract concluded in Your interest between Rail Europe/ Omio and another natural or legal person (Art. 49(1)(c) GDPR).

6. Purposes and legal basis of data processing

We will only process Personal Data in ways that are compatible with the purposes outlined in this Privacy Policy (or those you later authorize). We process Your Personal Data for the following purposes and on the following legal basis:

6.1 Performance of a Contract

Pursuant to Art. 6(1)(b) GDPR to enter into, perform, modify or terminate a contractual relationship with you, in particular:

• to enable Your access and use of the Service Site and the App,
• to facilitate Your search queries and bookings,
• to perform our contractual obligations,
• to personalize Your ticket or booking and to contact you with regards to the booking process or Your user account, for example to send you travel documents,
• to facilitate Your account login on the Service Site or the App (user account functionality), to recognize you as a user and spare you from re-entering Your data upon Your revisits to the Service Site or the App.

6.2 Legitimate Interest

Pursuant to Art. 6(1)(f) GDPR based on our legitimate interests,

• to improve the Service Site, Apps and our other services and to adapt them to the needs of our users,
• to perform internal quality checks,
• to prevent, detect, process and investigate malfunctions, incidents, fraudulent or other illegal activities, whether of Rail Europe, Omio or of our partners, or to mitigate the risk of occurrence of the aforementioned events,
• to ensure network and information security,
• to create statistics on access channels, the use of the Service Site and App and the frequency of transition to our partner's websites and services,
• for internal accounting and invoicing purposes with the respective transportation providers, accommodation or other partners and service providers,
• to personalize the Service Site, the App, and our offers of the Omio Group,
• to display advertisements and special offers that may match Your interests (or reduce Your exposure to advertising and special offers which you may find uninteresting),
• for marketing purposes and to optimize our marketing measures, including via automated decision making, to determine which of our offers are best suited to you,
• to enable Your interaction with social networks and other users, in order to improve our offers and make it more interesting for our users, to contact you, if requested by you or as necessary to fulfil the contract or as otherwise permitted by law,
• for the purpose of business process outsourcing to affiliated companies,
• enforcing obligations owed to us, and contractual terms and conditions, accounting, risk management and record keeping.

When using Personal Data to serve the above-mentioned legitimate interests, we will always balance Your rights and interests in protecting Your Personal Data against the rights and interests of our company, our affiliates, and trusted third-parties.

6.3 Consent

Pursuant to Art. 6(1)(a) GDPR based on Your consent,

• to send you newsletter emails or other marketing push messages (see above),
• to transfer data for certain bookings to our partner Amadeus and to transfer Facebook Data (see above).

6.4 Legal Obligations

Pursuant to Art. 6(1)(c) GDPR to comply with legal obligations, e.g. to observe retention periods required by trade or tax law or to comply with obligations to disclose data based on a legally binding court decision or official order.

7. Rights of the data subject, right to lodge complaints, right to object; Changes to this policy

In addition to the right to revoke Your consent given to us, where applicable, you have the right to request access to (Art. 15 GDPR) and rectification (Art. 16 GDPR) or erasure (Art. 17 GDPR) of Personal Data or restriction of processing (Art. 18 GDPR), the right to object (Art. 21 GDPR) and the right to data portability (Art. 20 GDPR).

You have the right to object to all types of processing described in this Privacy Policy for information that are based on Art. 6(1)(f) GDPR, based on grounds relating to Your particular situation (Art. 21(1) GDPR).

To the extent we process Your Personal Data pursuant to Art. 6(1)(f) GDPR for direct marketing purposes, you can object to such processing at any time without giving a reason.

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The competent supervisory authority for Omio is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Friedrichstr. 219, 10969 Berlin, Germany Fax: +49 (0)30 2155050 E-Mail: mailbox@datenschutz-berlin.de

The competent supervisory authority for Rail Europe is:

Commission nationale de l’informatique et des libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, Telephone: +33 (0)1 53 73 22 22, Fax: +33 (0)1 53 73 22 00, contact

Any inquiries, complaints or questions regarding this policy or Your personal ‎information should be addressed to our Data Protection Officer at the following email address: dsb@freshcompliance.de.

We may make changes or updates to this Privacy Policy from time to time or as required in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make, and in accordance with applicable law. You can see when this policy was last updated by viewing the "last updated' date displayed at the top of this Privacy Policy.

8. Additional information for residents of Brazil, California, and other Covered Residents

8.1 Additional Information for Brazilian Residents:

This Brazil-Specific Privacy Addendum ("Brazil Addendum") applies to all customers and website visitors located in Brazil. It supplements the information provided in this Privacy Policy. In the event of any conflict between this Brazil Addendum and the main Privacy Policy, the terms of this Brazil Addendum shall prevail for users in Brazil.

We respect Your privacy and are committed to protecting Your Personal Data. We follow best practices and comply with applicable data protection laws and regulations, including the Brazilian General Data Protection Law ("Lei Geral de Proteção de Dados" or "LGPD"), Federal Law No. 13.709/2018, which came into force on September 18, 2020.

If you are a Brazilian resident and have questions, requests, or wish to exercise Your LGPD rights, please contact us via our Help Centre. ANPD Contact Page: https://www.gov.br/anpd

8.2 Your Rights

As a Brazilian Data Subject, what are Your rights under the LGPD (Lei Geral de Proteção de Dados)?

In addition to the rights described in Section 2.4 of this Privacy Policy, In accordance with Article 18 of the LGPD, as a Brazilian resident you may avail of the following rights:

a) Confirm whether we process Your Personal Data b) Access the Personal Data we hold about you c) Request correction of incomplete, inaccurate, or outdated data d) Request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed unlawfully e) Request the portability of data to another provider f) Request deletion of data processed based on consent g) Receive information about public and private entities with which we share Your Personal Data h) Be informed about Your ability to withhold consent and the consequences of doing so i) Revoke Your consent at any time j) Request the review of decisions made solely through automated processing of Personal Data

You may exercise any of these rights by contacting our team via our Help Centre. We may require reasonable proof of Your identity before processing Your request.

8.2.1 Legal Basis for Processing Personal Data

We process Your Personal Data based on the legal grounds established in Article 7 of the LGPD and described in Section 5 of this Privacy Policy.

8.2.2 International Data Transfers

When Your Personal Data is transferred outside Brazil, we adopt appropriate safeguards in accordance with LGPD including but not restricted to User Consent.

8.3 Additional Information for California Residents

This California-Specific Privacy Addendum ("California Addendum") applies to all customers and website visitors located in California. It supplements the information provided in this Privacy Policy. In the event of any conflict between this California Addendum and the main Privacy Policy, the terms of this California Addendum shall prevail for users in California.

We respect Your privacy and are committed to protecting Your Personal Data. We follow best practices and comply with applicable data protection laws and regulations, including the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), and other relevant California privacy laws. California law requires us to provide you with some additional information about how we collect, use, disclose, sell and "share" Your "personal information", each as defined in CCPA. We will not rent or sell Your personal information to third-parties in exchange for money.

8.3.1 Personal information we collect, and how we use, disclose, and share such personal information.

Throughout this Privacy Policy, we discuss in detail the categories of personal information we collect from and about You, and if relevant, about Your travel companions. The CCPA also requires us to provide the information in the chart below.

We will retain Your personal information for as long as reasonably necessary to fulfill the purposes for which it is collected or to comply with applicable law, including as set forth throughout this Privacy Policy. Retention periods may vary depending on the type of personal information and the ways that we use it.

8.3.2 Opt out of sharing of personal information

To opt out of our use of Your personal information for purposes that are considered "sharing" for cross-context behavioral advertising purposes (as indicated in the chart above), you can visit this link. Please note that you must complete this opt-out on each browser or device you use to access the Service.

8.3.3 California Privacy Rights

California residents may have the following rights;

• The right to be informed about the types of personal information we collect or disclose about you; the types of sources of this information; the business or commercial purpose for collecting this information; and the categories of third parties to which we disclose this information (this information is provided in this Privacy Policy).
• The right to be provided access to and/ or a copy of certain personal information we hold about you.
• The right to correct or update personal information we hold about you.
• The right to deletion of certain personal information we have about you.

Certain information may be exempt from these requests under applicable law. For example, we need certain information in order to provide the Service to you or comply with applicable law. We may take reasonable steps to verify Your identity before responding to a request. Depending on the sensitivity of the information you are requesting and the type of request you are making, this may include verifying Your name and email address. If we cannot verify Your identity, we may be unable to respond to Your requests.

To exercise these rights, you can contact us via our Help Centre. You may be able to designate an authorized agent to make requests on Your behalf. For us to verify an authorized agent, you must provide the authorized agent with signed, written permission to make such requests or a power of attorney. We may verify Your identity directly with you before processing the authorized agent's request, as permitted by applicable law.

In the limited circumstances that we process sensitive personal information as defined in the CCPA (e.g., log-in information and precise geolocation data), we only use or disclose it for disclosed and permitted business purposes.

8.3.4 "Shine the Light" disclosure

California Law allows customers who are California residents to request certain information once per year regarding our disclosure of "personal information" (as that term is defined under applicable California law) to third parties for such third parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

8.3.5 Do Not Track

California law requires us to let you know how we respond to web browser Do Not Track (DNT) signals. Because there currently isn't an industry or legal standard for recognizing or honoring DNT signals, we don't respond to them at this time. Do Not Track is a different mechanism that the legally recognized GPCS browser-based opt out preference signal mentioned above.

8.4 Supplemental Information for Covered Residents

This Addendum (the "Covered Residents Addendum"), specific to residents (the "Covered Residents") of Colorado, Connecticut, Oregon, Texas, Utah, and Virginia, and other U.S. states with similar consumer privacy laws (the "Covered States") applies to all Rail Europe customers and website visitors located in the aforementioned States. It supplements the information provided in Rail Europe's Privacy Policy. In the event of any conflict between this Covered Residents Addendum and the main Privacy Policy, the terms of this Covered Residents Addendum shall prevail for users in the Covered States.

The consumer privacy laws in the Covered States ("State Privacy Laws") require us to provide you with some additional information about how we collect, use, disclose Your "personal data," and how we use personal data for "targeted advertising" purposes, each as defined in State Privacy Laws.

Throughout this Privacy Policy, we discuss in detail the categories of personal data we collect from and about Covered Residents, and if relevant, about Your travel companions. For more detail about how we use, disclose, and use such personal data for targeted advertising purposes, please see the chart in Section 8.3.1 above.

Opt out of sale of personal data or use of personal data for targeted advertising.

To opt out of our use of Your personal data for purposes that are considered "targeted advertising" (as indicated in the chart above), Covered Residents can visit this link. Please note that you must complete this opt-out on each browser or device you use to access the Service. If you have a legally recognized browser-based opt out preference signal turned on through Your browser, we recognize the preference expressed by this signal in accordance with applicable law.

8.4.1 Your Privacy Rights

Covered Residents may have the right to ask us to:

• Confirm whether we are processing Your personal data.
• Provide you access to and/or a copy of certain personal data we hold about you.
• Correct or update personal data we hold about you.
• Delete certain personal data we have about you.

Certain personal data may be exempt from these requests under applicable law. For example, we need certain data in order to provide the Service to you or comply with applicable law. We may take reasonable steps to verify Your identity before responding to a request. Depending on the sensitivity of the data you are requesting and the type of request you are making, this may include verifying Your name and email address. If we cannot verify Your identity, we may be unable to respond to Your requests.

To exercise these rights, you can contact us via our Help Centre. You may be able to designate an authorized agent to make requests on Your behalf. For us to verify an authorized agent, you must provide the authorized agent with signed, written permission to make such requests or a power of attorney. We may verify Your identity directly with you before processing the authorized agent's request, as permitted by applicable law.

If we deny Your request to exercise these rights, you have the right to appeal our decision. We will provide information about making an appeal in our response denying the request.