Privacy Policy — What We Do With Your Data

1. Who is responsible for your data

Train Tickets China is a sole-trader booking service that buys tickets from China Railway on your behalf. For the purposes of the EU and UK General Data Protection Regulation, we are the data controller for the information described on this page. Our contact address for anything privacy-related is traintickets@trainticketschina.com.

2. What we collect

To issue the ticket: each traveller’s full name as printed on the passport, nationality, date of birth where the railway requires it, passport number, and the travel details (route, date, train number, seat class).

To contact you: your email address, and a phone number if you give us one for a time-critical problem on the day of travel.

To take payment: we receive a payment confirmation, the amount paid and the last four digits of the card from our payment processor. We never see or store the full card number, the expiry date or the security code: those are entered on the processor’s own hosted checkout page.

Technical: standard server logs (IP address, browser type, pages requested) kept for security and to diagnose faults. We also collect aggregate, cookie-free page-view counts through Cloudflare Web Analytics — it tells us which pages are visited and how fast they load, and it cannot follow you to other websites. We do not run advertising trackers, behavioural profiling, or any analytics that builds a profile of you across sites.

3. Why we are allowed to hold it

Contract. A passport number is not optional — China Railway will not issue a ticket without a valid identity document. We cannot perform the service you asked for without it.

Legal obligation. We keep transaction records for the period accounting and tax law requires.

Legitimate interests. Keeping enough technical log data to detect fraud and abuse of the booking system, and to defend against chargebacks.

We do not rely on consent for anything essential to issuing a ticket, because withdrawing consent would simply mean we cannot issue it. Where we do ask for consent — for example if you sign up to an occasional email — you can withdraw it at any time.

4. Who else sees it

This is the complete list, not a summary:

China Railway (12306) — the railway operator. Your name and passport number are submitted to their ticketing system because a ticket cannot legally exist without them. China Railway is a separate organisation with its own data practices, and its systems are located in China.

Waffo Pancake — our payment processor, which handles card authorisation and settlement, and which is the merchant name that appears on your card statement. They receive the payment amount and your billing details, never your passport data.

Cloudflare — our hosting, CDN and security provider. It also serves our cookie-free page-view statistics, which record the page requested, the country, and timings, but not your identity and not a cross-site profile.

Our email provider — used solely to deliver your booking confirmation and ticket details to the address you gave us.

Our hosting provider — stores the site and the booking database on our behalf.

We do not sell personal data. We do not share it with advertising networks, data brokers, or any marketing company. We do not use your passport data for any purpose other than issuing and servicing the ticket you booked.

5. Sending data outside your country

Booking a Chinese train ticket necessarily involves transferring the traveller’s name and passport number to China Railway in China. That transfer is the service, not a side effect of it. If you are in the EU, UK, or another jurisdiction with transfer restrictions, this means your data will leave that jurisdiction, and the receiving country may not offer the same level of legal protection. By asking us to book, you are asking us to make that transfer.

Our own systems are hosted on infrastructure in the United States and the European Union. Our payment processor handles card data within its own PCI-DSS-compliant environment.

6. How long we keep it

Booking and payment records — kept for seven years after the travel date, because that is how long tax and accounting rules require us to be able to produce them, and how long a card dispute can surface.

Passport numbers on completed bookings — masked in our working interface as soon as the ticket is issued and the journey is complete. The full number is retained only inside the archived record described above, and only for the purpose of answering a railway query or a dispute.

Email enquiries that did not become bookings — deleted within 12 months.

Server logs — rotated and deleted within 90 days.

When a retention period ends, records are deleted or irreversibly anonymised.

7. Your rights

You can ask us, free of charge, to do any of these:

Access — get a copy of the personal data we hold about you. Correct — fix anything inaccurate; note that a name already printed on an issued ticket can only be changed by reissuing the ticket, which China Railway charges for. Delete — erase data we no longer need. Restrict or object — limit processing that is not necessary to perform the contract. Port — receive data you gave us in a machine-readable format.

You can also complain to your national data protection authority. Please tell us first, though — most problems are quicker to fix directly.

Email traintickets@trainticketschina.com with the request. We reply within 30 days. We may ask you to confirm your identity, and for a booking request we will ask for the booking reference so we do not hand someone else’s travel documents to the wrong person.

One honest limit: once a booking is complete, we cannot delete the record on demand, because tax law requires us to keep it and because the railway may need it to answer a query about your journey. In that case we will tell you exactly what we are keeping and why, rather than pretending the data is gone.

8. Security

The site runs over HTTPS. Passport numbers are stored in a database that is not publicly reachable, and access is restricted to the accounts that need it to issue tickets. Card data never reaches our servers at all — it goes straight to the payment processor.

No system is perfect. If a breach ever put your data at risk in a way that matters, we will contact affected customers directly and notify the relevant authority as required by law, rather than waiting to be asked.

9. Cookies

We use cookies that are strictly necessary to keep your search and booking session working, and to remember your language and currency choice. Our page-view statistics are cookie-free. We do not use advertising or cross-site tracking cookies, so there is no consent banner to dismiss.

If you block the session cookie in your browser, search will still work but you will not be able to complete a booking.

10. Changes and contact

If we change this policy we publish the new version on this page with a new version number and effective date. Material changes affecting existing bookings are also sent to the email address on those bookings.

Questions, requests, or complaints: traintickets@trainticketschina.com. This page and our Terms of Service and Refund Policy together describe the whole of our arrangement with you.

All train routes we cover

Every route below has a dedicated page with live timetables, USD fares and a direct booking link.