Privacy Notice Last Updated: January 2025

This privacy notice tells you what to expect when Heathrow Express Operating Company Ltd (“Heathrow Express”) a subsidiary of Heathrow Airport Ltd, collects personal information from you via:

our website

our mobile application

ticket transactions

station CCTV cameras

our customer relations team (where you have made an enquiry)

on-board Wi-Fi service

when you use Heathrow Rewards

My Heathrow Account

Heathrow Express is committed to protecting your personal information when you use Heathrow Express services. Whenever you provide such information, we are legally obliged to use your information in line with all applicable laws concerning the protection of personal data including the UK General Data Protection Regulation (“UK GDPR”). Your information will be kept in a secure environment and access to it will be restricted according to the “need to know” principle.

What Information We Collect About You?

Heathrow Express collects the following information about you:

Title
Name
Email address
Mobile number
Date of travel
Postcode
Rail travel discount entitlement
Payment details (including billing address)
Heathrow Rewards number and login credentials (if you are a Heathrow Rewards member)
My Heathrow Account details: name, email address, date of birth, address, gender, vehicle registration and airline programme membership (if you chose to add)
Surveillance systems are used in stations at Heathrow Airport which operate the Heathrow Express service. We capture and monitor images of events that take place within the vicinity of the stations across all terminals. Some of our colleagues also wear Body Worn Cameras. Please note, the CCTV inside the trains are operated by Great Western Railway (GWR). For more information visit the GWR website: Privacy and cookies | Great Western Railway (gwr.com). For more information on how Heathrow Airport process surveillance systems, please click here.
Any details you provide in relation to a customer service enquiry, this could include booking reference number, proof of purchase and other account details. Please note, information collected may differs depending on your enquiry.

Heathrow Express collects information about how you use the website and app. This includes the device(s) you use to access as well as collecting unique online identifiers such as IP addresses, which are numbers that uniquely identify a specific computer or other network device on the internet. For more information on cookies, how we use, and how to manage, see our cookies policy.

How Will Heathrow Express Use The Information It Collects About Me?

We will use your personal data for a number of purposes including the following:

Use of Data	Purpose	Justification
To provide you with the Heathrow Express Service	Contract	Where you buy a ticket from us via our website or mobile application, the lawful justification for collecting and using your personal data is that it is necessary for the performance of the Heathrow Express train services which you contractually enter into.
To follow up on your enquiry or request via our Customer Service Team and to keep a record of any actions and engagement of our responses.	Legitimate interest	We have a legitimate interest for processing your personal data in order to respond to any customer service enquiries.
To provide you with onboard Wi-Fi services	Contract	If you sign up to our Wi-Fi services, we will collect your information as part of the onboard Wi-Fi terms and conditions. This helps us understand how passengers use our services and improve their overall experience. It also supports access to features like free magazines, newspapers, and allows us to manage access, apply usage policies, and protect against unauthorised use.
To send you marketing communications about Heathrow Express products including the latest Heathrow Express promotions, news, offers, competitions, updates, and abandoned basket reminders.	Consent	When you purchase a Heathrow Express Ticket, a Heathrow product, use one of our services or engage with our retail partners, we may send you marketing communications where we have your consent to do so. These communications aim to inform you about latest updates, promotions and exclusive offers, or simply to inform you of the range of services available to enhance your experience when visiting Heathrow or using our online platforms. We may combine the data we collect with other information we hold about you if you have used our products and services before, or if you have provided your Heathrow Rewards account number when purchasing from our retail partners. This processing is conducted where we have a legitimate business interest. We may also analyse our marketing communications, including how they are received, to evaluate campaign effectiveness and to learn from customer engagement. This helps us better understand our customers’ preferences when interacting with Heathrow and our partners’ products and services. As a result, we can continue to provide ever more relevant content and services, with the aim that our communications are meaningful and that your journey experience is improved. You have full control over how we use your data for marketing purposes. If you no longer wish to receive marketing communications, you can update your marketing preferences at any time by: contacting us at privacy@heathrow.com or clicking ‘unsubscribe’ on the footer of any emails you receive from us or logging into your ‘My Heathrow’ account to update your Marketing Preferences, where you will be offered the opportunity to unsubscribe from marketing emails from: Heathrow Express Heathrow Airport Unsubscribe from all
Capturing your images via CCTV	Legitimate interest	The lawful justification for collecting and using CCTV footage is legitimate interest. CCTV is used in stations at Heathrow operating the Heathrow Express service. We capture and monitor images of events that take place within the vicinity of the stations across all terminals. Some of our colleagues may also wear Body Worn Cameras. We capture surveillance data for multiple reasons which are detailed in our CCTV privacy notice here. Other third parties such as Great Western Railway (GWR) may install their own CCTV in the train carriages; in this case they are data controllers in their own right. For more information visit the GWR website: Privacy and cookies \| Great Western Railway (gwr.com)
To provide you with the Heathrow Express App	Contract/ Legitimate interest	We rely on legitimate interest where necessary and where you have booked a Heathrow Express Ticket via the app we rely on contract to process your booking.
To provide the My Heathrow platform	Contract	My Heathrow online account provides seamless access to all Heathrow services. We process your data to enable a single sign-on with multi-factor authentication and security, ensuring access to your My Heathrow account dashboard which displays your orders/bookings, account history and other account details.

You are always in control of how we use your personal data and can opt out of marketing communications during and after the booking process. You can change your marketing preferences at any time or unsubscribe from Heathrow Express marketing communications by visiting ‘My Account’ or by clicking ‘Unsubscribe’ on the footer of a Heathrow Express marketing email.

Your information may be stored, handled, managed and/or used by the following recipients in order to deliver the Heathrow Express service:

Heathrow Express Operating Company and Heathrow Airport Ltd teams who deal with system support and Customer Relationship Management (CRM).

Our trusted data partner(s), who deal with marketing support for our Customer Relations Management platform

Our third-party software system providers who provide a method for delivering tickets to you either by email or mobile.

Our trusted payment service providers who administer the payments of Heathrow Express tickets

Suppliers of technical services delivering the technical administration of the Heathrow Express Service including (a) third-party IT systems that manage our IT platforms, and (b) IT providers who supply Heathrow with CCTV support

Wi-fi providers who deliver the onboard Heathrow Express Wi-Fi service.

Your information will always be retained in a secure environment and access to it will be restricted according to the 'need to know' principle.

We will not transfer or disclose your personal information, other than as identified in this privacy notice or otherwise except to our trusted third-party suppliers, to the police, tribunals, courts, regulators, or other authorities to assist them with their investigations or requests or for us to report security incidents or suspected or actual unlawful acts and/or as may be otherwise required by law.

All information identified in this privacy notice is processed in the UK and EEA. Other than, where you have purchased a ticket your email address will be transferred to the United States to send you booking confirmations. There are appropriate mechanisms in place to ensure the security of your data during any transfers. We always ensure that your information remains protected and secure when being transferred.

How Long Will Heathrow Express Keep My Information For?

Where you have purchased a ticket, contacted our customer service team or signed up to our marketing communications, your data will be retained for a period of three years from the date of your last interaction after which your personal data will be anonymised.

Where you have used our on-board Wi-Fi, your information will be retained for a period of 15 days from the date of your last Wi-Fi login at which point all of your personal details are removed from our systems.

CCTV data is stored on a secure system for a period of up to 31 days before being deleted. Imagery required for investigative or evidential purposes may be retained beyond 31 days and is securely disposed of upon completion/conclusion of the purpose for which it has been retained.

What Rights Do I Have Over My Personal Data?

Under the UK General Data Protection Regulation, you have the right to:

Be informed as to how your data is being processed;

Access your personal data by making a subject access request;

Rectification, erasure or restriction of your information where this is justified;

Object to the processing of your information where this is justified;

Where applicable, you have rights in relation to data portability; and

Where applicable, you have rights in relation to automated decision making.

To exercise your rights, please contact the Heathrow data protection officer using the following contact details:

Data Protection Officer
Heathrow Express Operating Company Limited
The Compass Centre
Nelson Road
Hounslow, Middlesex
TW6 2GW

Email: privacy@heathrow.com

What If I Find Your Response Unsatisfactory?

If you would like to complain about the service you received, please contact us via our Online Complaints Form. If you would like to make a data-privacy related complaint, please contact us at privacy@heathrow.com or our Online Complaints Form. Should you find our response unsatisfactory, you have the right to lodge a complaint with the supervisory authority – the Information Commission. You can find more information on the Information Commission's website at https://ico.org.uk/concerns/ regarding the complaints process.
From time to time we may process personal data from EU residents. Whenever applicable, we have appointed an EU Representative to ensure that we continuously process your personal data in compliance with applicable laws and without undermining your statutory rights. You can contact our EU Representative at HeathrowEURepresentative@eversheds-sutherland.com and write EU Representative as subject matter. You may also contact our EU Representative per post mail at:

Eversheds Sutherland Netherlands B.V.

Attn. EU Representative Heathrow Airport

Fascinatio Boulevard 212

Floor 2A

3065 WB Rotterdam

EU Representative Contact Details

From time to time, we may process personal data from EU residents. Whenever applicable, we have appointed an EU Representative to ensure that we continuously process your personal data in compliance with applicable laws and without undermining your statutory rights.

You can contact our EU Representative at HeathrowEURepresentative@eversheds-sutherland.com and write EU Representative as subject matter. You may also contact our EU Representative per post mail at:

Eversheds Sutherland Netherlands B.V. Attn. EU Representative Heathrow Airport Fascinatio Boulevard 212

Floor 2A

3065 WB Rotterdam

Privacy & Cookies

Cookies are small text files which are stored on your computer when you visit certain web pages. At Heathrow Express we use cookies to understand how our sites are used which helps us to improve your overall online experience. Some of the cookies we use are necessary for some of our sites to work whilst other cookies are used to provide tailored advertising by trusted third parties.

To find out more about cookies, visit www.aboutcookies.org.

Heathrow Express uses the following types of cookies on our websites:

Strictly Necessary

Cookie

Operator

Duration

Purpose

__cf_bm

Cloudflare

1 day

Used to maximize network resources, manage traffic, and protect our customers’ sites from malicious traffic and Bot detection.

__cq_dnt

dw_dnt

dwsid

sid

Salesforce Commerce Cloud

Session

Essential in order to provide a good shopping experience, enabling customers to place orders and manage Salesforce Cookie consent.

dwanonymous_*

Salesforce Commerce Cloud

180 Days

Used to identify repeat customers and save settings and repeat information.

utag_main

CONSENTMGR

Tealium

365 Days

Required for cookie and tag consent management

AWSALB

AWSALBCORS

AWSALBTG

AWSALBTGCORS

Adobe AEM and Amazon Web services

1 week

These are used for Load balancing to ensure our hosting can cope with website demand.

1^st Party Performance

Cookie

Operator

Duration

Purpose

AMCV_*

AMCVS_*

gpv_pn

gpv_url

s_cc

s_vi

Adobe Analytics

13M

session

session

session

session

These first party cookies are used to measure the performance of our websites and enable us to improve content and functionality. They are not used for any targeting or identification purposes and will not result in you seeing adverts.

optimizelyEndUserId

optimizelyRedirectData

optimizelyDomainTestCookie

optimizelyOptOut

optimizelySession

Optimizely

From 30 Minutes to 6 Months

Stores a visitor's unique Optimizely Experimentation identifier, experimentation specific data and evaluates new/returning sessions.

3^rd Party Performance

Cookie

Operator

Duration

Purpose

_cs_c

_cs_id

_cs_cvars
_cs_s
_cs_mk

Content Square

Session
13M
13M
13M

These cookies are used to provide our users with a better experience, identify technical issues and monitor and improve the overall performance of our site. They are not used for any targeting or identification.

Functionality

Cookie

Operator

Duration

Purpose

__stripe_mid

__stripe_

Stripe

13 M

Stripe sets these cookies as a unique session identifier to recognize users and provide payment functionality across sessions.

Targeting & Advertising

Cookie

Operator

Duration

Purpose

_fbp

&others

Facebook

13M

Used to measure performance of Facebook advertising. This will result in Facebook showing personalized ads through retargeting

_gcl_au

_gcl_aw

_gcl_dc

_gcl_gs

GCL_AW_P

GCL_DC_P

__Secure-1PSID

__Secure-3PSIDCC

__Secure-3PSIDTS

Google

From 1 day to 13 Months

Used to measure performance of Google advertising. This will result in Google knowing you visited Heathrow sites and potentially show relevant and personalized ads through retargeting.

ar_debug

Doubleclick

1 Year

This cookie is used by Google Ad Services/DoubleClick to resolve issues with advertisement

_uetsid

_uetvid

MSPTC

MUID

Microsoft Bing Ads

From 1 day to 1 Year

Used by Bing Ads to track visits across websites, measure advertising performance and retarget relevant and personalised ads.

d

Mc
_qca

Quantserve

Used to measure display advertising performance and advertising measurement as well as retargeting.

ORA_FPC

oinfo

oid

Oracle

730 Days

Used for Advertising measurement and retargeting.

Personalisation
Cookie	Operator	Duration	Purpose
_evga_* _sfid_	Salesforce Personalisation	13 M	Used to deliver tailored content, product recommendations and offers on our websites. They will recognise repeat visits and show more relevant content.

Managing Cookies:

You can set your browser to restrict, block or delete cookies from Heathrow and our third-party advertisers, or any other website. Each browser is different, so check the 'Help' menu of your particular browser to learn how to change your cookie preferences. If you choose to disable all cookies, we cannot guarantee the performance of our websites and some features may not work as expected. For more information on what cookies we use and how to manage cookies see our cookies policy.

Links to other websites - This privacy notice does not cover the links within this site to third-party websites. We encourage you to read the privacy statements on the other websites you visit.

Changes to this privacy notice - We will keep this privacy notice under regular review, and we will place any updates here. At the start of this privacy notice, we will tell you when it was last updated.

Mappa del sito