Privacy Policy

1. Who We Are

China Expresses ("we", "us", "our") is a specialist travel curator connecting English-speaking travellers with China's licensed luxury train operators. We are not a railway operator. Our website is www.chinaexpresses.com.

2. What Information We Collect

When you submit an enquiry form, register interest or contact us via email, we collect:

• Identity data: your name, nationality (when relevant for permit requirements).
• Contact data: email address, and optionally your phone number.
• Journey preferences: preferred routes, travel dates, party size, suite category, dietary or medical requirements relevant to the journey.
• Communication records: email correspondence, form submissions, and notes from calls or messages.

We do not collect payment-card details. Payments are handled separately through secure third-party channels and are never stored on our systems.

3. How We Use Your Data

Your personal data is used solely for:

• Designing and pricing a personalised journey proposal.
• Communicating with you about your enquiry or booking.
• Processing necessary permits (e.g., Tibet Travel Permit) where you have explicitly requested a journey requiring one.
• Meeting legal obligations — for example, record-keeping required by Chinese tourism regulations for foreign travellers.
• Sending occasional relevant journey updates if you have opted in (you may unsubscribe at any time).

We do not sell, rent or trade your personal data to third parties for marketing purposes. We do not use automated profiling or decision-making.

4. Legal Basis for Processing

Under applicable data-protection law (including the GDPR for UK and EU residents), we rely on the following legal bases:

• Performance of a contract: to prepare a journey proposal or fulfil a booking you have requested.
• Legitimate interest: to respond to your enquiry and improve our service.
• Legal obligation: to comply with Chinese tourism regulations and permit requirements.
• Consent: for marketing communications you have opted into.

5. Data Sharing

We share your data only where strictly necessary:

• Licensed train operators: to confirm suite availability and onboard requirements.
• Permit authorities: where a permit (e.g., Tibet Travel Permit) is required for your chosen route.
• Accommodation and ground-transport partners: for pre- and post-train arrangements included in your itinerary.
• Service providers: such as our email platform, website host (Cloudflare) and analytics tools — all bound by data-processing agreements.

We do not transfer your data outside the jurisdictions in which it was collected unless necessary for delivering your journey (for example, permit applications within China).

6. Data Retention

We keep your personal data only as long as needed:

• Enquiry data (no booking): deleted 24 months after your last interaction unless you request earlier deletion.
• Booking data: retained for 7 years after your journey to comply with Chinese tax and tourism record-keeping requirements.
• Marketing consent records: retained indefinitely unless you withdraw consent, to evidence your preferences.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate or incomplete data.
• Request deletion of your data (subject to legal retention requirements).
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, commonly used format.
• Withdraw consent at any time (for processing based on consent).
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email journeys@chinaexpresses.com. We will respond within 30 days.

8. Cookies

Our website uses minimal, privacy-respecting cookies:

• Essential cookies: None. Our site is static and functions without cookies.
• Analytics (optional): We may use Cloudflare Web Analytics, which does not use cookies and is GDPR-compliant by design. No personal identifiers are collected.
• Third-party cookies: None. We do not embed third-party tracking, advertising or social-media pixels.

9. Security

We take appropriate technical and organisational measures to protect your data — including HTTPS encryption, access controls, and data minimisation. However, no internet transmission is entirely secure; we cannot guarantee absolute security.

10. Children's Privacy

Our services are not directed at individuals under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it immediately.

11. Changes to This Policy

We may update this policy from time to time. The latest version is always published here with the effective date. Material changes will be notified by a notice on our website or via email if you have an active enquiry with us.

12. Contact

For any privacy-related questions or to exercise your rights:
Email: journeys@chinaexpresses.com
Data controller: China Expresses, represented through our contact page at www.chinaexpresses.com/contact.html.