Privacy Policy

Last updated: 2026-10-21

1. Who we are

TrainTicket.travel is operated by 青海优选文旅有限公司, China. We arrange rail tickets in China, Korea and Thailand for travellers booking from abroad.

Questions about this policy, or any request about your data, go to support@traintickets.travel — the same address our support team answers from.

2. What we collect

We collect only what a booking needs:

• Passenger details — full name, passport number, date of birth and nationality. These are required by the railway for a real-name ticket. Passport numbers are encrypted with AES-GCM on the server before they are stored, and any screen that shows one displays a mask such as E123****789 rather than the full number.
• Contact details — your email address, and your phone number if you give one, so we can send the payment link, the ticket and travel updates.
• Order details — train number, travel date, seat class, amount paid and payment status, plus the messages you exchange with our support team.
• Cookies — tt_sess keeps you signed in and holds your session; lang remembers your language preference. We do not run advertising or third-party analytics cookies.

We never see or store your full card number. Card payment is handled by PayPal or Airwallex on their own checkout pages. We receive only the result of the payment — paid, failed, refunded — never the card number or security code.

3. Why we collect it

• To buy and issue the ticket in the passenger's name through China Railway 12306, which requires real-name passenger data.
• To email the payment link, the issued ticket and any change or delay notice.
• To answer support questions about an existing order and to process refunds.
• To keep accounting, tax and other records the law requires us to keep.

4. Who we share it with

We share the minimum needed, and only with:

• China Railway 12306 (or the national railway of Korea or Thailand for those bookings) — passenger name, passport number, date of birth, nationality, train and travel date. This is mandatory: no ticket can be issued without it.
• PayPal and Airwallex — order reference and amount, to collect and refund payment. Card details are entered on their pages, not on ours.
• Our email provider — your email address, to deliver order notifications.
• Cloudflare — hosting and network security for this website.

We do not sell personal data and we do not share it for advertising.

5. Retention

Order and passenger records are kept for 24 months from the travel date, which covers refunds, payment disputes and legal record-keeping. When that period ends the order is deleted, including the encrypted passport data. Support emails are kept for the same period and then deleted.

6. Your rights

You can ask us to show you the data we hold about you, correct it, or delete it. Write to support@traintickets.travel from the address used for the booking and include your order number (it starts with TT). We respond within 7 business days.

Deletion is not always possible immediately: once a ticket has been issued, the railway and accounting rules may require us to keep the record for the retention period above. We will tell you what applies when you ask.

7. Children

Passengers under 14 must be booked by a parent or guardian, who is responsible for the details submitted. We do not knowingly collect data from children other than as part of a booking made by an adult.

8. International transfers

We operate from China and use service providers in other countries, including Cloudflare's global network and the payment providers named above. Your data may therefore be processed outside the country you live in. Wherever it is processed, it is covered by this policy and by the provider's own data-protection terms.

9. Changes to this policy

If this policy changes, we update this page and the date at the top. If a change materially affects an active booking, we also tell you by email.