In most cases, we will process your information so that we can carry out the contract that exists between our company and you. This is the case, among others when you book or purchase a stay.

In addition, in certain circumstances, we are legally required to process your personal data.
We can also group an amount of processing in the legitimate economic interest of our company. Examples of this include the combating of fraud, carrying out market research, improving our services and the development of new products. In doing so, we always assess whether your interest in protecting your privacy and your rights concerning your personal data outweigh the interest of our company. If this is effectively the case, we cannot begin this processing and must adapt it so that it is in balance with your interests.

Lastly, we will base some of the processing on your consent. This is, for example, the case with electronic direct marketing and with processing specific categories of personal data.. This consent shall, in most cases, be made clear by a positive action that you make (for example, supplying us with your personal data).
You can always revoke your consent. The processing that we have done until this consent is revoked does remain valid and justified.

How long will we keep your data?

Whenever the law imposes a minimum storage period, we are always required to store your information at least for this period. Aside from this minimum storage period and when the law does not establish a storage period, we have made a consideration in determining the storage period that weighs your interests and those of our company whereby the interests of us may never outweigh yours, and of the rate at which the data ages and the reasons for processing your data.

If we process your data for various reasons, the longest storage period will always apply. The possibility of the relevant services of our company using your personal data will, however, be determined by the specific storage period that applies to that service: if the storage period for that service has expired, we will no longer be able to use the data.

After the storage period has expired, your data will be removed from our data banks or be anonymized so that we can no longer link it to you.

More information about the exact storage period of your data can be found above in the information for specific processing.

What about your personal data?

1. You can oppose the use of your personal data for direct marketing.

You can, at any moment, oppose the processing of your personal data for direct marketing purposes. This applies both to the regular processing as for the profiling that is used for this direct marketing.

2. We can provide you with an overview of your personal data that we process.

You have the right to view your personal data that we process. This overview can help you assess whether you also wish to make use of other rights (for example, your right to change the data).

3. You can ask us to adapt or augment your personal data.

If you notice that the personal data that we have about you is incorrect or incomplete, you can ask us to adapt it or augment it, respectively. The latter can be useful, for example, when consequences are linked to this personal data, for example, with the assessment of whether you are eligible for a discount.

4. You can ask us to delete certain parts of your personal data.

Based on the privacy rules, you have the right to ask us to delete certain data. This is only possible when this data is no longer needed to achieve a certain objective. We cannot, for example, delete your personal data as long as you wish to make use of your rail season tickets or if we must still receive payment for outstanding amounts (for example, after a violation).

5. You can ask us to provide you with your personal data in an electronically legible format so that this can be passed on to another train operator.

Based on the privacy rules, you have the right to the transferability of your data. You can then ask us to receive all of the personal data you have provided us within a legible electronic format.

6. You can revoke the consent you provided for the processing of your personal data.

When the processing is based on our consent, you can revoke this consent at any time. An example of this is the processing of medical certificates to assess whether you are eligible for certain discounts. Depending on the time that you revoke your consent, this may mean that we will no longer be able to provide you with certain items. It may then be possible that you will no longer be able to benefit from a discount that is based on the processing of personal data.

7. You can ask to limit the processing of your personal data to certain purposes.

The privacy rules give you the right to ask us to limit the processing of your data to certain purposes. It will not, however, always be possible for us to meet this request, for example, when we are legally required to process your personal data or to be able to follow up on violations.

How can I do this?

You can oppose the use of your data for direct marketing by clicking on the “sign out” button that you will find in all of the direct marketing documents.

In addition, you can also send a written request with proof of your identity to info at

How do we protect your data?

We have appointed a Data Protection Officer who advises us about the privacy rules and checks whether our company complies with the privacy rules.

In addition, we also ensure that only the persons who are effectively required to process your personal data for their professional activities within our company have access to your data.


NH bvba draagt zorg om alle persoonsgegevens goed te beschermen, zowel organisatorisch (bijvoorbeeld door middel van registers, policy’s) als technisch (bijvoorbeeld door middel van IT-maatregelen).

NHI bvba probeert op een  begrijpelijke en transparante manier klanten te informeren over hoe wij persoonlijke gegevens verzamelen en verwerken. Het verzamelen, verwerken en opslaan van persoonlijke gegevens is bij ons beperkt tot specifieke en rechtmatige doeleinden.

NHI bvba kan persoonsgegevens  wissen als de persoon in kwestie daar om vraagt, en als er geen geldig tegenargument gegeven kan worden. Dat geldt ook als de data inmiddels gedeeld zijn met derde partijen.