The state railway carrier "Ukrzaliznytsya" has approved an updated Privacy Policy and an actualized Notice on the Processing of Personal Data. The document regulates the full cycle of working with passenger information: from the moment of purchasing a ticket through electronic services to the consideration of complaints and insurance cases. The carrier has clearly defined which specific categories of data are collected, for what purposes they are processed, and what protection mechanisms are applied at each stage. The update of the rules takes place against the backdrop of the active development of the company's digital services, including the mobile application, web platform, and integration with state electronic identification systems.
What data the carrier collects and for what purposes
The volume of processed information depends directly on the service chosen by the passenger. When booking tickets through the app or website, the company records the surname, first name, phone number, email address, and, if applicable, information from documents confirming the right to a concession. For electronic identification via "Diia.Sign", NBU BankID, or "Diia.Sharing", the carrier receives identification data, including the Taxpayer Identification Number (RNOKPP), as well as information on the status of an internally displaced person. When booking special wagons, car-carrying wagons, station assistant services, or placing orders for military personnel, additional data is processed: car make, scanned copies of documents. For claim-based ticket refunds, full names, date of birth, residential address, RNOKPP, and IBAN account number are requested. All this data is used exclusively for providing transport services, conducting settlements, resolving disputes, and ensuring information security.
Storage and protection: servers remain in Ukraine
"Ukrzaliznytsya" emphasizes that all personal passenger data is stored on servers located in data centers on the territory of Ukraine. The company applies a complex of technical and organizational security measures: it limits the circle of employees who have access to databases and records any attempts of unauthorized violation. The legal grounds for processing are the passenger's consent, the fulfillment of the terms of the public offer (transport contract), and imperative requirements of Ukrainian legislation in the field of personal data protection. The transfer of information to third parties without the consent of the data subject is strictly prohibited.
When data is transferred to state bodies
An exception to the rule on the prohibition of transfer to third parties is provided by law: information about concession passengers may be sent to the Ministry of Social Policy, Family and Unity of Ukraine or the Ministry of Education and Science for verification of relevant documents. Transfer is also possible in other cases directly provided for by current legislation. Passengers, in turn, on the basis of the Law of Ukraine "On Protection of Personal Data" have the right to receive information about their data, demand its correction or deletion in case of detection of inaccuracies, as well as withdraw previously given consent for processing. These rights can be realized via the hotline 0-800-503-111 or via email.
Context: security and insurance payments
Against the backdrop of the update of privacy rules, "Ukrzaliznytsya" has also actualized guidelines for passengers on actions in emergency and conflict situations. The carrier reminded about the possibility of using the "panic button" in wagons, the urgent call of railway workers and law enforcement agencies in case of threat or violence. The procedure for receiving insurance payments in case of injury during the trip is explained separately: according to current legislation, insurance of railway transport passengers provides compensation for harm to life and health in the amount of up to 320,000 hryvnias.
Contradictory data
No significant discrepancies in figures or dates were found in the provided sources. Source RBC.ua (ID 1) confirms the fact of updating the Privacy Policy and changing the rules for data processing when purchasing tickets. Source UNIAN (ID 4) touches on a related topic — simplifying the ticket purchasing procedure for certain categories of passengers, which indirectly correlates with the update of data policies, but does not contain contradictory facts. Sources garant.ru (ID 2) and rbc.ru (ID 3) are of a general reference nature on the topic of compiling privacy policies and do not relate to the specific news about "Ukrzaliznytsya", so they are not included in the fact-check.
