1. INTRODUCTION, DEFINITIONS AND ACCEPTANCE. The Great Smoky Mountains Railroad and its subsidiaries (“we”, “us” or “our”) are committed to maintain privacy protections for the users (“you” or “your”) of our services and products. Our Privacy Policy is designed to explain how we collect, use and safeguard the personal data you provide to us and your rights with respect to such data. Please read this Privacy Policy carefully before providing us with any personal data. By providing your personal data to us, whether through our websites (“Sites”) or otherwise, you are consenting to the collection, storage, use and disclosure of your personal data in the manner described below.
2. INFORMATION WE COLLECT. We collect the categories of personal data from and/or about you listed below. The list below represents categories of personal data across all consumers and does not necessarily represent the data we have specifically collected from and/or about you. Also, the definition of personal data included herein may be subject to certain exceptions and may not include data that is publicly available or that has been aggregated or de-identified in accordance with applicable laws.

We have or may collect the following kinds and types of personal information:

• Registration information when you create an account or subscribe, such as your name, country or state of residence, email address, username and password.
• Transactional information you provide when using our Sites, such as your home or work postal address, telephone number and payment information.
• Location and computer-based information, including location information provided by a mobile or other device interacting with our Sites, your computer hardware and software, IP address, browser type, domain names, access times and referring website addresses.
• Information you provided in public forums on our Sites and through applications, such as your forum posts and blog comments.
• Information sent either one to one or within a limited group using our message chat, post or similar functionality.
• Information we obtain from third parties, such as a site or platform provider or through tracking technologies about the use of our application or information on third party platforms.
• Activity information about your use, and the use of any person you authorize through your account, to access our Sites and applications, such as the content you review or post, how often you use our Sites, services or products we provide and your preferences.
• Sensitive information, such as social security number, passport number, financial information, such as credit or debit card numbers, independently or in combination with any required security or access code, password or credential allowing access to any account.

1. COOKIES AND OTHER TRACKING TECHNOLOGIES. Like many websites and applications, we and our service providers and business relations have automatically collect certain information about you when you use and interact with our Sites, their websites, social media accounts, mobile applications and emails (collectively “Online Services”). We collect this information using tools such as cookies, and other tracking devices (collectively “Tracking Technologies”). We use these Tracking Technologies to customize your visit, save your preferences, IP addresses, data related to advertisements that have been displayed to you or that you have clicked on, advertising identifiers (including mobile identifiers), page views and/or clicks and the date and time of your use. Cookies may be persistent or stored only during an individual session. You can set some cookie references through your device or browser settings but doing so may affect the functionality of the Sites.
2. CHILDREN’S PRIVACY. The Sites and the services and products provided by us are not directed to children, as defined below. The Sites do not knowingly collect or solicit information (as defined by the U.S Children’s Privacy Protection Act) from anyone under the age of 13. If you are a parent or guardian and you believe we have collected information from your child in a manner not permitted by law, contact us at privacy@americangeritagerailways.com. We will remove the data to the extent required by applicable laws.
3. LINKS TO OTHER WEBSITES. As part of the services and products we offer, we provide links to or with other websites or applications. We are not responsible for the privacy practices employed by these websites or the information or content they contain. This Privacy Policy applies solely to data and information collected by us on our Sites or through our services and products and not to your use of a third-party website accessed by selecting a link on our Sites or via our services or products. To the extent you access or use our services or products through or on another website or application, then the privacy policy of that other website or application will apply to your access or use of that site or application. We encourage our users to read the privacy statements of other websites before proceeding to use them.
4. HOW WE USE. The purposes for which we collect and use personal data depend on, among other things, our relationship or interaction with the specific users. We collect or may collect and use personal data for the following various business and commercial purposes:
5. To provide and personalize our services and products for our users.
6. To complete your transaction with us.
7. To process and collect your payments.
8. To send you promotional and marketing material about us and our services.
9. To customize, analyze, adjust and improve our Sites.
10. To provide you with important administration information regarding the Sites, such as changes to this Privacy Policy, our terms of use and other policies.
11. To prevent fraud and other prohibited or illegal activities.
12. To comply with requests of law enforcement or data protection agencies.
13. To provide you with technical and customer support.
14. To seek your opinion or feedback on our services and products or industry questions.
15. To facilitate access to all our applications to which you have subscribed.
16. To enforce our legal rights or comply with legal requirements.
17. To enhance our Sites functionality and provide improved product and user experience.
18. To track trends and analyze use patterns on our Sites.
19. HOW WE SHARE. We may disclose or may have disclosed the categories of personal data listed in B) above to third parties for a business purpose listed in F) above. In addition, we may disclose or may have disclosed your personal data to the following categories of third parties; affiliates and subsidiaries, vendors and suppliers that provide services and products on our behalf, insurers, joint marketing companies, ad networks, internet service providers, data analytics providers, operating systems and platforms, providers of identity and credit verification services, regulatory and other professional bodies and government authorities. We may disclose information about your browsing activity to certain third parties via automated technologies (e.g., third-party cookies) in exchange for non-monetary consideration. Depending on your state’s consumer laws, this may be considered a “sale” or “share” of data. We may also use certain categories of your personal data (such as IP addresses, information about your web browser and cookie specified data) for targeted advertising and profiling, but such information would not include sensitive personal information or data.
20. PROTECTING YOUR PERSONAL DATA. We have implemented security measures designed to protect your personal data from unauthorized access. We have contracted with reputable third-party providers to store and provide security for your personal data. Although we have taken reasonable measures to assess the existence of the technology used by us and/or these third-party providers to protect your personal data, we have relied on the statements and contract representations of the providers of these services regarding the security evaluations of the technology being used. No security measures are 100% secure and we expressly deny any guarantee that your personal data will not be accessed, disclosed, altered or destroyed by breach of the security measures used by such providers.  By using our Sites and services and products, you acknowledge that you understand and hereby agree to assume the risk.
21. YOUR RIGHTS REGARDING THE USE OF YOUR PERSONAL DATA. You have the following rights with respect to your personal data:

• You have the right to confirm whether we are processing your personal data and to access your personal data.
• You have the right to request that we provide you with a copy of your personal data.
• You have the right to request that we correct inaccuracies in the personal data we have collected about you.
• You have the right to request that we delete certain personal data that we have collected about you, subject to our right to maintain your personal data for specific purposes permitted by applicable state law.
• You have the right to request that your personal data not be sold to third parties or used for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. The definitions of “profiling” “sold” and “targeted advertising” are provided in the privacy law(s) applicable to this Privacy Policy.

You may have additional rights to the ones listed above based on the privacy laws for your state of residence, but we have chosen to model our privacy policy upon the privacy laws of the State of Colorado.

1. CHANGES TO THIS PRIVACY POLICY. We reserve the right to change this Privacy Policy and our terms of service at any time to reflect changes in our practices. When we post modifications to this Privacy Policy, we will revise the “last updated” date on our Sites. The modified Privacy Policy will be effective immediately upon posting on the Sites. Your continued use of the Sites after posting the modified Privacy Policy constitutes your agreement to abide and be bound by it. If you object to any modification, your sole recourse is to stop using the Sites.
2. CONTACT US. To Opt-out, remove or modify information you have provided us or if you have any questions regarding this Privacy Policy or the practices of the Sites, please contact us by sending an email to privacy@americanheritagerailways.com, Attn: Privacy Policy Manager.

LAST UPDATED: 08/26/2023