It is one part of a longer page -
https://www.thetrainline.com/terms/privacy.
If you look under the section entitled "Payment Card details and the address your card is registered to", you get the following:
Further down, it states who Trainline share data with. What is interesting, and possibly for a different topic, is that it does not say that it shares information with train operators for the purposes of preventing crime, merely "the authorities". That suggests an interesting question of definition about whether a TOC's enforcement team constitute "the authorities" for this purpose.