General Data Protection Regulation

Rail Exclusive is committed to protecting your privacy. We have prepared this Privacy Notice to describe our practices regarding the ‘personal data’ we collect from contractors, members of the public, and visitors to the Rail Exclusive web site. Your data will always be treated securely and in accordance with this Privacy Notice. We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so.

The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).

Your personal data – what is it?

Personal data means any data that allows someone to identify you. For example, your name, address, telephone and mobile numbers, and email address – as well as any information about you that is associated with, linked to, or could be linked to, any of the aforementioned data. When identified by such information, you are known as the ‘data subject’.

Who are we?

Rail Exclusive is the ‘data controller’ (contact details below). This means it decides how your personal data is processed and for what purposes.

How do we process your personal data?

Rail Exclusive complies with its obligations under the “GDPR” by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

We use your personal data for the following purposes:

• To process your order
• To manage your account
• To personalise your use of the website
• To manage our employees
• To maintain our own accounts and records
• To inform you of news, events, and activities

We may also collect and store information about you when you interact with us. For example when you:

• submit an enquiry
• give us feedback
• make a complaint
• apply for a job
• enter into a contract with us

What is the legal basis for processing your personal data?

• Explicit consent of the data subject so that we can keep you informed about news, events, and activities
• Processing is necessary for carrying out obligations under employment, social security or social protection law, or a collective agreement
• Processing is carried out ensuring there is no disclosure to a third party without consent

Sharing your personal data

Your personal data will be treated as strictly confidential. We will only share your data with third parties with your explicit consent or when required by law to do so.

How long do we keep your personal data?

• We will keep your personal contact information for only as long as it remains relevant and/or necessary for us to do so.
• We will keep financial records and associated paperwork for as long as the law requires us to, for tax or accounting purposes (which may be up to six years after a particular transaction).

Contact forms

If you contact us through any of the contact and/or feedback forms on this website, we will process your email address and your name. We will retain this data only as long as necessary and relevant to process the your enquiry. We will not use your data for any other purpose than was intended.

Cookies

Cookies are small pieces of data, stored in text files, that are stored on your computer or other device when websites are loaded in a browser. They are widely used to ‘remember’ you and your preferences, either for a single visit (through a ’session cookie’) or for multiple repeat visits (using a ‘persistent cookie’). They ensure a consistent and efficient experience for visitors, and perform essential functions such as allowing users to register and remain logged in. Cookies may be set by the site that you are visiting (known as ‘first party cookies’), or by third parties, such as those who serve content or provide advertising or analytics services on the website (‘third party cookies’).

How We Use Cookies

We use first party and third party cookies for several reasons. Some cookies are required for technical reasons in order for our website to operate. We refer to these as “essential” or “strictly necessary” cookies. Other cookies enable us to provide a better user experience such as when people make a purchase. Finally, third parties serve cookies through our website to provide tracking technologies which we use to analyse trends and improve the website as a whole. You can set your cookie preferences at any time using the dialogue box below:

Your rights and your personal data

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:

• The right to request a copy of your personal data which Rail Exclusive hold;
• The right to request that Rail Exclusive corrects any personal data if it is found to be inaccurate or out of date;
• The right to request your personal data is erased where it is no longer necessary for the Rail Exclusive to retain such data;
• The right to withdraw your consent to the processing at any time;
• The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means];
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
• The right to object to the processing of personal data, (where applicable) [Only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics]; and
• The right to lodge a complaint with the Information Commissioners Office.

Further processing

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the new processing.

People under 18

All personal information processed about people under the age of 18 is done so with parent/guardian consent. Before processing data we will ask you to confirm that consent has been provided, if the individual is under the age of 18. We trust that adults from other organisations (for example, teachers and youth workers) who provide us with data about those aged under 18 have received parent/guardian consent for the data to be shared.

Contact Details

To exercise all relevant rights, queries of complaints please in the first instance contact the Rail Exclusive via e-mail at info at slw@railexclusive.com.

You can contact the Information Commissioners Office on 0303 123 1113 or via email at https://ico.org.uk/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

Data Controller

The data controller is:

Data Protection

The data protection officer is:

Changes to this Privacy Notice

Our Privacy Notice may change from time to time to ensure adherence to legislation or industry developments. Please check this page occasionally to see if we have included any updates and that you are happy with them.

(Last updated by Antar Howarth on: 18 September 2018)