Privacy Notice — Draft

DRAFT — not yet approved for final publication. The lawful bases for processing, retention periods, hosting and email-provider arrangements, international transfers (if any), controller/processor responsibilities and implementation of the closure policy must be confirmed.

This notice explains how personal information is handled in RailStock Register, a railway rolling-stock record-keeping service operated by Ride on Railways Ltd.

1. Who is responsible for your information?

Ride on Railways Ltd operates the RailStock Register service and manages its technical administration. Individual railway organisations use separate areas of the system to manage their own rolling stock, users and records.

Depending on the information and purpose involved, a railway organisation may be the data controller for records it enters, while Ride on Railways Ltd may act as its processor. Ride on Railways Ltd may be a controller for its own account administration and service operations. These responsibilities must be verified and documented before this notice is finalised.

2. Information the service handles

• Account information: names, email addresses, assigned railway sites, access roles and securely stored password hashes.
• Rolling-stock records: registration numbers, descriptions, owners where entered, photographs, service dates and related details.
• Inspection and maintenance records: checklist answers, inspection dates, inspector names, results, running notes and safety restrictions.
• Incident reports: descriptions, dates, locations, actions taken and details of identifiable individuals where entered. These may include sensitive information.
• Service communications and security information: invitation and notification records and information needed to maintain secure access and operation.

Railway administrators and users should enter only information necessary for legitimate railway administration, safety and record-keeping purposes.

3. How information is used

Information is used to provide and secure user accounts, restrict access to the correct railway site, maintain rolling-stock and inspection histories, manage safety warnings and incident records, send configured service notifications, support users and operate the service.

Lawful bases: the applicable UK GDPR lawful basis for each processing purpose has not yet been fully documented and must be confirmed before final publication. Where special-category personal information is processed, any required additional condition must also be identified.

4. Who may access information?

Access is controlled through user roles and railway-site membership. Authorised users of a railway can access records permitted by their role. Authorised Ride on Railways Ltd administrators may access records where necessary to administer, maintain, secure or support the service.

Hosting and email-service providers may process information in providing the service. Their identities, contractual safeguards, processing locations and any international transfer arrangements must be verified.

5. Security and cookies

RailStock Register uses authenticated sessions and access controls to help protect railway records. No online service can guarantee absolute security. Users should keep passwords confidential and report suspected unauthorised access promptly.

The service uses an essential session cookie to maintain secure sign-in. See the Cookie Notice for further information.

6. How long information is kept

Under the proposed closure policy, after a railway organisation's RailStock account closes, its records would normally be retained for up to 12 months and then securely deleted or anonymised, subject to legal obligations, legal claims and justified exceptions. Earlier deletion may be requested where appropriate.

This policy is not yet confirmed as fully implemented. Retention periods for other records, including account information, notification logs, incidents and backups, and the timing of backup deletion must also be established before final publication.

7. Requesting a copy of railway records

An authorised railway administrator may request a copy of their organisation's records before deletion. The intended format is a ZIP archive containing available railway records, reports and photographs. This is a request-based process; an automated export facility has not yet been implemented.

Identity and authority will be checked, and an appropriate secure delivery method agreed before records are released.

8. Your data protection rights

Under UK data protection law, you may have rights to access or correct your personal information, request erasure or restriction, object to certain processing and, in some circumstances, receive data in a portable format. These rights are not absolute and depend on the processing involved.

Requests about records maintained by a railway organisation may need to be referred to that organisation as the relevant controller. You also have the right to complain to the Information Commissioner's Office (ICO).

9. Contact details

Ride on Railways Ltd
Unit 5, Rear of The Parade (TDi's)
Southend Arterial Road
Romford, RM3 0EX
Email: esales@rideonrailways.co.uk
Telephone: 01708 374468

10. Changes to this notice

This notice will be reviewed as the service develops and when processing arrangements change. A final approved version should include its effective date and review date.

Status: Draft for review — 28 October 2026.