Introduction

Other pages of this website tell you about who we (the Middleton Railway Trust Ltd) are and what we do. In connection with some of our activities we need to store and process some personal data. We want to ensure that we are using your data sensibly and appropriately so that all of our activities, whether they are events or fundraising campaigns, are done as effectively as possible with your best interests at heart.

This privacy statement outlines our commitment to you, and tells you about the data that we need to collect and about how we use it. The collection and use of this data is all in accordance with the Data Protection Act 2018 (which incorporates into UK law the requirements of the EU’s General Data Protection Regulation). We take seriously our responsibilities under this Act and we ensure that the personal information we obtain is stored, used, transferred and processed accordingly.

The Data We Hold

If you make any advance booking for train tickets, such as for our Santa Special or Party trains, then we will store any data relating to your booking, except that we do not store any details of payment cards or bank accounts.
If you contribute to any of our fundraising campaigns, then we will store any data relating to your contribution, and particularly if you allow us to claim Gift Aid on that contribution. Again, though, we do not store any details of payment cards or bank accounts.
If you are a member of the railway then we may need to store other data for operational purposes, as described in the separate privacy statement for members, which is available on our intranet.
Our Moor Road site is equipped with CCTV for security purposes, and data from this system is stored for some days after it has been captured.
No other kinds of personal data relating to members of the general public are stored or processed.

How and Why We Use Your Data

Data collected in connection with any advance booking for train tickets is stored and processed to enable us to administer that booking.
Data collected in connection with any of our fundraising campaigns is stored and processed to enable us to account correctly for donations made, and for any Gift Aid that may be reclaimed.
If you have given your consent to us retaining contact information for marketing or fundraising purposes, then we will store this and may use it to send you information about our activities.
If you are a member of the railway then how and why we may need to use other personal data is described in the separate privacy statement for members, which is available on our intranet.
Data captured by our CCTV system is only used for crime prevention purposes, and so is stored for long enough to ensure that it is available for these purposes if needed. We do from time to time receive requests from West Yorkshire Police to examine the images from our system in relation to possible crimes committed on Moor Road. Thereafter the data is deleted.

We may use third-party partners to support the activities described above. If you interact with us through a third party (for example, buying tickets through our online ticket agent, or supporting us through JustGiving) then we may obtain information from them, but only if you have given them your explicit consent. The receipt of data by us in this manner is subject to the third party’s own privacy policy and the data obtained is bound by the terms of this privacy statement as soon as it is received by us.

We may use tools to help us monitor and improve the effectiveness of our communications with you, including tracking whether any emails that we send are opened and which links are clicked within an email message. We may monitor visits to our website and use tools such as Google Analytics to improve our website and services.

Electronic Devices and Cookies

A separate statement explains that we may from time to time place a “Cookie” on your electronic device when you access our website. You can control this through security and privacy options on your specific device.

Protecting Your Data

We are committed to holding your data securely and treating it with sensitivity. All data is held securely in accordance with the Data Protection Act 2018. Where it is held in any database this will be hosted on a secure private computer that is only accessible to our responsible senior managers. Where communications are sent out by email this may be done by a third party provider, but personal data such as the email addresses are not passed to them.

We will not disclose your data to individuals, organisations or other external entities unless we are required to do so by law or by order of a court.

We Do Not Sell Data To or Trade Data With Any Other Organisations

Although most of the information we store and process stays within the UK, some information may be transferred to other countries in an encrypted form to a secure backup facility. We may also hold data for individuals who reside outside of the European Economic Area (EEA) and where these countries do not have similar data protection laws to the UK, we will ensure we provide an adequate level of protection in accordance with UK data protection law.

Your Rights

We will always try to ensure that the data we hold for you is up to date, reasonable and not excessive. You will always have the right to:

request a copy of the data we hold about you;
update or amend the information we hold about you;
ask us to remove your personal information from our records; or
object to the processing of your information for any of the purposes outlined above.

For any of these purposes you may contact us at the email address <This email address is being protected from spambots. You need JavaScript enabled to view it.>. This email address may also be used by members who do not have access to our intranet if they wish to request a copy of the privacy statement for members that is referred to above.

If our information practices need to change some time in the future, for instance to collect additional data and/or use data for new purposes that are not currently described in this statement, then we will publish the policy changes here.

Revised June 2018