Inspiration: The Railway 200 Exhibition Train Privacy Policy
This Data Privacy Notice outlines how the Railway 200 collects, use, and safeguard any personal information you provide. It is necessary to collect certain personal data which is held in compliance with the Data Protection Legislation. Railway 200 is committed to ensuring that your privacy is protected in compliance with applicable data protection laws.
The Railway 200 may change this policy from time to time by updating this page. You should check this page from time to time to ensure that you are happy with any changes.
The Data Protection law has been made to ensure that we keep your information safe. Railway 200 take your right to privacy seriously and want you to feel comfortable with the information you give us. This privacy notice explains everything you need to know about your rights and choices in relation to your personal information.
Who is responsible for the personal information that we collect?
Railway 200 is responsible, and we act as the data controller (the company in charge of the data we collect) for data protection law purposes. We are responsible for the personal information you give to us. All station staff are required to read, understand, and comply with all policies and procedures related to the handling of personal data during the Railway 200 exhibition.
This policy is effective from 1st March 2025.
The data we hold
The Railway 200 holds:
Full Name
Email Address
Number of Tickets Reserved
Disability Profile
Age Group
Postcode (First 3 digits of your postcode)/Location
Demographic information for the post event survey relating to protected characteristics as defined by the Equality Act 2010; age, sex, ethnicity, religion and belief, health or disability, pregnancy and maternity, sexuality, gender identity, marital status.
Full Name
Email Address
Number of Tickets Reserved
Disability Profile
Age Group
Postcode (First 3 digits of your postcode)/Location
Demographic information for the post event survey relating to protected characteristics as defined by the Equality Act 2010; age, sex, ethnicity, religion and belief, health or disability, pregnancy and maternity, sexuality, gender identity, marital status.
What we do with the information we gather from tickets
1. Railway 200 will record the personal information provided in your ticket registration via Merlinsoft a secure system and use it solely to manage and facilitate your visit to the exhibition train.
2. Full names are collected to verify attendees' identities and ensure that ticket holders can access the train.
3. Email addresses are used to send confirmations, updates, reminders, event communications, and post event survey.
4. All ticket holders have a right to ask for a copy of their information and to correct any inaccuracies.
5. For any safety or security emergency situations where a roll call would be required and/or a first aider/emergency services need to be aware of your condition.
6. Your contact details will not be shared with third parties, and all data will be retained for a maximum of 8 weeks once the exhibition has taken place.
7. Railway 200 collect the number of tickets reserved to effectively manage event capacity.
8. Railway 200 collect information on accessibility needs to ensure the station requirements are met and to facilitate ramp access to the train.
9. We collect information such as age group and postcode/location to help us understand who is engaging with our events and activities. This data allows us to:
- • Assess regional reach – by analysing postcodes, we can identify which areas are being engaged and whether we are reaching a wide geographic audience.
- • Measure social value and inclusivity – age group data helps us understand the diversity of our audience and assess how well we are engaging different demographic groups.
- • Inform future planning – insights from this data help us improve accessibility, tailor content, and ensure our events have a meaningful impact across various communities.
All data is used solely for reporting and improvement purposes.
10. If an attendee decides to cancel their ticket(s), all associated personal information will be deleted from all retrieval systems (electronic and hard copy) within 24 hours of the cancellation submission.
11. If you do not wish to receive such information or amend your preferences, you can inform Railway 200 at any time by email at railway200@gbrtt.co.uk.
Our data policies
Our policies on the holding of data about the attendee are:
• Railway 200 only retain the data provided by attendees to facilitate their exhibition visit and any necessary post-visit communications.
• Railway 200 do not hold any other data about the attendees.
• Railway 200 will not share our attendees’ data with any third party.
• Railway 200 use our attendees’ data only for the purposes for which they have given it to us.
• Access to stations and private sites CCTV footage is restricted to authorised personnel and will be used solely for safety purposes. Any disclosures of CCTV footage to third parties will be documented and comply with data protection laws.
How we store data
Access to our members’ data is limited to those officers of Railway 200 who need to facilitate the ticketing process and communications.
Post Visit Survey
Railway 200 will undertake a survey to collect feedback from visitors, schools, and volunteers, aiming to evaluate the impact of the exhibition train. Your participation in this study is entirely voluntary. Railway 200 will collect responses to these surveys. All parties have taken every precaution to ensure the privacy and security of your data during the survey.
Railway 200 will only collect and use personal data in accordance with this notice to the extent deemed reasonably necessary to serve our legitimate business purposes, and we will maintain appropriate safeguards to ensure the security, integrity, accuracy and privacy of the data you have provided.
At no time will the data you provide be used for any purpose other than research and you will in no way be adversely affected by taking part. It is not our aim to sell or promote anything. This is a post event research survey using scientific methods and we commit, in obtaining your co-operation, not to mislead you about the nature of the research or how the findings will be used.
As part of this survey, we will ask about your age, gender, working status, postcode, sexual orientation, ethnicity, transport usage, origin and destination station, and about any disabilities you may have. You do not have to provide this data if you do not want to, although it is very helpful when we analyse the responses to help us inform of improvements needed.
What we do with the information we gather from surveys
1. We need your postcode so that we can understand how far you have to travel to the station, how long it might take to travel there, and to group you with others in your local area to help us understand the people who travel in more detail.
2. We need your demographic data to be able to analyse survey responses using these characteristics. This helps us understand if some communities have better experiences than others, and ensure there is no discrimination in the service we offer.
3. We need data on your disability to be able to analyse survey responses for different disabled groups, and understand what we can do to improve the experience of these groups specifically
4. Historical data will be kept to monitor performance over time, and to allow a greater understanding of the influences on the exhibition train
Our lawful basis
The GBRTT’s lawful basis for processing your data as part of the survey is Article 6(1)(e) of the UK GDPR – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where special category personal data is being processed, a further section of the UK GDPR applies, Article 9(2)(g) – substantial public interest.
The data subject has given consent to the processing of his or her personal data. You can withdraw your consent at any time by contacting railway200@gbrtt.co.uk.
Data sharing
Network Rail Infrastructure Ltd will function as Data Controllers for your personal data and as a key Data Processor.
We have strong security measures in place to prevent your personal data being misused. In addition, we will limit access to your personal data to those employees, within the wider organisations in rail, who have a business need to access this only.
Your responses may be made accessible to wider organisations in rail, including train operating companies, Network Rail, Transport Focus and Rail Delivery Group. With your data, they will be able to identify issues and react quickly to these as they arise; as well as conduct analysis to ensure that the needs and priorities of all rail users are represented, including those with protected characteristics. Anonymised and aggregated data in the form of reporting will also be made available to the general public.
Railway 200 have strong security measures in place to prevent your responses being misused. In addition, we will limit access to your personal data to those employees, within the wider organisations in rail, who have a business need to access this only. We will not transfer your personal data outside of the UK.
Managing your data
Your data will be kept securely by Network Rail Infrastructure Ltd, who will only retain personal identifiable data for the length of time that the research is required for. Email addresses collected as part of the ticket registration will be deleted by Railway 200 & Merlinsoft.
How can I complain or get further information?
Questions, comments and requests during the event should be addressed to railway200@gbrtt.co.uk.
General enquiries are welcomed and should be addressed to the Data Protection Officer at data.protection@networkrail.co.uk.
You have the right to lodge a complaint with the way your data has been handled with the Information Commissioners Office by post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or on their website (https://ico.org.uk)