Welshpool & Llanfair Light Railway Privacy Policy

Privacy Policy 

Introduction

This is the first issue of this policy reissued in updated format. 

 

This document sets out the company’s policy on general data protection. 

 

Legal compliance

In the event of a conflict between this policy and applicable legal and regulatory requirements, the applicable legal and regulatory requirements shall be followed. If this procedure creates a higher obligation, it shall be followed providing full compliance with applicable legal and regulatory requirements is also achieved.

 

This policy has been drawn up on the basis of law and guidance including:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018.

 

Scope 

 

Scope 

This policy applies to all persons involved with the Welshpool & Llanfair Light Railway Preservation Co. Ltd. in whatever capacity. 

 

Policy Introduction

 

The Welshpool & Llanfair Light Railway Preservation Company, which runs the Welshpool & Llanfair Light Railway with assistance from its trading subsidiary, W&L Sales Limited, is a charity registered in the UK, charity number 1000378. We take your privacy very seriously and are committed to protecting your personal information.

This policy explains how we may collect and use the information you give us.

You can contact us at:

Data Protection Officer, The Welshpool & Llanfair Light Railway

The Station, Pool Road

Llanfair Caereinion

Powys SY21 0SF

Tel 01938 810441

E-mail info@wllr.org.uk

 

The Welshpool & Llanfair Light Railway’s promise

• We will always store your personal details securely
• We will only hold your information for as long as necessary
• We will tell you how we are using information about you; and when you ask us to stop using your data, we will do so promptly
• We will only contact you in the ways you wish, using what you have told us to help communicate better with you
•  

This policy includes:

• How we collect information
• What personal information we collect 
• How we use your personal information
• What we do to keep your information safe and who has access to it 
• How we keep your information up to date
• How long we keep your information for
• Your right to your information

 

1. How we collect information

We collect information you provide when you:

·        Book travel tickets online with us 

·        Book to join one of our special events

·        Become a member of our railway

·        Donate to us

·        Telephone us, e-mail us, text us or visit our website and enquire about our activities

·        Post content on our social media sites  

·        Sign up to receive updates on the railway and our activities

·        Participate in a customer survey with us and provide us with information about you

 

We may also receive information about you from third-parties; but only if you have given them permission to share your information. Examples of this are if you post about the railway on Facebook, Twitter or other social media services. You can refer to the Privacy Policy of these organisations to understand how they might share information with the Welshpool & Llanfair Light Railway.

 

Our use of cookies

 Cookies are small pieces of information sent by a web server to a web browser, which enable the server to collect information from the browser. The cookie then sits as a small text file on your computer’s hard drive and identifies you to the web server when you return to that website in the future. For Welshpool & Llanfair Light Railway websites, like most websites, this helps us serve you better by already knowing which pages you have seen before and interest you.   

 

2.                What personal information we collect

The type and quantity of information we collect and how we use it depends on why you have provided it. Some information is legally required, notably details to support a Gift Aid claim. 

 

Most personal information you provide to The Welshpool & Llanfair Light Railway is collected because you have purchased a service from us or have consented for The Welshpool & Llanfair Light Railway to have this information. It enables The Welshpool & Llanfair Light Railway to better serve you as a customer, to thank you for your support as a donor or member and to communicate with you about activities at the railway which you may find of interest. 

 

If you are a customer, member, donor or ask to be kept informed of activities at The Welshpool & Llanfair Light Railway, we will collect where relevant:

·        Your full name

·        Your contact details, namely full address, phone numbers, e-mail

·        Your contact preferences

·        Your date of birth

·        Your dietary and mobility requirements where this is relevant to the catering we provide to you or to you being able to access and enjoy the railway, its trains and buildings 

·        Your credit card details (only until we have been able to process the transaction)

·        Details of specific areas of The Welshpool & Llanfair Light Railway’s activities that you are interested in

 

Children’s data

We do not actively collect information from children under 16. If we have supporters who are under 16, we will ask a parent or guardian for consent to collect information about children.

 

3.                How we use your personal information

We use your personal information in a number of ways, including:

·        To administer your booking to visit the railway and join activities here

·        To administer your donation, including Gift Aid processing

·        To update you about our upcoming activities, events and development projects

·        To invite you to participate in voluntary surveys 

·        To maintain our organisational records and ensure that we have the most up to date preferences on how you wish us to contact you

·        To analyse and improve our website and social media services

·        To analyse your website behaviour

·        To help us work with third parties to ensure we send you targeted communications that are in accordance with the consents you have given

 

4.                What we do to keep your information safe and who has access to it 

We place great importance on the security of your personal information and will always try to take appropriate precautions to protect it. 

 

We establish our website(s) with the industry-recommended security features and carry out regular security reviews and investigations of any potential breaches. 

We ensure that only authorised Welshpool & Llanfair Light Railway staff and contractors have access to your information and that they are appropriately trained to manage your data.

 

Despite all our precautions, no data can be guaranteed to be 100% secure. While we strive to protect your personal information, we cannot guarantee the security of information you disclose to us online, and you must understand that you do so at your own risk. However, any payment card details entered into our website are passed securely and directly to our payment processing providers who meet Payment Card Industry (PCI) security standards. 

 

We do use external organisations to process personal data on our behalf. When engaging a contractor company we check that they meet all relevant regulations and registrations. We also include in the contract the data protection obligations to give maximum protection of your personal information.  If the company processing the data is transferring, processing and storing your personal information outside the European Economic Area (EEA), we will take steps to provide suitable further measures to secure your personal information, such as entering into European Commission approved standard contractual clauses.

 

We may legally be required to disclose your personal information to the police or for other regulatory reasons in certain circumstances. In other circumstances, we will only ever share your personal information if we have your consent to do so. 

 

5.                How we keep your information up to date

We aim to be in contact with our members at least once a quarter and at least once a year with visitors who ask to be kept informed. We will update any changes notified to us promptly. 

You can write to us, e-mail us or call us with any changes.

From time to time, we may use databases such as the Post Office’s National Change of Address register to update our records.  

 

6.                How long we keep your information for

We will hold your personal information on our database on our systems for as long as is necessary for the relevant activity. For instance, we will keep a record of Gift Aid donations you have made for at least six years.  When memberships lapse we will usually retain your record for five years, as lapsed members do often return to membership later. If you ask us to remove your records sooner, we will do so.

If you ask us to stop sending you marketing materials and newsletters, we will keep a record of your contact details and preferences to enable us to comply with the request not to contact you.

 

7.                Your right to your information

We collect and store your personal information so that The Welshpool & Llanfair Light Railway can communicate with our regular visitors and supporters.

 

Although in most cases we will seek consent to process your personal information, we may in some instances process your information without consent when we are legally allowed to do so. This will only be where it is in our legitimate interests to do so and where we are confident that this processing is not likely to prejudice your legitimate interests or rights and freedoms.

 

Where we are processing your personal information based on consent that you have given us, you are entitled to withdraw that consent. You have the right to ask us to stop processing your personal information at any time, subject to us having a legal obligation to retain certain information, for instance for audit.

 

You have the right to request a copy of the information we hold about you, a Subject Access Request (SAR). Our contact details are at the top of this privacy policy.

If the information is incorrect or you disagree with it, you have the right to ask us to correct it or erase it. We will promptly correct any inaccuracies and discuss with you any other changes you request.

 

For more information on these rights please read the relevant guidance issued by the Information Commissioner’s Office (ICO) at: 

 https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/

 

If you would like to make a complaint about how we process your personal data, please contact our Data Protection Officer, details above.

 

If you are not satisfied with how your complaint is dealt with, you should contact the Information Commissioner’s Office (www.ico.org.uk). Alternatively, you are entitled to make a complaint to the Information Commissioner’s Office without first referring your complaint to us.  

 

DigiTickets Privacy Policy

Policy Owner

This policy is owned and distributed by IT and Compliance manager of Digital Ticketing Systems Limited

Who we are

In this Privacy Policy, references to "we", "us", and "our"" are to Digital Ticketing Systems Limited (Company number 07044584). References to "our Website" or "the Website" are to *.digitickets.co.uk.

Digital Ticketing Systems Limited is the data controller responsible for the personal information collected through this Website.

Information We Collect

We may collect and process the following categories of personal information:

Information You Provide Directly

When you contact us, make a purchase, register for services, or complete forms on our Website, we may collect information such as:

• Name
• Postal address
• Email address
• Telephone number
• Purchase and booking information
• Any other information voluntarily provided by you

Payment Information

Payments made through our Website are processed by authorised payment service providers. We do not store your full credit or debit card details on our systems.

Our payment providers may process payment information and carry out fraud prevention and verification checks. Where international transfers are required, appropriate safeguards will be applied in accordance with applicable data protection laws.

Digital Ticketing Systems is PCI DSS v4.0.1 compliant and are annually assessed/certified.

Website Usage Information

When you visit our Website, we may automatically collect:

• IP address
• Browser type and version
• Device information
• Screen resolution
• Operating system
• Referral source
• Pages visited and actions taken on the Website
• Date and time of access

Marketing Preferences

If you choose to receive marketing communications, we will record your preferences and any interactions with our emails, including whether emails are opened or links are clicked.

Cookies and Similar Technologies

We use cookies and similar technologies to operate our Website, remember your preferences, analyse usage, and improve user experience. Further information is provided in our Cookie Policy below.

How We Use Your Information

We process personal information for the following purposes:

• To provide products and services you request
• To process transactions and fulfil orders
• To provide customer support and after-sales services
• To manage bookings and accounts
• To improve our Website, products, and services
• To ensure Website security and prevent fraud
• To comply with legal and regulatory obligations
• To send marketing communications where we have your consent or another lawful basis to do so

Lawful Basis for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

• Performance of a contract: to provide goods or services you have requested.
• Legal obligation: where processing is necessary to comply with legal requirements.
• Legitimate interests: to manage and improve our business, Website security, and customer experience.
• Consent: where required, including for certain cookies and marketing communications.

Where we rely on consent, you may withdraw it at any time.

Sharing Your Information

We may share your personal information with:

• Payment processors
• Hosting and IT service providers
• Delivery and fulfilment partners
• Marketing and communications providers
• Analytics and Website performance providers
• Professional advisers and auditors
• Regulatory authorities, law enforcement agencies, or courts where required by law

All third-party service providers are required to process personal information only on our instructions and in accordance with applicable data protection laws.

We do not sell personal information to third parties.

International Transfers

Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place, such as:

• Transfers to countries deemed to provide an adequate level of protection; or
• Approved contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, regulatory, and reporting requirements.

Retention periods vary depending on the type of information and the purpose for which it is processed.

Cookie Policy

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly, remember preferences, improve performance, and provide analytics information.

How We Use Cookies

We use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of the Website and cannot be disabled through our cookie management tools.

Cookie	Purpose	Duration
PHPSESSID	Maintains user session and shopping basket functionality	Session / 24 minutes
dtAnalyticsConsent	Records cookie consent preferences	1 year

Analytics Cookies

These cookies help us understand how visitors interact with the Website so that we can improve performance and usability.

These cookies are only placed with your consent.

Google Analytics

Examples include:

• _ga
• _ga<container-id>
• _gid
• _gat_<tracker-name>

Used to collect aggregated statistical information about Website usage.

Google Privacy Information:

https://support.google.com/analytics/answer/6004245

Microsoft Clarity

Examples include:

• _clck
• _clsk
• CLID
• ANONCHK
• MR
• MUID
• SM

Used to analyse user interactions and improve Website usability.

Microsoft Clarity Information:

• https://clarity.microsoft.com/blog/cookies-in-clarity/
• https://learn.microsoft.com/en-us/clarity/

Performance Monitoring Cookies

Performance monitoring tools help us identify technical issues and improve Website reliability.

Examples may include cookies used by services such as New Relic.

Managing Cookies

When you first visit our Website, you will be presented with a cookie banner allowing you to:

• Accept all cookies
• Reject non-essential cookies
• Choose your cookie preferences

You may change your preferences at any time through our cookie settings tool.

You can also manage cookies through your browser settings. Disabling certain cookies may affect Website functionality.

Your Data Protection Rights

Under UK GDPR, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Restrict processing
• Object to processing
• Request portability of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO)

For more information about your rights, visit:

https://ico.org.uk/

Automated Decision-Making

We do not generally make decisions producing legal or similarly significant effects using solely automated processing.

Where automated tools are used for fraud prevention, security monitoring, or service administration, appropriate safeguards will be applied in accordance with applicable data protection legislation.

Childrens Data

Our Website is not intended to knowingly collect personal information from children unless necessary to provide services requested by a parent, guardian, school, attraction, venue, or authorised organisation.

Where we process children's personal information, we take additional care to ensure appropriate protections are in place.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

Digital Ticketing Systems (t/a DigiTickets)

Sentio House, Pynes Hill, Exeter, Devon, EX2 5AZ

www.digitickets.co.uk/compliance-request

If you have concerns about how we use your personal information, you may submit a privacy complaint to us using the contact details above.

We will acknowledge your complaint and investigate it in accordance with applicable data protection legislation. We aim to respond without undue delay and within the timescales required by law.

If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

Other Websites

This Privacy Policy applies only to this Website. Links to third-party websites are provided for convenience only. We are not responsible for the privacy practices of those websites, and we encourage you to review their privacy policies before providing any personal information.

Last Updated: 5 August 2026