Privacy Policy & Cookies

Spa Valley Railway

Who are we?
The Spa Valley Railway recognises that your privacy is important, and we are committed to protecting the Personal Data that we collect from you. The Spa Valley Railway is owned and operated by the Wealden Railway Company Limited (Registered company 1936470). In this Privacy Policy, Wealden Railway Company Limited is referred to as "SVR", Spa Valley Railway", "WCR", "SpVR", "we", "our" and "us" and who is for the purpose of GDPR we are the Data Controller and can be contacted by email at or by post by writting to West Station, Nevill Terrace, Royal Tunbridge Wells, Kent, TN2 5QY.

Personal Data is managed in accordance with the General Data Protection Regulations (GDPR).

The Spa Valley Railway will never sell your Personal Data, or otherwise use your data for the benefit of outside parties. We do not use your Personal Data for automated decision making, profiling, screening or other similar processes. We will only use your data for purposes reasonably required in the ordinary course of Spa Valley Railway activity such as bookings or contacting a customer relating to a booking. This Privacy Policy outlines the types of Personal Data that we may collect, how that Personal Data will be used, disclosed, transferred and stored, and sets out the measures that we take to comply with the above Acts and Regulations.

Collecting Personal Data
The Spa Valley Railway will only collect and hold Personal Data about you that is reasonably necessary to undertake our normal activities, bookings and functions, or as otherwise permitted by law. 

Why we collect Personal Data
We may collect your Personal Data for one or more of the reasons outlined below. We will use Legitimate Interest as the legal basis for so doing, excepting where under GDPR we are required to seek your express consent.

  • Providing our membership services to you including newsletters, and information about events.
  • To assist with your enquiries.
  • Processing a booking or application that you have made via our website provider and booking system vTicket, which is owned and operated by Wilson Digital.
  • For appropriate surveys, direct marketing, promotions or competitions.
  • Facilitating our internal operations including the fulfilment of any legal or regulatory requirements.
  • Analysing our services and member/ customer needs with a view to developing new and/or improved products and services.
  • For Spa Valley Railway volunteers, contractors and suppliers, as is reasonably and/or legally necessary.
  • For us to be able to contact you by email, post or by MailChimp regarding your bookings, transactions or contracts you enter into us with.

How we collect your Personal Data
We generally collect Personal Data directly from you, through the use of any of our standard forms, over the internet, via email or through a telephone conversation with you. As part of booking process’ on this website information is collected online and used within vTicket by our website provider Wilson Digital.

We may also collect Personal Data from third party contractors or agents who provide our products and services on our behalf.

What kinds of Personal Data we collect:
You are under no legal obligation to provide your Personal Data. If however you do not provide us with your personal data it may affect our ability to offer you our products and services.

The types of Personal Data that we collect may include:

  • Your name & job title
  • Contact information such as postal address
  • Email address
  • Social media 
  • Phone number
  • Other contact details and relevant information that allows us to provide our products and services to you in the manner that you have requested, or to comply with the law.

We do not generally collect sensitive information from you. However, if you provide such information to us, we will only collect that information with your express consent and only where such information is reasonably required in order for us to provide our products or services to you (such as special access or an assistance requirement due to a health condition).

We do not store credit card details. We will only provide such Personal Data to those third parties as required to provide our products, sorting or services. 

We shall not disclose sensitive data to any other party beyond necessary third-party contractors or agents without your consent.  We will hold your Personal Data as current for up to 2 years after its last active use or to legally required timescales (whichever is the longer), after which your Personal Data will be archived and not used or maintained, unless you contact us further. We will only hold your personal data with your explicit permission, if we are informed that you have withdrawn this consent then we will only keep your personal data for the period required to complete any transaction that we have legitimate interest with.

How your data is held and processed
Your personal details are stored on a secure booking system called ‘vTicket’ provided by Wilson Digital. Any paper documents you have completed, and any correspondence are held in a secure environment. We process your data only to contact you on products, experiences, bookings you have made, matters of interest relating to the Spa Valley Railway such as events. Your data is not subject to any processing which includes automated decision making.

Our online payment portal is provided by PayPal. 

Your Rights

  • You can ask for a copy of the information we hold about you and have it corrected if it is wrong.
  • You have the right to ask us to delete any personal data we hold about you.
  • You have the right to object to your data being used for specific purposes.

If you have any cause for complaint about our use of your data you should contact us to try to resolve the matter. You have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office, if not satisfied.

How we use cookies
A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. 

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Links to other websites
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

Booking with vTicket