Spa Valley Railway

Privacy Policy & Cookies

Who are we?
The Spa Valley Railway recognises that your privacy is important, and we are committed to protecting the Personal Data that we collect from you. The Spa Valley Railway is owned and operated by the Wealden Railway Company Limited (Registered company 1936470). In this Privacy Policy, Wealden Railway Company Limited is referred to as "SVR", Spa Valley Railway", "WCR", "SpVR", "we", "our" and "us" and who is for the purpose of GDPR we are the Data Controller and can be contacted by email here or by post by writting to West Station, Nevill Terrace, Royal Tunbridge Wells, Kent, TN2 5QY.

Personal Data is managed in accordance with the General Data Protection Regulations (GDPR).

The Spa Valley Railway will never sell your Personal Data, or otherwise use your data for the benefit of outside parties. We do not use your Personal Data for automated decision making, profiling, screening or other similar processes. We will only use your data for purposes reasonably required in the ordinary course of Spa Valley Railway activity such as bookings or contacting a customer relating to a booking. This Privacy Policy outlines the types of Personal Data that we may collect, how that Personal Data will be used, disclosed, transferred and stored, and sets out the measures that we take to comply with the above Acts and Regulations.

Collecting Personal Data
The Spa Valley Railway will only collect and hold Personal Data about you that is reasonably necessary to undertake our normal activities, bookings and functions, or as otherwise permitted by law. 

Why we collect Personal Data
We may collect your Personal Data for one or more of the reasons outlined below. We will use Legitimate Interest as the legal basis for so doing, excepting where under GDPR we are required to seek your express consent.

How we collect your Personal Data
We generally collect Personal Data directly from you, through the use of any of our standard forms, over the internet, via email or through a telephone conversation with you. As part of booking process’ on this website information is collected online and used within vTicket by our website provider Wilson Digital.

We may also collect Personal Data from third party contractors or agents who provide our products and services on our behalf.

What kinds of Personal Data we collect:
You are under no legal obligation to provide your Personal Data. If however you do not provide us with your personal data it may affect our ability to offer you our products and services.

The types of Personal Data that we collect may include:

We do not generally collect sensitive information from you. However, if you provide such information to us, we will only collect that information with your express consent and only where such information is reasonably required in order for us to provide our products or services to you (such as special access or an assistance requirement due to a health condition).

We do not store credit card details. We will only provide such Personal Data to those third parties as required to provide our products, sorting or services. 

We shall not disclose sensitive data to any other party beyond necessary third-party contractors or agents without your consent.  We will hold your Personal Data as current for up to 2 years after its last active use or to legally required timescales (whichever is the longer), after which your Personal Data will be archived and not used or maintained, unless you contact us further. We will only hold your personal data with your explicit permission, if we are informed that you have withdrawn this consent then we will only keep your personal data for the period required to complete any transaction that we have legitimate interest with.

How your data is held and processed
Your personal details are stored on a secure booking system called ‘vTicket’ provided by Wilson Digital. Any paper documents you have completed, and any correspondence are held in a secure environment. We process your data only to contact you on products, experiences, bookings you have made, matters of interest relating to the Spa Valley Railway such as events. Your data is not subject to any processing which includes automated decision making.

Our online payment portal is provided by PayPal. 

Your Rights

If you have any cause for complaint about our use of your data you should contact us to try to resolve the matter. You have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office, if not satisfied.

How we use cookies
A cookie is a small file which asks permission to be placed on your computer's hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about webpage traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. 

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

Links to other websites
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

CCTV Policy

Description of CCTV Use & Reasons/purposes for processing information
The Wealden Railway Company Ltd. / Spa Valley Railway (SVR) uses CCTV at its stations and elsewhere on trains or the lineside to monitor and collect visual images for the purpose of safety (including the observation of train movements), security and the prevention and detection of crime. Images from wide angle ‘webcam’ cameras at stations may also be made available as internet streams via our website and other partners such as RailCam for promotional purposes. The use of these systems is set out in this policy.

Nature of work – Transportation, Heritage, Leisure
The use of CCTV will be notified to the Information Commissioner and such notification will be renewed annually. The continuing requirement for CCTV will be assessed annually by the SVR Leadership Team at which time this policy will also be reviewed. The use of CCTV by the SVR will comply with the SVR’s data protection policy.

Person Responsible
The CCTV systems used by the SVR are the responsibility of the SVR’s Telecommunications Manager. At the current time this is Mark Patrick. The systems are managed and owned by the SVR and third party services are not used for the provision of recording and monitoring.

System Setup & Camera Positioning
The systems used are chosen to produce clear images.  Cameras are sited such that they primarily only cover private land on SVR premises but some peripheral capture of public areas (e.g. just beyond the entrance gate) is unavoidable. The systems will not record audio.

Monitoring of Live Images
Monitor screens are provided in staff areas such as Booking Office and the Signal Box. These monitors are arranged such that members of the public cannot see them from normally accessible positions.

Remote access to live streaming of images from the systems is possible but access is limited to members of the SVR Leadership Team and also to the Telecommunications team for the purposes of system support. A strong password is required for access.

Image Storage & Security
Images from the cameras are securely stored and access is only possible by members of the SVR Leadership Team. Where applicable systems will be password protected. Where systems permit remote access via the internet, this will be secured with a strong password and details will only be made available to members of the SVR Leadership Team.

Images will not be retained for a period exceeding 4 weeks. The exact storage period depends on system capability at each location and will vary.

Access to Recorded Images
The SVR Leadership Team may view images to assess and evaluate an incident. Such use of the system will require authorisation from the Telecommunications Manager along with at least one other member of the Leadership Team and will be done privately.

Any access to the system will be noted in the CCTV logbook held at Tunbridge Wells West Station stating the data and time access was made, the period of time being accessed, who access was authorised by, who undertook the access and details of any recordings extracted and who they were passed to, if applicable.

Any request for access to the images should be made to the Telecommunications Manager in writing. They will consider the impact of such a request and act on it accordingly, taking into account the possible impact on the SVR or any individuals concerned.

Images containing identifiable personal images will not be published online or be sent to the media.

Images obtained from the CCTV systems will not be made available to third parties. The only exceptions are as follows:

All locations where CCTV is in use will display signage to clearly indicate this to customers, volunteers and visitors.

As the primary purpose of the CCTV systems is for safety and security, any wilful damage to them will be treated seriously. This includes adjusting the angle of cameras or covering them without the consent of the S&T team. Where this damage is by a member of staff or a volunteer, disciplinary action will be taken as appropriate.

Accidental damage to the systems should always be reported to the S&T team for repair.