Privacy Policy
Who we are
ATOC Ltd brings together the companies that run Britain’s railway into a single team. ATOC Ltd is the data controller for all the personal data that you provide. ATOC Ltd.’s address is 200 Aldersgate Street, London EC1A 4HD. ATOC Ltd also trades under the name Rail Delivery Group.
The purpose of this policy is to make you aware of how we will manage your personal data.
Our lawful basis for collecting your data
We collect personal data so that your organisation can apply for a rail warrant account or rail warrant season ticket account. Therefore, collecting your data is necessary for us to perform our service to you. We will treat your data in an appropriate and lawful manner, in accordance with data protection laws.
What data we collect
For all rail warrant account or rail warrant season ticket account applications we collect your name, organisation name, organisation address, organisation email address and organisation contact number.
We use cookies and similar tools across our website to improve your experience and our website's performance. To find out more about cookies, read our Cookie Policy.
Sharing information with other data processors
To fulfil your request, we use suppliers to enable your organisation to open and administer your account.
We work with the following suppliers to provide and support your account:
• Quietstorm (Website content management system)
• Worldline (Account admin/invoicing supplier)
We also share information with law enforcement agencies when required.
Your personal information may be disclosed to the train companies who accept warrants on their services in order for them to administer and support your use of the account.
We will not share your details with any other parties.
Keeping it safe
We protect your privacy by ensuring we have the appropriate security measures in place.
We ensure that our suppliers process your data in an appropriate, lawful and safe manner, and your data stays within the EU.
What we do with your data
We use your data to provide a contact detail on our records for invoicing or general contact purposes.
We also use your data in order to contact you for operational issues.
How long do we keep your data?
When the warrant account is closed all organisation and personal data will be destroyed within one year of the account being fully closed.
Subject access request
You have the right to request that we give you a copy of the data we hold about you. This is called a ‘Subject Access Request’.
Right to deletion
You have the right to request that we delete any data that we hold for you if you no longer work for the organisation that holds the warrant account or season ticket warrant account.
Right to restrict processing
You have the right to request that we restrict processing of your information:
• if you believe the information that we hold is incorrect, or
• if you can show that our processing is unlawful, or
• if you want us to stop processing your data but you do not want us to erase it (for example, you may wish us to hold it for legal reasons, to defend a legal claim).
Right to rectification
If your details are incorrect, incomplete or have changed, you can update them by logging into the website, going to the Compliance Form and updating them.
Alternatively, use the Contact Us link to correct or complete the data for you.
To exercise any of your rights, please contact:
The Data Protection Lead
ATOC Ltd, 200 Aldersgate Street, London EC1 4HD.
Tel: 0207 841 8000.
Email: warrantprivacy@raildeliverygroup.com
Right to complain
You have the right to complain about our processing to the Information Commissioner if you believe we are not processing your data in a proper manner.
https://ico.org.uk/concerns/handling/