Privacy & Data Policy

This Privacy & Data Policy explains how Roundhouse Relay — England Transport Museums (“we”, “us”, “our”) collects, uses, and protects your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Controller Details

Roundhouse Relay — England Transport Museums
17 Station Rise, York YO24 1AB, England
Phone 441 904 812 673 Email [email protected]

2. Personal Data We Collect

Basic contact information (name, email, phone) submitted through our booking or enquiry forms.
Non-identifiable analytics data such as browser type, device, and session duration collected via cookies.
Correspondence records when you email or call us.

3. Purpose and Lawful Basis

We process personal data to manage bookings, respond to enquiries, and comply with legal obligations. Our lawful bases include “contract” (when you request a booking), “legitimate interest” (for site analytics), and “consent” (for optional marketing emails, if offered).

4. Cookies and Analytics

We use essential cookies for form security and aggregated analytics via privacy-friendly metrics. Details appear in our Cookie Choices page.

5. Data Storage and Security

All personal data is stored on secure UK-based servers with encryption at rest. Access is restricted to authorised staff who require it for operational reasons. We employ HTTPS/TLS 1.3 for transmission security.

6. Data Retention

Contact and booking data are retained for up to 24 months after your visit unless required longer for financial or legal compliance. After that period, data is securely erased.

7. Your Rights Under UK GDPR

Access — Request a copy of your data.
Rectification — Correct inaccurate or incomplete data.
Erasure — Request deletion where lawful.
Restriction — Limit processing in specific cases.
Data Portability — Receive data in a structured, machine-readable format.
Objection — Object to processing based on legitimate interest.
Withdraw Consent — At any time, where processing relies on consent.

8. Third-Party Access

We do not sell or rent data. Limited third-party access may occur for secure email delivery, web hosting, or legal compliance, all under contract ensuring equivalent protection.

9. International Transfers

Your data remains within the UK and EEA regions. If transfer outside EEA becomes necessary, we apply UK International Data Transfer Addendum (IDTA) safeguards.

10. Children’s Information

Our site is designed for general audiences and is not intended for users under 16. Any data from minors received inadvertently is deleted upon discovery.

11. Complaints

If you believe your data has been mishandled, contact us first at [email protected]. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk.

12. Policy Updates

This policy was last reviewed in October 2025 and may be updated periodically. Major changes will be announced on this website.