Website Privacy Policy
Who we are
ATOC Ltd brings together the companies that run Britain’s railway into a single team. ATOC Ltd is the data controller for all the personal data that you provide. ATOC Ltd.’s address is 200 Aldersgate Street, London EC1A 4HD. ATOC Ltd also trades under the name Rail Delivery Group.
The purpose of this policy is to make you aware of how we will manage your personal data.
Our lawful basis for collecting your data
We collect personal data so that you can register as a user on the website, access the Knowledgebase, and register and take rail exams. Therefore, collecting your data is necessary for us to perform our service for you. We will treat your data in an appropriate and lawful manner, in accordance with data protection laws.
What data we collect
For all website registrations and survey requests (surveys administered by Survey Monkey), we collect your name, organisation name, organisation address, organisation email address and organisation contact number.
We may also collect your personal address should you wish to use this as the billing address when registering and making payment for Certificate of Rail Agent Competency (CORAC) exams.
We use cookies and similar tools across our website to improve your experience and our website's performance. To find out more about cookies, read our Cookie Policy.
Sharing information with other data processors
To fulfil your request, we use suppliers to enable your user account and produce, deliver and administer your CORAC exams. You may also be asked if you like to participate in taking a survey regarding the CORAC exams.
We work with the following suppliers to provide and support you with your user account and exams and to collect survey information:
- Quietstorm (Website content management system)
- Survey Monkey (Survey providers)
We also share information with law enforcement agencies when required.
We will not share your details with any other parties.
Keeping it safe
We protect your privacy by ensuring we have the appropriate security measures in place.
We ensure that our suppliers process your data in an appropriate, lawful and safe manner, and that your data stays within the EU.
However, if you participate in a survey with us your survey responses will be processed by Survey Monkey in the United States under an EU approved data protection framework.
What we do with your data
We use your data to provide you access to the website, including registering for rail exams and access to Knowledgebase.
We also use your data in order to contact you for operational issues.
How long do we keep your data?
When you register as a user on the website, your user record is assigned to the travel agency/Travel Managment Company (TMC) you are part of.
If you leave the travel agency/TMC, the travel agency/TMC must amend your record to indicate you are no longer there.
Records of individuals that are no longer part of a travel agency/TMC will be deleted on an annual basis, except where the individual holds or previously held a CORAC qualification. If you have a CORAC qualification record then your details will be retained indefinitely should you wish to take a renewal exam in the future.
Subject access request
You have the right to request that we give you a copy of the data we hold about you. This is called a ‘Subject Access Request’.
Right to deletion
You have the right to request that we delete any data that we hold for you if you no longer work for your agency/TMC or any other agency/TMC.
Right to restrict processing
You have the right to request that we restrict processing of your information:
• if you believe the information that we hold is incorrect, or
• if you can show that our processing is unlawful, or
• if you want us to stop processing your data but you do not want us to erase it (for example, you may wish us to hold it for legal reasons, to defend a legal claim).
Right to rectification
If your details are incorrect, incomplete or have changed, you can update them by logging into the website, going to the Compliance Form and updating them.
Alternatively, use the Contact Us link to ask us to correct or complete the data for you.
To exercise any of your rights, please contact:
The Data Protection Lead
ATOC Ltd, 200 Aldersgate Street, London EC1 4HD.
Email: TAprivacy@raildeliverygroup.com
Right to complain
You have the right to complain about our processing to the Information Commissioner if you believe we are not processing your data in a proper manner.
https://ico.org.uk/concerns/handling/
May 2018