Privacy Notice

Privacy Notice

Purpose of this Privacy Notice

Dispute Resolution Ombudsman, trading as the Rail Ombudsman, respects your privacy and is committed to protecting your personal data. This Privacy Notice tells you what to expect when we process your personal data, or personal information, when you visit our website, when you call us by telephone, or contact us via another channel and/or when you complete an Application Form to start a complaint. It tells you about your privacy rights, how the law protects you, the purposes for which we may process your personal information and the legal basis for the processing (‘processing’ includes us just keeping your personal information).

It is important that you read this Privacy Notice so that you are fully aware of how and why we are using your personal data.

All your personal data will be held and used in accordance with the data protection rules and regulations currently in force [1] (‘ Data Protection Law’). These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal data must be collected lawfully and used fairly, stored safely and not disclosed unlawfully.

Identity and contact details of Controller

Dispute Resolution Ombudsman , trading as the Rail Ombudsman, is the controller of personal data for the purposes of the Data Protection Law and is responsible for the protection of your personal data.

Our contact details for data protection purposes are as follows:

Dominique Marshall, Head of Process, Quality & Risk

Rail Ombudsman, Premier House, 5 Argyle Way, Stevenage, SG1 2AD
Tel: 0330 094 0362
Email: info@railombudsman.org

The data we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymised data).

We may collect, use, store and transfer different kinds of personal data about you which we have listed as follows:

  • title, forename(s), surname;
  • address, email address and telephone contact details;
  • personal details of a third party representative;
  • reference number;
  • complaint details which may contain personal identifiers;
  • photographic or video evidence provided;
  • regular commute.

Some personal information that is collected is treated as more sensitive (referred to as ‘special categories of personal data’[2], for example, information about health, sexuality, ethnic background and others).

You are able to contact us via Twitter/X (@railombudsman). However, we do not have any influence on the scope of data that is collected by Twitter/X or any other social media channels through their sites and if you use them, you should check the policies of the relevant channels to understand how they protect your data. We may collect, use and retain some information that you provide or which is otherwise obtained via social media channels if it is relevant to your complaint.

How is your personal data collected?

We use different methods to collect data from and about you including through:

  • Direct interactions.You may give us information about yourself by filling in an Application Form and/or by corresponding with us by post, phone, email or otherwise including through social media channels.
  • Indirectly from the other parties to the case. The Service Providers may share information with us from their own internal databases insofar as it is relevant to your complaint.
  • Our website will store cookies. Cookies are small pieces of text which are stored on your browser, the page you are viewing or the on your device. They allow the website or a third party to recognise you and help you navigate the website more easily. For more information about the cookies we use on our website, please click here.
  • Third parties.We may collect standard internet log information and details of visitor behaviour patterns from various third parties such as analytics providers (e.g. Google Analytics).

We may collect information about your computer, including where available your IP address, operating system and browser type. This is for system administration, to filter traffic, to look up use domains and to report statistics. This is statistical data about our users’ browsing actions and patterns and does not identify any individual.

Legal basis for processing

We will only use your personal data when the law allows us to. This means we have to have a legal reason to use your personal data. The legal basis is that we have a legitimate interest in processing your data in order to administer a claim against a Service Provider against whom you have lodged your complaint. When you ask us to consider a complaint against a Service Provider, we will only request the personal information that is needed to process your complaint. We require your data to pursue our legitimate interests in a way that we consider you could reasonably expect in the administration of the claim itself.

Special categories of personal data[3]

The legal reason for processing special categories of personal data is more limited. We must identify a lawful basis for this processing and meet a separate condition for the processing. The basis for which we can use these special categories is that we have a legitimate interest in processing your data in order to administer a claim against a Service Provider against whom you have lodged your complaint. The separate condition is that you have given your explicit consent to us processing your data for this purpose. Consent must be freely given, specific and informed and you must have a genuine choice about offering your data.

Where you have supplied special categories of personal data which are relevant to your claim, you will be asked to consent to us using your data for the proper and reasonable administration of your claim when you submit or sign your Application Form. Where we rely on your explicit consent to process special categories of personal data, this consent can be withdrawn at any time. To withdraw your consent, please contact us.

If you are unsure about our use of your data, or require more information, please contact us for details.

What we use your information for

The Rail Ombudsman will only use the information you provide to:

  • respond to your enquiry;
  • investigate your complaint;
  • comply with our reporting obligations.

You will not be subject to automated decisions.

We will not use your data for any marketing or promotional purposes and will not share your personal data with any third party for marketing purposes.

Telephone calls to and from the Rail Ombudsman may be recorded for training and quality purposes. Recordings are used to protect the interests of those participating in the call and provide us with useful information or evidence that supports your complaint.

When you submit an Application Form and request the Rail Ombudsman’s involvement in your complaint, you acknowledge that we will hold and use your information in the ways described above.

Sharing your personal information

The Rail Ombudsman is a subsidiary of The Ombuds Group (registered in England and Wales, company number: 14275884 / ICO Registration ZB499817) along with the Dispute Resolution Ombudsman (registered in England and Wales, company number: 8945616/ ICO Registration ZA050882) All data held by the Rail Ombudsman may be shared/transferred between any of the above organisations.

As part of the process to administer a claim against a Service Provider against whom you have lodged your complaint, we may share the information that you provide to us with:

  • the other parties in the case;
  • other organisations who can help in resolving the dispute (including companies who provide us with services such as Welsh and British Sign Language translation services and IT support); and/or
  • other statutory bodies for any complaint which is out of scope for the Rail Ombudsman (e.g. Transport Focus and London TravelWatch, CAHA);
  • any other body with whom we are legally obliged to co-operate, for example law enforcement bodies.

Please also note that as part of our service, we operate a Case Management System which is managed by a third-party company. All data (including personal data) relating to cases is stored within this system and therefore may be accessed by employees and associates of the third-party company. We have a data sharing agreement in place with them for this purpose.

Any data shared with any other third party (e.g. for reporting purposes to the Rail Delivery Group, the Office of Rail and Road (the Regulator for the rail industry) and/or the Department for Transport) will be anonymised. Any such reports will contain no personal data about you or any information from which you could be identified.

Please note that as referred to above, The Rail Ombudsman works with Transport Focus and London TravelWatch. These bodies are independent watchdogs for transport users, who use insight from complaints to inform their policy and campaign work with the aim of improving the passenger experience of rail.  We transfer some cases to these bodies in accordance with this Privacy Notice, where the matters in dispute are outside our remit but within theirs.

When completing an Application form you will be explicitly asked if you consent to the Rail Ombudsman sharing the content of your application form, including any personal data you may have included within it, with these bodies for the purposes of generating insight.

Please note that your response in no way affects your claim at the Rail Ombudsman and your details will only be shared once the case is closed.

If you have any questions regarding this, please contact info@railombudsman.org

Your consent can be withdrawn at any time by contacting us via info@railombudsman.org.  In the event that you contact us and we have already shared the content of your application form, we will ask the Statutory Appeals Bodies to delete any personal data they hold about you.

Customer satisfaction surveys

Sometimes when you submit a complaint we may use a research organisation to contact you to see whether you will participate in an anonymised Customer Satisfaction Survey; while such organisations act as processors of your personal data on our behalf, we are responsible for your personal data at all times. We send such requests on the basis of a legitimate interest in improving our services that we provide to you. If you do not wish to take part, you have the right to opt out of the surveys at any time by contacting us at the address in the ‘Contact Us’ section or changing your contact preferences in your account, if you have one with us.

How we manage your personal information

We process your personal information in accordance with the principles of the Data Protection Law.
We will treat your personal information fairly and lawfully and we will ensure that information is:

  • processed for limited purposes;
  • kept up-to-date, accurate, relevant and not excessive;
  • not kept longer than is necessary;
  • kept secure to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

Access to personal information is restricted to authorised individuals on a strictly need to know basis and subject to a duty of confidentiality.

We are committed to keeping your personal details up-to-date, and we encourage you to inform us about any changes needed to ensure your details are accurate.

Sometimes we will need to share your personal data with third parties and suppliers outside the European Economic Area, such as the USA. If we do this, we have received confirmation to ensure your data receives the same protection as if it were being processed inside the European Economic Area.

Your rights under the Data Protection Law

Under the Data Protection Law, as a data subject you have the legal right to:

  • request access to your personal data (commonly known as a ‘data subject access request’);
  • request correction of your personal data;
  • request erasure of your personal data;
  • object to processing of your personal data;
  • request restriction of processing your personal data;
  • request transfer of your personal data;
  • not be subject to automated decisions; and
  • withdraw your consent.

Please contact us if you require any further information relating to, or if you wish to exercise any of, these rights.

Periods for which we will store your personal information

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.

Telephone recordings are kept for 6 months. If a telephone call recording provides useful information or evidence that supports a complaint, we may keep this as part of the case for 12 years.

We will keep other records of the information that you give us for up to 6 years. This is required for us to monitor the progress of your case and produce statistics that we may publish. We have a legal obligation to publish certain case statistics to our ADR accrediting body.

Personal information that you provide through social media is kept for a period of up to 12 months.

We also have an ongoing duty to retain personal data so that we can make reasonable adjustments for consumers under the Equality Act 2010. This may affect, for example, a consumer’s preferred method of contact if they had a hearing impairment and/or what would be an appropriate award to make.

In some circumstances you can ask us to delete your data: see Your rights under the Data Protection Law for further information.

Third party links

This website includes links to the websites of the Service Providers and may include links to other third party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

Further information

For further information on how and why we process your information and on how to exercise your legal rights, contact us.

The Information Commissioner’s Office (ICO) is also a source of further information about your data protection rights. The ICO is an independent official body, the UK supervisory authority for data protection issues, and one of their primary functions is to administer the provisions of the Data Protection Law.

You have the right to complain to the ICO if you think we have breached the Data Protection Law.

Dispute Resolution Ombudsman who operates the Rail Ombudsman is registered under the General Data Protection Regulation and Data Protection Act 2018 (registration ZA050882)

You can contact the ICO at:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: ww.ico.org.uk

Contact Us:

Telephone: 0330 094 0362
Textphone: 0330 094 0363
Email: info@railombudsman.org
Twitter: @RailOmbudsman
By Post: Rail Ombudsman, Premier House, 5 Argyle Way, Stevenage SG1 2AD

Scroll to top

[1] By this we mean the GDPR as supplemented and amended by the Data Protection Act 2018 and, post 31 December 2020, the provisions of UK GDPR

[2] ‘Special categories of personal data’ is defined within the GDPR and covers racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a person’s sex life or sexual orientation.

[3] See footnote 2.