Purpose of this Privacy Notice
Dispute Resolution Ombudsman Limited, trading as the Rail Ombudsman, respects your privacy and is committed to protecting your personal data. This Privacy Notice tells you what to expect when we process your personal data, or personal information, when you visit our website, when you call us by telephone, or contact us via another channel and/or when you complete an Application Form to start a complaint. It tells you about your privacy rights, how the law protects you, the purposes for which we may process your personal information and the legal basis for the processing (‘processing’ includes us just keeping your personal information).
It is important that you read this Privacy Notice so that you are fully aware of how and why we are using your personal data.
All your personal data will be held and used in accordance with the General Data Protection Regulation (‘GDPR’). These rules apply regardless of whether data is stored electronically, on paper or on other materials. To comply with the law, personal data must be collected lawfully and used fairly, stored safely and not disclosed unlawfully.
Identity and contact details of Controller
Dispute Resolution Ombudsman Limited, trading as the Rail Ombudsman, is the controller of personal data for the purposes of the GDPR and is responsible for the protection of your personal data.
Our contact details for data protection purposes are as follows:
Judith Turner, Legal Counsel & Head of ADR
Rail Ombudsman, Premier House, 5 Argyle Way, Stevenage, SG1 2AD
Tel: 0330 094 0362
The data we collect about you
Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymised data).
We may collect, use, store and transfer different kinds of personal data about you which we have listed as follows:
- title, forename(s), surname;
- address, email address and telephone contact details;
- personal details of a third party representative;
- reference number;
- complaint details which may contain personal identifiers;
- photographic or video evidence provided;
- regular commute.
Some personal information that is collected is treated as more sensitive (referred to as ‘special categories of personal data’, for example, information about health, sexuality, ethnic background and others).
You are able to contact us via Twitter (@railombudsman). However, we do not have any influence on the scope of data that is collected by Twitter or any other social media channels through their sites and if you use them, you should check the policies of the relevant channels to understand how they protect your data. We may collect, use and retain some information that you provide or which is otherwise obtained via social media channels if it is relevant to your complaint.
How is your personal data collected?
We use different methods to collect data from and about you including through:
- Direct interactions. You may give us information about yourself by filling in an Application Form and/or by corresponding with us by post, phone, email, webchat or otherwise including through social media channels.
- Indirectly from the other parties to the case. The Service Providers may share information with us from their own internal databases insofar as it is relevant to your complaint.
- Website. Our website will store cookies. Cookies are small pieces of text which are stored on your browser, the page you are viewing or the on your device. They allow the website or a third party to recognise you and help you navigate the website more easily. For more information about the cookies we use on our website, please click here.
- Third parties. We may collect standard internet log information and details of visitor behaviour patterns from various third parties such as analytics providers (e.g. Google Analytics).
We may collect information about your computer, including where available your IP address, operating system and browser type. This is for system administration, to filter traffic, to look up use domains and to report statistics. This is statistical data about our users’ browsing actions and patterns and does not identify any individual.
Legal basis for processing
We will only use your personal data when the law allows us to. This means we have to have a legal reason to use your personal data. The legal basis is that we have a legitimate interest in processing your data in order to administer a claim against a Service Provider against whom you have lodged your complaint. When you ask us to consider a complaint against a Service Provider, we will only request the personal information that is needed to process your complaint. We require your data to pursue our legitimate interests in a way that we consider you could reasonably expect in the administration of the claim itself.
Special categories of personal data
The legal reason for processing special categories of personal data is more limited. We must identify a lawful basis for this processing and meet a separate condition for the processing. The basis for which we can use these special categories is that we have a legitimate interest in processing your data in order to administer a claim against a Service Provider against whom you have lodged your complaint. The separate condition is that you have given your explicit consent to us processing your data for this purpose. Consent must be freely given, specific and informed and you must have a genuine choice about offering your data.
Where you have supplied special categories of personal data which are relevant to your claim, you will be asked to consent to us using your data for the proper and reasonable administration of your claim when you submit or sign your Application Form [link]. Where we rely on your explicit consent to process special categories of personal data, this consent can be withdrawn at any time. To withdraw your consent, please contact us.
If you are unsure about our use of your data, or require more information, please contact us for details.
What we use your information for
The Rail Ombudsman will only use the information you provide to:
- respond to your enquiry;
- investigate your complaint;
- comply with our reporting obligations.
You will not be subject to automated decisions.
We will not use your data for any marketing or promotional purposes and will not share your personal data with any third party for marketing purposes.
Telephone calls to and from the Rail Ombudsman may be recorded for training and quality purposes. Recordings are used to protect the interests of those participating in the call and provide us with useful information or evidence that supports your complaint.
When you submit an Application Form and request the Rail Ombudsman’s involvement in your complaint, you acknowledge that we will hold and use your information in the ways described above.
Sharing your personal information
As part of the process to administer a claim against a Service Provider against whom you have lodged your complaint, we may share the information that you provide to us with:
- the other parties in the case;
- other organisations who can help in resolving the dispute (including companies who provide us with services such as Welsh and British Sign Language translation services and IT support); and/or
- other statutory bodies for any complaint which is out of scope for the Rail Ombudsman (e.g. Transport Focus and London TravelWatch);
- any other body with whom we are legally obliged to co-operate, for example law enforcement bodies.
Any data shared with any other third party (e.g. for reporting purposes to the Rail Delivery Group, the Office of Rail and Road (the Regulator for the rail industry) and/or the Department for Transport) will be anonymised. Any such reports will contain no personal data about you or any information from which you could be identified.
How we manage your personal information
We process your personal information in accordance with the principles of the GDPR.
We will treat your personal information fairly and lawfully and we will ensure that information is:
- processed for limited purposes;
- kept up-to-date, accurate, relevant and not excessive;
- not kept longer than is necessary;
- kept secure to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.
Access to personal information is restricted to authorised individuals on a strictly need to know basis and subject to a duty of confidentiality.
We are committed to keeping your personal details up-to-date, and we encourage you to inform us about any changes needed to ensure your details are accurate.
Sometimes we will need to share your personal data with third parties and suppliers outside the European Economic Area, such as the USA. If we do this, we have received confirmation to ensure your data receives the same protection as if it were being processed inside the European Economic Area.
Your rights under the GDPR
Under the GDPR, as a data subject you have the legal right to:
- request access to your personal data (commonly known as a ‘data subject access request’);
- request correction of your personal data;
- request erasure of your personal data;
- object to processing of your personal data;
- request restriction of processing your personal data;
- request transfer of your personal data;
- not be subject to automated decisions; and
- withdraw your consent.
Please contact us if you require any further information relating to, or if you wish to exercise any of, these rights.
Periods for which we will store your personal information
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements.
Telephone recordings are kept for 6 months. If a telephone call recording provides useful information or evidence that supports a complaint, we may keep this as part of the case for 6 years.
We will keep other records of the information that you give us for up to 6 years. This is required for us to monitor the progress of your case and produce statistics that we may publish. We have a legal obligation to publish certain case statistics to our ADR accrediting body.
Personal information that you provide through social media is kept for a period of up to 12 months.
We also have an ongoing duty to retain personal data so that we can make reasonable adjustments for consumers under the Equality Act 2010. This may affect, for example, a consumer’s preferred method of contact if they had a hearing impairment and/or what would be an appropriate award to make.
In some circumstances you can ask us to delete your data: see Your rights under the GDPR for further information.
Third party links
For further information on how and why we process your information and on how to exercise your legal rights, contact us.
The Information Commissioner’s Office (ICO) is also a source of further information about your data protection rights. The ICO is an independent official body, the UK supervisory authority for data protection issues, and one of their primary functions is to administer the provisions of the GDPR.
You have the right to complain to the ICO if you think we have breached the GDPR.
You can contact the ICO at:
Information Commissioner’s Office
Wycliffe House, Water Lane
Tel: 0303 123 1113
Telephone: 0330 094 0362
Textphone: 0330 094 0363
By Post: Rail Ombudsman, Premier House, 5 Argyle Way, Stevenage SG1 2AD
 By this we mean the GDPR as supplemented and amended by the Data Protection Act 2018
 ‘Special categories of personal data’ is defined within the GDPR and covers racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a person’s sex life or sexual orientation.
 See footnote 2.