Who we are
The fares reform consultation is conducted by Britain Runs on Rail (BROR), part of the Rail Delivery Group, which brings together the companies that run Britain’s railway into a single team with one goal - to deliver a better railway for you and your community. ATOC Ltd is the name of our legal entity and the data controller for all the personal data that you provide.
ATOC Ltd's address is 200 Aldersgate Street, London EC1A 4HD.
The purpose of this policy is to make you aware of how we will manage your personal data.
Our lawful basis for collecting your data
We only collect personal data from you if you choose to take part in the survey, and only to the extent that you give us personal data.
The legal basis for us to collect your personal data is legitimate interest. We have a legitimate interest in understanding what you think about rail fares, and that the best way for us to understand your opinions is to ask you for them in this survey.
We will treat your data in an appropriate and lawful manner, in accordance with data protection laws.
What data we collect
In the survey we will ask you for your name, your email address and the first part of your postcode. We also collect your IP address.
We use this information to ensure that each response is unique.
We will also ask you for your ethnicity and any disabilities that you have. This is sensitive personal information and you do not have to provide this information if you do not want to.
Sharing information with other data processors
For the fares reform consultation, RDG is working with Systra, KPMG and SmartSurvey who are data processors working on behalf of RDG. All three companies are UK-based and will store the survey data exclusively in the UK and Ireland.
Any information you provide will only be used for the purposes of the survey and will not be shared with any other third parties.
Keeping it safe
We protect your privacy by ensuring we have the appropriate security measures in place. We ensure that our suppliers process your data in an appropriate, lawful and safe manner.
Survey responses will be securely stored and processed in the UK by RDG and our partners, and then anonymised. The anonymised survey base data will be kept for up to 5 years.
What we do with your data
Your personally identifiable data (name and email address) is used to ensure that each response is unique. We use this data to validate the responses. Once the validation is complete, we will analyse the results. We will delete your personal data when the analysis is complete.
You may be asked if you are prepared to take part in a workshop in the future. If you choose to volunteer for a workshop, then we will contact you at a later date.
Subject access request
You have the right to request that we give you a copy of the data we hold about you. This is called a ‘Subject Access Request’.
Right to deletion
You have the right to request that we delete any data that we hold on you.
Right to restrict processing
You have the right to request that we restrict processing of your information:
- if you believe the information that we hold is incorrect, or
- if you can show that our processing is unlawful, or
- if you want us to stop processing your data but you do not want us to erase it (for example, you may wish us to hold it for legal reasons, to defend a legal claim).
Right to rectification
Right to complain
You have the right to complain about our processing to the Information Commissioner if you believe we are not processing your data in a proper manner. https://ico.org.uk/concerns/handling/