Privacy Policy

1. Introduction & Data Controller

We at European Railway Heritage Trust Ltd ("we", "us", or "our"), registered under company number 14298104 at Platform House, 44 Signal Way, York, YO26 4RD, United Kingdom, are committed to protecting the privacy of visitors to our educational portal storyshelvessprygo.christmas. This policy sets out how we collect, handle, store, and protect personal data in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR).

2. Personal Information We Collect

We aim to collect only the minimum personal information necessary to provide informational rail heritage archives and handle visitor inquiries:

• Inquiry & Correspondence Data: When you complete our contact form, we collect your full name, email address, inquiry topic, and message text. We use this data solely to reply to your correspondence.
• Technical and Device Information: Our hosting servers log basic technical telemetry including IP addresses (anonymized where appropriate), browser user agent strings, referring URLs, operating system configurations, and timestamps of access.
• Cookie & Local Storage Data: We store user consent state via client-side storage keys to remember your cookie preferences across browsing sessions.

3. Lawful Bases for Processing

We process your personal information under the following lawful bases pursuant to Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): Where you explicitly provide consent, such as opting in to non-essential functional or analytics cookies.
• Legitimate Interests (Art. 6(1)(f)): To maintain the network security, load integrity, and reliability of our web server infrastructure, and to respond to direct research communications initiated by you.
• Legal Obligation (Art. 6(1)(c)): Where data retention is required to comply with statutory accounting, reporting, or regulatory directives.

4. Contact Form Inquiries & Communications

When you submit an inquiry through our Contact page, the transmission is protected via modern Transport Layer Security (TLS/HTTPS). We do not sell, rent, or lease your contact details to commercial third parties. Inquiries regarding archival locomotive records, historical stations, or restoration techniques are routed directly to our designated heritage desk. Messages are retained for a maximum period of twenty-four (24) months after the resolution of the inquiry unless extended correspondence is required for collaborative academic research.

5. Cookies and Web Storage

Our website utilizes local storage tokens and essential session cookies to retain user preferences. We provide full granular controls over tracking cookies through our interactive cookie banner. For detailed specifications on cookie names, storage durations, and classification, please review our separate Cookie Policy.

6. Third-Party Processors & Infrastructure

Our website is hosted on secure web infrastructure located within the United Kingdom and the European Economic Area (EEA). If technical support or infrastructure services require data transfer across borders, we implement Standard Contractual Clauses (SCCs) and International Data Transfer Agreements (IDTAs) to guarantee that equivalent data privacy standards apply.

7. Data Security Safeguards

We employ administrative, physical, and technical safeguards designed to protect personal data against accidental loss, unauthorized access, destruction, and alteration. These safeguards include encrypted network protocols, access control policies, periodic server vulnerability scans, and strict least-privilege administrative access.

8. Your Statutory Rights (GDPR & UK DPA 2018)

Under applicable data privacy regulations, you possess enforceable rights regarding your personal information:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request the correction of inaccurate or incomplete records.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of personal information where processing is no longer necessary.
• Right to Restrict Processing: You may request that we temporarily suspend active processing of your data while an objection is verified.
• Right to Data Portability: You may request your personal data in a structured, machine-readable format.
• Right to Object: You have the right to object to processing based on legitimate interests.

9. California Consumer Privacy (CCPA/CPRA Notice)

Although our trust is primarily established in the United Kingdom, we respect visitors globally. For California residents under the CCPA/CPRA, we confirm that we do not sell, trade, or share your personal data for cross-context behavioral advertising. You have the right to know what personal data is collected and to request its deletion without facing discriminatory treatment.

10. Data Protection Officer & Contact Inquiries

If you have any questions, wish to exercise any statutory privacy rights, or need to discuss data handling, please contact our designated Data Protection Officer at:

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your local European supervisory authority if you believe our data practices violate statutory requirements.

Policy Last Updated: January 12, 2026