Privacy Policy

Last updated: 02 September 2025

Who We Are

Rewarding Rail is a customer loyalty programme for rail passengers in Great Britain. We let you earn points based on the distance (in miles) that you travel by rail, on eligible rail ticket types. Your points can then be redeemed for various perks and rewards, depending on your membership type.

Contact us about your data:

What Information We Collect

When you join Rewarding Rail, we collect:

  • Your name and email address when you create your account
  • Rail ticket information when you submit tickets to earn points, including:
    • Journey details (stations, dates, times)
    • Ticket prices and types
    • Images/copies of your tickets
  • Points balance and account activity as you use our service
  • Website usage data through Google Analytics

Why We Use Your Information

We process your personal data to:

  • Run your loyalty account – track your journeys and award points
  • Send you account updates – confirmation emails and point notifications
  • Improve our service – analyse how customers use Rewarding Rail
  • Meet legal requirements – keep records as required by law

Legal basis:We process your data based on our legitimate interest in operating the loyalty programme, and your consent where required.

How We Protect Your Information

We keep your account details separate from your journey information to protect your privacy. Your data is protected by:

  • Secure encrypted storage
  • Limited staff access on a need-to-know basis
  • Regular security reviews and updates

Where Your Data Goes

Your information is processed in several locations:

  • UK servers for our website (hosted by Krystal Hosting Ltd.)
  • USA servers for ticket storage (Amazon AWS) and processing (Claude AI)
  • Global servers for email services (SendGrid) and analytics (Google)

We only work with providers who meet strict data protection standards, including adequacy decisions and contractual safeguards under UK GDPR.

How Long We Keep Your Data

We retain your information for:

  • Account data – until you close your account plus 10 years for legal purposes
  • Journey records – 10 years to maintain points history
  • Ticket images – 10 years for verification purposes

Your Rights

You have the right to:

  • See your data – request a copy of information we hold about you
  • Correct mistakes – ask us to fix incorrect information
  • Delete your data – request removal of your information (with some legal exceptions)
  • Stop processing – object to how we use your data
  • Move your data – get a copy in a standard format to transfer elsewhere
  • Withdraw consent – stop us processing data you previously agreed to

How to exercise your rights:Email us at data@rewardingrail.com with your request.

Cookies and Analytics

Our website uses:

  • Essential cookies to make the site work properly
  • Google Analytics to understand how visitors use our site (only with your consent)

You can manage cookie preferences through your browser settings.

Changes to This Policy

We may update this privacy policy from time to time. We’ll notify you of significant changes by email or through our website.

Questions and Complaints

If you have concerns about how we handle your data:

  1. Contact us first: data@rewardingrail.com
  2. Contact the regulator: You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk

This policy explains how Rewarding Rail complies with UK GDPR and data protection law(s).