Privacy Policy

Young Rail Professionals ("YRP", "we", "us", "our") is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains how we collect, use, store and protect your information.

1. Data Controller

Young Rail Professionals is the data controller responsible for your personal data. If you have questions about this policy or wish to exercise your data rights, please contact us at info@youngrailpro.com.

2. What Data We Collect

We may collect and process the following personal data:

• Identity data: first name, last name
• Contact data: email address
• Account data: password (stored securely hashed), account status
• Profile data: date of birth, gender, organisation, profession, rail career start year, entry route into rail
• Diversity data (optional): race & ethnicity, sexual orientation, education level, disability/health/learning status — collected anonymously for aggregate reporting only
• Event data: event registrations, waitlist sign-ups
• Technical data: browser type, IP address, pages visited (via cookies and analytics)

3. How We Use Your Data

We process your personal data on the following lawful bases under UK GDPR Article 6(1):

4. How We Store and Protect Your Data

Your data is stored on secure servers. Passwords are cryptographically hashed and never stored in plain text. We use HTTPS encryption for all data in transit and implement appropriate technical and organisational measures to protect against unauthorised access, alteration, disclosure or destruction.

We retain your personal data for as long as your account is active or as needed to provide you with our services. You may request deletion of your account and associated data at any time.

5. Your Rights

Under UK GDPR, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate data
• Right to erasure (Art. 17): request deletion of your personal data
• Right to restrict processing (Art. 18): request limitation of how we use your data
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interest
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time

To exercise any of these rights, contact us at info@youngrailpro.com. We will respond within one month as required by law.

6. Third-Party Services

We may share data with the following categories of processors:

• Hosting and infrastructure providers (Vercel)
• Email service providers (Brevo) for transactional emails
• Analytics services (Google Analytics) for website usage data
• Content management (Sanity CMS) for public website content

All third-party processors are contractually obligated to protect your data and process it only on our instructions.

7. Cookies

We use the following types of cookies:

• Essential cookies: required for authentication and core site functionality (e.g. session tokens)
• Analytics cookies: help us understand how visitors use the site (Google Analytics)

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect site functionality.

8. Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

9. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via email or a prominent notice on our website. We encourage you to review this page periodically.

10. Contact & Complaints

If you have concerns about how we handle your data, please contact us at info@youngrailpro.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

This privacy policy is provided as a template and should be reviewed by a qualified legal professional to ensure full compliance with applicable regulations.