UK GDPR Compliance Policy

1. Purpose

This policy sets out how Reliance Rail Solutions approaches data protection compliance under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all personal information we process about clients, enquirers, delegates, suppliers, and website visitors, and to anyone working on behalf of Reliance Rail Solutions who handles that information.

This policy is a statement of our internal practices and commitments. It complements, but is separate from, our Privacy Notice, which is the public-facing document explaining what we do with personal information.

2. Our commitment

Reliance Rail Solutions is committed to processing personal information fairly, lawfully, and transparently. We aim to collect only the information we genuinely need to plan and deliver our consultancy, training, and operational support services, to keep it secure, and to respect the rights individuals have over their own data.

3. The data protection principles we follow

We process personal information in line with the six UK GDPR principles:

1. Lawfulness, fairness, and transparency — we only process data where we have a valid lawful basis, and we are open about how we use it.

2. Purpose limitation — we collect data for specified purposes (such as managing a client engagement or delivering a training programme) and do not use it for unrelated purposes without telling you.

3. Data minimisation — we only ask for the information needed to provide our services, such as contact details, organisational context, and delegate information for training.

4. Accuracy — we take reasonable steps to keep contact and engagement details accurate and up to date.

5. Storage limitation — we do not keep personal information longer than necessary (see our retention approach in the Privacy Notice).

6. Integrity and confidentiality — we use appropriate security measures to protect data against loss, misuse, or unauthorised access.

We also comply with the accountability principle by maintaining this policy, keeping records of our processing activities, and being able to demonstrate compliance if asked.

4. Roles and responsibilities

Reliance Rail Solutions acts as the data controller for personal information collected through our website, client engagements, and training activities. Day-to-day data protection responsibility sits with the business owner/management, who:

– decide what personal information is collected and why;

– ensure this policy and our Privacy Notice stay up to date;

– handle data subject requests (such as access or deletion requests);

– manage relationships with any third-party processors (such as our website hosting provider or payment provider);

– respond to any data protection concerns or breaches.

5. Lawful basis for processing

We rely on the following lawful bases, depending on the activity:

Contract — to confirm an engagement, deliver consultancy, training, or operational support, and manage associated communications.

Legitimate interests — to respond to enquiries, prevent fraud, and improve our services, where this does not override individuals’ rights and interests.

Consent — for marketing communications and for using case study content, photographs, or other references featuring identifiable individuals or organisations.

Legal obligation — for keeping financial, tax, and contractual records as required by law.

6. Third parties and processors

We work with a small number of third parties who may process personal information on our behalf, including:

– our website hosting and platform provider;

– payment processing providers;

– email or document management platforms, where used;

– professional advisers such as our accountant.

Where we use a third-party processor, we take reasonable steps to satisfy ourselves that they provide appropriate safeguards for personal information, and we only share the minimum information necessary for them to perform their function.

7. International transfers

Where any of our service providers store or process information outside the UK or European Economic Area, we rely on legally recognised safeguards, such as the UK International Data Transfer Addendum, standard contractual clauses, or an applicable adequacy decision.

8. Data subject rights

We recognise and will honour the following rights for individuals whose data we hold, in line with UK GDPR:

– right to be informed;

– right of access;

– right to rectification;

– right to erasure;

– right to restrict processing;

– right to data portability;

– right to object;

– rights related to automated decision-making (we do not carry out automated decision-making or profiling that has a legal or similarly significant effect on individuals).

Requests can be made to [Insert email address] and will normally be responded to within one calendar month.

9. Security measures

We take reasonable and proportionate steps to keep personal information secure, including:

– restricting access to client, engagement, and financial records to those who need it;

– using reputable third-party platforms with their own security safeguards for hosting and payments;

– taking care when sharing client or delegate details with sub-contractors or partners, limiting this to what is necessary for the engagement;

– securely disposing of personal information that is no longer needed.

10. Personal data breaches

If we become aware of a personal data breach that poses a risk to individuals’ rights and freedoms, we will:

– assess the nature and severity of the breach as soon as possible;

– where required, notify the Information Commissioner’s Office (ICO) without undue delay, and within 72 hours of becoming aware, where feasible;

– notify affected individuals directly if the breach is likely to result in a high risk to their rights and freedoms;

– record details of the breach, its effects, and the action taken, even where notification is not required.

11. Training and awareness

Anyone handling personal information on behalf of Reliance Rail Solutions is made aware of this policy and of the importance of handling client, delegate, and enquirer information responsibly, including keeping engagement and project details confidential and only using photographs or case study content with appropriate consent.

12. Reviewing this policy

We review this policy periodically and whenever there is a material change to how we collect or use personal information, or following changes in data protection law or ICO guidance.

13. Contact

Questions about this policy, or about how Reliance Rail Solutions handles personal data, can be sent to:

Reliance Rail Solutions