Privacy Notice
The purpose of this policy is to make you aware of how we will manage your personal data.
If you have a 16-17 Saver, please see the 16-17 Saver Privacy Notice.
If you have a Veterans Railcard, please see the Veterans Railcard Privacy Notice.
For other Railcards, you can use the links on the left to go directly to specific sections.
Who we are
ATOC Ltd manages Railcards on behalf of Britain’s train companies. ATOC Ltd is the data controller and, as such, is responsible for ensuring the lawful and appropriate handling of all the personal data that you provide in order to purchase a Railcard. ATOC Ltd’s address is:
Railcards Marketing, RDG, First Floor North, 1 Puddle Dock, London, EC4V 3DS.
Railcard and National Rail are trademarks of ATOC Ltd. ATOC Ltd also trades under the name Rail Delivery Group.
Our lawful basis for collecting your data
This website is offered as a service to you, the user, by ATOC Limited. Your use of this website constitutes your agreement to all the terms and conditions detailed here. Additional terms and conditions apply in respect of the purchase of Railcards. If you do not agree with these terms and conditions then you are not authorised to use this website.
What data we collect
We only collect the data that we need in order to process your application. For all Railcards we collect your name, address, email address and contact number. For age specific Railcards we also require details from either a UK driving licence, International Passport or National Identity Card to verify your date of birth. We also collect additional information depending on what Railcard you are purchasing:
16-25 Railcard: we require your photograph. For mature students, we also require confirmation of your attendance at a university/college
Disabled Persons Railcard: we require evidence of your eligibility which may include evidence of receiving a government benefit, allowance or medical information
Family & Friends Railcard: if you decide to have a second cardholder named on the card, we will need their name.
Two Together Railcard: we require the name of the second cardholder and photographs of both you and the second named cardholder
If you choose to have your Railcard delivered to your mobile device, we will require your photograph regardless of the Railcard you are buying.
If you are buying a Railcard on behalf of another person, we will need their personal details. In this case, we will deem that you have the other person's permission to provide their personal details.
If you choose to enter a voluntary prize draw for either market research or competitions, we will collect your personal email address, your name, postcode and Railcard number.
We use cookies and similar tools across our website to improve your experience and our website's performance. To find out more about cookies, read our Cookie Policy.
Sharing information with other data processors
We use a number of suppliers to produce, deliver, administer and market Railcards.
These suppliers are:
Salesforce (who send our emails and provide our database)
Coforge (who manages our database)
Mulesoft (who transfer data between our website and database)
Teleperformance (who provide customer support and verification for Railcard applications)
Vodafone (who provide the telephone service for the Teleperformance customer support centre)
ESP Group (who fulfil all plastic Railcard orders)
Indicia (who transfer data between the Railcard website and digital Railcard app, manages our Station bought Railcards and manage our contact exclusions process)
Rival (who send renewal reminders by post)
Quiet Storm (who provide some of our website pages, including competition and contact forms)
BPA Quality (who provide quality assurance on customer correspondence and telephone calls with the Teleperformance Customer Support Teams)
First Rail holdings (who provide quality assurance on customer telephone calls with the Teleperformance Customer Support Teams)
Accent (who undertake market research and surveys on our behalf)
Global Pay (who process credit/debit card payments on our behalf)
Genesys (who store audio calls received by the Teleperformance Customer Support Team)
Survey Monkey (process responses if you participate in any surveys with us)
SendGrid (who send password reset emails on our behalf)
Amazon Simple Storage Service (who provides storage services for our customer data
DBS Data (who run our contact exclusions process)
Lonsdale Direct Solutions (who capture details from Railcard paper application forms)
Encordia (who provide our website, app and Railcard Digital Services)
Node 4 (provide and manage all our nationalrail.co.uk email accounts)
Readapt (who analyze our customer service enquiry data)
BrandSwap (who provide us with Gift with purchase offers)
Nasstar (who provide and manage our Railcard Service Desk function, support and management of all our AWS environments for website)
OwnBackup (who provides our data backup solution)
TTK (who generates the barcodes used within our digital railcard app)
Amazon Web Services (AWS) (who host our services and website infrastructure, enabling secure storage, faster deployments, and reliable performance)
Your personal information may be disclosed to the train companies who run services in your region in order for them to administer and support your use of the Railcard. We may be required to share information with law enforcement agencies. Please be assured, we will only share information that is absolutely necessary.
We will not share your details with any other third parties for marketing purposes unless you provide us with your consent, or we have legitimate interest to do so. If you consent to marketing, you can find out more about the communications you’ll receive in our Marketing and Contact Policy (below).
If you already hold a valid Railcard your details will be shared with a third party, under legitimate interest, to exclude you from acquisition marketing.
If you participate in a survey with us, your surveys will be processed by our survey supplier.
If you enter one of our prize draws for market research or competitions, your entry will be held by our suppliers (Survey Monkey for research and Quiet Storm for competitions). Winners of competitions will be notified using the contact details provided in their entry. Where a prize is being offered by one of our partners, your contact details may be provided to them in order for them to fulfil the prize.
Keeping your data safe
We protect your privacy by ensuring we have the appropriate security measures in place, backed up by contractual obligations, to ensure that our suppliers process your data in an appropriate, lawful and safe manner.
What we do with your data
We use your data to provide you with the Railcard and:
to provide you with customer support services, for example if you lose your Railcard
to exclude you from acquisition marketing if you hold a valid Railcard
to notify you when your Railcard is due to expire, and to suggest other relevant products if you no longer qualify for your current Railcard
to remind you if you have an incomplete online Railcard application, via email and digital marketing channels
to send you information about any changes to your Railcard’s terms and conditions; and
to alert you to any changes to this Privacy Notice
We analyze our customer data for sales insight and marketing research including demographic, geographic and attitude analysis to understand who our customers are in groups rather than as individuals.
We have a legitimate interest in improving our products and services, and we conduct market research for this purpose. We may therefore contact you from time to time to invite you to participate in our market research. This research may be carried out by a supplier not currently listed in this Privacy Notice, however we will always inform you who is completing this research on our behalf. Your data will be shared with this supplier for this purpose alone and will be deleted once this research has been completed.
If you enter one of our prize draws for market research or competitions, the data we collect will be kept securely whilst the survey and/or competition is live. The prize draw winner's(s') details (first name and county) will be made available for 30 days after the closing date to those who email marketing@raildeliverygroup.com with the survey title as the subject line. Personal details will only be used for the purpose of the prize draw and will be deleted once the winner has been confirmed.
How long do we keep your data?
We keep your data while your Railcard is valid and for 2 years thereafter to enable you to renew easily within that period. During this time, you may receive other communications from us if you have consented.
If you have started but not completed a Railcard application and haven’t purchased a Railcard using an online account with us before, the data you have entered will be held for 30 days to allow you to return to complete your application. After that time, it will be deleted.
If you participate in a prize draw for market research or competitions, your entry will be held for 30 days and then deleted.
Your rights
You have several rights to data protection which are set out below. Submit a request to contact us in relation to your rights regarding how we use your data.
Subject access request
You have the right to request a copy of the data that we hold about you. This is called a Subject Access Request.
Deletion of personal information
You have the right to request that we delete any data that we hold on you after your Railcard has expired.
Bereavement notification
If you wish to notify us of the death of a Railcard customer, you can submit a bereavement request using our online form. Please select 'Bereavement – Data Deletion' from the request options and provide the required information so that we can process the request appropriately.
Restrict processing of personal information
You have the right to request that we restrict processing of your information for specific purposes such as direct marketing at any time. However, for the duration that your Railcard is active, we will continue to process your data in the way we have set out in this Privacy Notice so that we can fulfil our contract to you.
Right to rectification
If your details are incorrect, incomplete or have changed, you can contact us at any time to change these.
If you bought your Railcard online, you can update your details by logging onto your online account on the relevant Railcard website and updating them.
Alternatively, please fill out our online form to request changes to the data we hold on you.
How to contact us
To exercise any of your rights, set out above, please fill out our online form or contact us using the details provided below:
Data Protection Lead for Railcards
First Floor North
1 Puddle Dock
London
EC4V 3DS
Please include your name, address and Railcard number, so that we can deal with your request.
Complaints
You have the right to complain about our processing to the Information Commissioner if you believe we are not processing your data in a proper manner. Visit the Information Commissioner’s Office website for more information.
Last updated 5 August 2026