Privacy Policy

The purpose of this policy is to make you aware of how we will manage your personal data.

You can use the short cut links below to go directly to specific sections.

Who we are Your Rights
Our lawful basis for collecting your data Subject Access Request
What data we collect Deletion of personal information
Sharing information with other data processors Restrict processing of personal information
Keeping your data safe Right to rectification
What we do with your data How to contact us
How long we keep your data Complaints


Who we are

ATOC Ltd manages Railcards on behalf of Britain's train companies. ATOC Ltd is the data controller for all the personal data that you provide in order to purchase a Railcard.  ATOC Ltd's address is 200 Aldersgate Street, London EC1A 4HD.

Railcard and National Rail are trade marks of ATOC Ltd. ATOC Ltd also trades under the name Rail Delivery Group.

Our lawful basis for collecting your data

When you buy a Railcard, you enter into a contract with ATOC Ltd for the provision of the Railcard on behalf of train companies. Therefore, collecting your data is necessary for us to perform the contract with you. 

We will treat your data in an appropriate and lawful manner, in accordance with data protection laws.  

What data we collect

For all Railcard applications we collect your name, address, date of birth, email address and contact number.

We collect additional information depending on what Railcard you are purchasing:

  • 16-25 Railcard: we require your photograph. For mature students, we also require confirmation of your attendance at a university/college
  • 26-30 Railcard
  • Disabled Persons Railcard: we require evidence of your eligibility which may include evidence of receiving a government benefit, allowance or medical information
  • Family & Friends Railcard: if you decide to have a second cardholder named on the card, we will need their name.
  • Senior Railcard
  • Two Together Railcard: we require the name of the second cardholder and photographs of both you and the second named cardholder

If you choose to have your Railcard delivered to your mobile device, we will require your photograph regardless of the Railcard you are buying. 

If you are buying a Railcard on behalf of another person, we will need their personal details. In this case, we will deem that you have the other person's permission to provide their personal details.

If you choose to enter a voluntary prize draw for either market research or competitions, we will collect your personal email address, your name and postcode and Railcard number.

We use cookies and similar tools across our website to improve your experience and our website's performance. To find out more about cookies, read our Cookie Policy.

Sharing information with other data processors

To fulfil your request for a Railcard, we use a number of suppliers to produce, deliver and administer your Railcard. 

These suppliers are: 

  • Fast Rail Ticketing Ltd (who retail and fulfil the Network Railcard)
  • ESP Group (who retail, fulfil and provide customer support for the 16-25, 26-30, Family & Friends, Two Together, Senior and Disabled Persons Railcard) 
  • Ndata (who capture details from paper application forms)
  • Indicia (who provide our customer database)
  • Intelenet (who provide customer support for Network Railcard)
  • Salesforce (who sends our emails)
  • Rival (who sends renewal reminders by post)
  • Quiet Storm (who provide some of our website pages, including competition and contact forms)

If you participate in a survey with us your survey responses will be processed by our survey supplier (Survey Monkey).

Your personal information may be disclosed to the train companies who run services in your region in order for them to administer and support your use of the Railcard. We also share information with law enforcement agencies on request.

We will not share your details with any other third parties unless you provide us with your consent. If you consent to marketing, you can find out more about the communications you’ll receive in our Marketing & Contact Policy.

If you enter one of our prize draws for market research or competitions, your entry will be held by our suppliers (Survey Monkey for research and Quiet Storm for competitions). Winners of competitions will be notified using the contact details provided in their entry. Where a prize is being offered by one of our partners, your contact details may be provided to them in order for them to fulfil the prize.

Keeping your data safe

We protect your privacy by ensuring we have the appropriate security measures in place. We ensure that our suppliers process your data in an appropriate, lawful and safe manner, and within the EU only.

If you participate in a survey with us your data will be held with our supplier (Survey Monkey) in the United States under an EU approved data protection framework. It will be anonymised for reporting purposes and then deleted after 30 days.

What we do with your data

We use your data to provide you with the Railcard, and:

  • To provide you with customer support services, for example if you lose your Railcard
  • To send you information about any changes to your Railcard’s terms and conditions
  • To alert you to any changes to this privacy policy
  • To remind you when your Railcard is due to expire.

We do some analysis on our customer data for sales analysis and marketing research.  

We do not use your data for automated decision making. However we do demographic, geographic and attitude analysis to understand who our customers are in groups rather than as individuals. 

If you enter one of our prize draws for market research or competitions, the data we collect will be kept securely whilst the survey and/or competition is live. The prize draw winner(s) details (first name and county) will be made available after the closing date for 30 days to those sending an email to with the subject line of the survey title. Personal details will only be used for the purpose of the prize draw and will be deleted once the winner has been confirmed.

How long do we keep your data?

We keep your data while your Railcard is valid, and for two years thereafter to enable you to renew easily within that period. During this time you may receive other communications from us if you have consented.  

If you have started but not completed a Railcard application, the data you have entered will be held for 30 days to allow you to return to complete your application.  After that time it will be deleted.

If you participate in a prize draw for market research or competitions, your entry will be held for 30 days and then deleted.

Your rights

Subject access request

You have the right to request that we give you a copy of the data we hold about you. This is called a ‘Subject Access Request’.

Deletion of personal information

You have the right to request that we delete any data that we hold on you after your Railcard has expired. 

Restrict processing of personal information

You have the right to request that we restrict processing of your information:

  • if you believe the information that we hold is incorrect, or
  • if you can show that our processing is unlawful, or
  • if you want us to stop processing your data but you do not want us to erase it (for example, you may wish us to hold it for legal reasons, to defend a legal claim).

Right to rectification

If your details are incorrect, incomplete or have changed, you can contact us at any time to change these.   

If you brought your Railcard online, you can update your details by logging onto your online account on the relevant Railcard website and updating them. 

All customers can request changes by contacting us:

  • 16-25, 26-30, Family & Friends, Two Together and Senior Railcards:

Use the Contact Us form on our website


Tel: 0345 3000 250 

Write to: National Railcards, PO Box 6616, Arbroath, DD11 9AR

  • Disabled Persons Railcard:

Use the Contact Us form on our website


Tel: 0345 6010 132

Write to: Disabled Persons Railcard, PO Box 6613, Arbroath, DD11 9AN 

  • Network Railcard:

Use the Contact Us form on our website

Tel: 0345 301 1655

Write to: Rail Delivery Group, 200 Aldersgate Street, London EC1A 4HD

How to contact us

To exercise any of your rights, please contact:

The Data Protection Lead

ATOC Ltd, 200 Aldersgate Street, London EC1 4HD.


Tel: 0207 841 8000.

Please include your name, address and Railcard number, so that we can deal with your request.


You have the right to complain about our processing to the Information Commissioner if you believe we are not processing your data in a proper manner - see for more information.


Last updated 14 March 2018.