Privacy policy

We are Rails of Sheffield Limited registered at 21-29 Chesterfield Road, Heeley, Sheffield, S8 0RL.

Your privacy is protected by law, and it is also protected by our data security and protection policies. This page gives you an idea of how we use your data and the safeguards we put in place to protect it.

You can contact our voluntarily appointed Data Protection Officer at DPO@railsofsheffield.com if you have any concerns or wish to exercise your rights.

Our Promises:

To help you on your journey with us we need data about you. We make the following promises about how we will treat this data:

  • We will only collect data about you that is relevant and necessary;
  • Your data will only be held on systems that meet compliance standards;
  • Your data will only be accessed by those who need it, and we will minimise the amount of data that is processed, wherever possible;
  • We will only share data with third parties that meet our own privacy standards for the purposes of fulfilling your order or contacting you unless either you have agreed to share data, we are required to share it by law, or we need to fulfil our service commitments to you through a fulfilment partner;
  • We will always remember that it is your personal data, not ours. As such we will ensure complete transparency and openness with you wherever possible.
  • We respect your rights as outlined in the next section and will respond to all requests promptly

Your Rights:

You have the following rights over any data we hold about you:

  • Your right of access - You have the right to ask us for copies of your personal information.
  • Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
  • Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
  • Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You can read more about your rights here.

If you would like to uphold your rights then please contact our Data Protection Officer at DPO@railsofsheffield.com.

If you are dissatisfied with our response you also have the right to lodge a complaint with the Data Protection Authority. This can be done at https://ico.org.uk/concerns/.

Collecting Data:

We try and minimise the data held and the exact data elements we hold will be dependent on your journey with us. Typically, data elements we collect are restricted to:

  • Your personal contact details – name, email address, IP Address, phone number, address for deliveries;
  • Transmitted information – such as emails, texts, messaging, phone call information and recordings, voice mails, email, and CVs.

When you use our website, we use analytics software to see how you engage with us. This includes using cookies and other beacons. We offer users a preference centre for the use of these when you visit the site.

We also collect data through our website to create an account for you.

Calls may also be recorded for information holding, quality and training purposes.

If you want to know what data about you, we have and how we obtained your data then please contact us.

Our website and other materials sent to you may contain links to other third-party websites. We may also offer buttons to social media that link to third party services. We’re not responsible for the content or the data privacy these sites provide through their tools or sites.

Why we process your Data

The primary legal basis that we process your data is for the fulfilment of Contract or our Legitimate Interests. Normally this means when you order something from us. We also use Legitimate Interest when you engage with us, or we believe we need to contact you. Marketing, including our mailing list, is based on your consent.

The information that we collect is essential for us to be able to carry out the services that you require from us effectively.

When you sign for our website you provide consent for the use of your data to enable you to manage your account and provide our goods and services to you.

Data gained from marketing our services to other businesses or other business activities are processed for our Legitimate Interests.

How we use your personal data

We process information about you to provide you with the services for which you engage us.

If we believe you will benefit from our services, we may use your data to market to you if you have consented to us or if we believe we have a legitimate interest in doing so, fulfil contractual arrangements or for other agreed purposes. Every email sent from us allows you to opt out of receiving marketing emails from us, except for the purposes of fulfilling any contractual arrangements.

Calls may be recorded for information holding, quality and training purposes. Our email, document management and website analytics are used for information purposes.

All our processes are mapped and are subject to various internal policies, procedures and governance, ensuring your data privacy and security remains central to all we do.

Processing your Data

Data is processed/stored locally and on encrypted third party hosted cloud services such as Google Business Suite and other systems. For example, for our website and App we use Shopify to power our online store. You can read more about how Shopify uses your Personal Information here: https://www.shopify.com/legal/privacy. We also use Klaviyo for engagement tracking. You can read about their approach to Privacy here: https://www.klaviyo.com/legal.

We use the “Custom Audience pixel” of Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”) on our website. With its help, we can keep track of what users do after they see or click on a Facebook advertisement. This enables us to monitor the effectiveness of Facebook ads for purposes of statistics and market research. Data collected in this way is anonymous to us, which means we cannot see the personal data of individual users. However, this data is saved and processed by Facebook. Facebook can connect this data with your Facebook account and use it for its own advertising purposes, in accordance with Facebook’s Data Policy which can be found at https://www.facebook.com/about/privacy/. You can allow Facebook and its partners to place ads on and outside of Facebook. A cookie can also be saved on your device for these purposes.

In addition, we may use Large Language Models (LLM) to help us fulfil some of our services. A full list of these systems can be provided on request.

Data will be processed in either the UK, EEA/EU data centres or on US based servers that have demonstrated strong Data Security. We may also process your data in countries outside the UK or European Union from time to time in other aspects of our business.

Further to Section 119A of the Data Protection Act 2018 and noting Case C-311/18 in the European Court of Justice, if your data is transferred or processed outside of the UK or EEA we ensure the safeguards of International Data Transfer Agreements (IDTAs) or Addendums are enforced. Where this is not possible, we ensure that European Standard Contractual Clauses are entered.

We regularly review suppliers for data security compliance to ensure your data is safe and track where your data is held.

Sharing your Data

We will not sell your data, nor will we share your information with third party organisations except as part of providing a product or service to you and/or when legally obliged to. It is our policy to use only third-party providers that are bound to maintain appropriate levels of security and confidentiality, to process your personal information only as instructed by us, and to flow those same obligations down to their sub-processors.

We may also disclose your personal information to law enforcement, regulatory and other government agencies and to professional bodies and other third parties, as required by and/or in accordance with applicable law or regulation including but not limited to prevention of fraud or minimising credit risk.

Retaining your Data

Dependant on the data you provide us and for what purpose it is provided we may need to retain your data for up to 6 years following the end of engagement. If you wish to find out more about your specific data retention, please contact us.

Data Protection Complaints

We always try to meet the highest standards of Data Privacy when collecting and using personal information. For this reason, we take any complaints we receive very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate.

You have the right to complain about how we use your personal data. If you are unhappy or have concerns, please contact us first using the details in the “Our Contact Details” section above, so we can try to resolve the issue.

You also have the right to make a complaint to the UK Information Commission (IC). However, the law now requires you to raise your complaint with us before complaining to the IC. If you do complain to us, we will acknowledge your complaint within 30 days, investigate it fairly and promptly, and write to you with our response.

You have the right to complain to the UK IC at any time, using the contact information below:

Please ensure that you state ‘Data Protection Complaint’ in the subject field.

The Information Commission’s address:

Information Commission
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Under the UK Data (Use and Access) Act 2025, the IC typically requires you to have completed our internal complaints process, before they will investigate.

Legal Compliance

We seek to uphold our legal obligations as covered by the Data Protection Act 2018, Data Use and Access Act 2025 and the General Data Protection Regulation 2016. Our Data Protection Authority is designated as the Information Commission (IC) formally the Information Commissioners Office (ICO). This Privacy Policy is reviewed on a regular basis and was last reviewed in September 2026.

We retain the right to update this notice at any time. We will always document any changes and will publish the latest version on the company’s website.