Privacy Policy

Introduction Restoring Nailsworth's Railway ("we", "us", "our") is committed to protecting your privacy and handling your personal data lawfully, transparently and securely. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and your rights in relation to your data. It also explains the measures we take to protect your information.

Controller The data controller for the purposes of this policy is Restoring Nailsworth's Railway.

Personal data we collect

  • Information you give us directly:

    • Contact details (name, email address, postal address, telephone number) when you sign up for newsletters, make enquiries, register for events, volunteer, or otherwise communicate with us.

    • Donation information when you donate through PayPal: the transaction amount and confirmation details. We do not receive or store your PayPal password or full payment card details.

    • Any other personal data you choose to provide (for example, photographs, comments, or messages).

  • Information we collect automatically:

    • Usage data collected through Squarespace Analytics about visits to our website, including pages viewed, time spent on pages, referring/exit pages, device and browser type, and anonymised or pseudonymised identifiers such as IP address (processed in accordance with Squarespace’s practices).

    • Cookie data as described in our cookie banner and cookie policy.

How we use your personal data We use personal data for the following purposes:

  • To communicate with you about your enquiries, donations, event bookings, volunteering, subscriptions and other requests.

  • To process and record donations and provide confirmations/receipts (via PayPal).

  • To send newsletters, updates and other communications where you have given consent or where we have a legitimate interest (for example, communications about events and activities relevant to supporters).

  • To administer and improve our website, understand how users interact with it and produce aggregated analytics using Squarespace Analytics.

  • To comply with legal obligations and protect our legal rights.

Legal bases for processing We rely on the following legal bases for processing personal data:

  • Consent: where you have given clear consent (for example, opting in to receive newsletters).

  • Contract: to process donations, event bookings or other transactions you have requested.

  • Legitimate interests: for purposes such as improving our website, keeping records of supporter relationships, and communicating information relevant to our charitable activities, provided such processing does not unduly infringe your privacy rights.

  • Legal obligation: where we must process personal data to comply with a legal duty.

Cookies and similar technologies We use cookies and similar technologies to provide and improve our website. Our cookie banner explains the categories of cookies we use and allows you to manage your preferences. Squarespace may also set cookies or similar technologies; these are governed by Squarespace’s policies and settings. You can manage cookie preferences via the cookie banner and by adjusting your browser settings, although blocking some cookies may affect website functionality.

Squarespace Analytics We use Squarespace Analytics to collect and analyse anonymised or pseudonymised information about how visitors use our site. This helps us understand traffic patterns and improve our content and services. Squarespace’s analytics may process certain technical data such as IP address, device type and browser; where possible such data is handled in a way that minimises identifiability.

Payments and donations Donations are processed via PayPal. When you make a donation, PayPal collects and processes payment and identifying information in accordance with PayPal’s privacy practices. We receive confirmation of the donation and associated basic details (such as your name and the donation amount). We do not receive or store your full payment card details. Please consult PayPal directly if you have questions about how they process your payment information.

Sharing your personal data We will not sell your personal data. We may share personal data with:

  • Service providers acting on our behalf (for example, web hosting, analytics, email delivery and payment processors such as PayPal). These providers are contractually required to protect your data and process it only as instructed.

  • Legal, regulatory or law enforcement authorities where we are required to do so by law.

  • Third parties where you have given consent to share information.

International transfers: Some service providers (including Squarespace and PayPal) may process or store personal data outside the UK. Where data is transferred outside the UK or EEA we will ensure appropriate safeguards are in place (for example, standard contractual clauses or other legal mechanisms) to provide an adequate level of protection.

Data retention: We retain personal data for as long as necessary for the purposes for which it was collected, to fulfil legal obligations, resolve disputes and enforce our agreements. Specific retention periods depend on the nature of the data and the purposes of processing (for example, donation records are kept for a period required for accounting and tax compliance).

Security: We take reasonable steps to ensure compliance with all security-based measures.