Privacy Notice

We recognise the importance of protecting your personal data and privacy, this Privacy Notice sets out how the Railway Children in the UK, Railway Children (Railway Children, we, us or our) may collect and process your personal data.   

This Privacy Notice was last updated on Friday 12th December 2025, however we may need to make changes to it, for example to reflect changes to the law or changes in how we process personal data. As such, please do regularly check our website https://www.railwaychildren.org.uk/privacy-policy/ for the latest version of the Privacy Notice.  

 

About us

The Railway Children Organisation is a charity started in 1996 which aims to keep street connected children safe. We work in partnership with transport operators and have set up safety nets across transport networks in the UK, India and Tanzania to change the lives of vulnerable children at risk of a life on the streets.    

In order for us to provide our support, we will need to process certain personal data. We are registered at the ICO as a data controller, which means we determine the purpose for which personal data is collected and can be used in compliance with UK data protection laws: the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025 (together referred to as Data Protection Laws). 

This Privacy Notice does not cover the processing of personal data of any children that we may collect carrying out our services.  We have a separate privacy notice for this which is available on request from hello@railwaychildren.org.uk. 

 

How and when we collect personal information

We collect personal information in the following ways: 

• When directly given to us by a person: this could be if a question is asked about our activities, registration for an event, making a donation, asking a question about supporting our work, purchasing something, applying for a job or volunteering opportunity, giving feedback or making a complaint, or signing up and taking part in our training programme. Communication may be by telephone, via the website, by post, email or direct message on social media channels. 

• Indirectly: interaction with us on social media platforms such as Facebook, WhatsApp, Instagram, YouTube or LinkedIn includes some personal information such as IP address. The amount of information we receive will depend on the privacy preferences set on each platform. 

• Through partners or third parties working on our behalf: this could be from one of the other third parties that we work with (for example Enthuse, JustGiving or Virgin Money Giving). 

 

Facebook Marketing

We participate in Facebook’s ‘Custom Audience’ program, which enables us to display adverts to existing supporters when they visit Facebook. We may provide personal information i e email address, mobile number and address to Facebook, so they can determine whether the person is a registered account holder with them. Our adverts may then appear when that person accesses Facebook. 

The data is sent in an encrypted format that is deleted by Facebook if it does not match with a Facebook account. 

For more information please see Facebook Business and Facebook’s  Data Policy. 

Collection of Data through ‘Cookies’ 

Cookies are widely used text files containing small amounts of information which are downloaded to a computer or mobile device when visiting a certain webpage to make a website work efficiently, as well as to provide information to the owners of a website. Cookies are sent back to the originating webpage on each subsequent visit or to another webpage that recognises that cookie. 

When you have consented we use cookies to: 

• Track traffic flow and browsing patterns in connection with our website 

• Understand the total number of visitors to our website on an ongoing basis and the types of internet browsers (e.g. Firefox, Chrome, Internet Explorer, Safari or Opera) and operating systems (e.g. Windows or Mac OS) used by our visitors 

• Monitor the overall performance of the website and continually improve it 

• Help to identify and resolve errors that visitors encounter on the website 

• Customise and enhance your online experience 

• Enable Railway Children and third parties to advertise both on and off the website. 

For more detail on our cookie policy and a description of the cookies we use please see our cookie policy https://www.railwaychildren.org.uk/cookie-policy/ 

 

Information we collect and why we use it

When people engage with us we collect information about them. This may include name, address, email address, telephone number, date of birth, job title, bank or credit/debit card details (if making a donation or purchase), and details of education and career. 

 

Special Category Information

Special category information is more sensitive personal information and includes information relating to racial or ethnic origin, religious or philosophical beliefs and political opinions, trade union membership, genetic or biometric data, health or a person’s sex life or sexual orientation. 

Special category information is treated that with additional care and confidentiality. 

If you are required to provide any personal data to us which relates to other individuals, such as family members, you agree that you will inform them about the contents of this Privacy Notice and obtain any required consent in accordance with this Privacy Notice. 

 

Job Candidates and Volunteers applying to work at Railway Children

We collect data through the hiring process and once candidates have been recruited as staff or volunteers at Railway Children.  If you provide us with details of anyone else (e.g. references, emergency contacts or family members etc.) you should also show this Privacy Notice to them. 

To view and download our Privacy notice specific to Job applicants visit Railway Children charity job vacancies. 

 

Personal information of those 18 or under

For a person aged 18 or under, they must get their parent/guardian’s permission before they provide any personal information to us and in some circumstances we will ask for parent/guardian to provide consent to us in addition to your permission. 

 

How we use your information

We mainly use personal information for: 

• Donation processing or transactional purposes: to process donations or other payments, to claim Gift Aid on donations and verify any financial transactions. We need to use personal information in order to carry out our obligations arising from any contracts entered into for goods or services, for example, processing an order and payment for a product from our Christmas Card shop. 

• Responding to a request: to provide the services or information requested, for example in response to a query or complaint or attending our Safeguarding on Transport training course. 

• Administration: to update supporters with important administrative messages about donations, a campaign or services, or to record and deal with a complaint, record a request not to receive further marking information, record what our volunteers have done and for other essential internal record keeping. 

• Developing, monitoring and evaluating our services: we may use personal information to improve current and future delivery of our services. For example we may create profiles to test advertising campaigns on social media or to evaluate the effectiveness of our programmes. 

• Processing an application to work with us: we need to process information if we are sent an application form or CV or details in order to evaluate suitability and respond or to administer the working arrangement. 

• Employment: we need to ensure that we meet our obligations as an employer and manage people effectively in the organisation. 

• Working with children and young people: we collect essential information to enable us to safeguard the children and young people we work with, for example, in campaigns or events. 

• Fundraising, direct marketing or campaigning: we will only send marketing information by email, or SMS if we have been given your consent. If consent is withdrawn and opt in to receive marketing information is received subsequently, then the most recent preference will supersede an earlier one. 

• Providing and developing our website: we use personal information to help provide with access to our website, personalise experiences, and improve and develop it further. 

• Market research and surveys: we use surveys or market research to help improve our website, fundraising, services and strategic development. Participation is voluntary and no individuals will be identified as a result of this research, unless we have consent to publish feedback. 

• Legal, regulatory and tax compliance: we may process personal information to fulfil obligations we are subject to. 

• Profiling and analysis: we want to improve the information we provide through our website, services, products and information. For the purposes of our legitimate interests we may use personal information to conduct profiling of supporters or potential supporters so that we can better understand our supporter’s preferences. This helps us communication in a more focused, efficient and cost-effective way. Our profiling and analysis activities can be broken into categories below: 

1. i) Data matching

We may combine the personal information we hold with data obtained from external sources, such as the Office for National Statistics or social media, to infer social, demographic and financial characteristics, so we can tailor communications and services to better meet supporters’ needs or the needs of others based on the insight we gain from the profile we build. We will not use the results of this data matching activity in a way that intrudes on anyone’s privacy or previously expressed privacy preferences. 

1. ii) Segmenting

We conduct analysis of supporters by group, post code or particular area where supporters may be based, and area of work they have supported in the past. This is to ensure that campaigns or mailings are sent to those who will be most interested or likely to respond. This type of activity is not aimed at identifying specific individuals to target, but rather many individuals who fall within a certain segment of supporters. 

iii) Major donor analysis 

We undertake in-house research and from time to time engage specialist agencies to gather information about you from publicly available sources, for example, Companies House, the Electoral Register, company websites, ‘rich lists’, social networks such as Linkedin, political and property registers and news archives.   

We may also carry out wealth screening to fast track the research using our trusted third party partners.  You will always have the right to opt out of this processing. We may also carry out research using publicly available information to identify individuals who may have an affinity to our cause but with whom we are not already in touch. This may include people connected to our current major supporters, trustees or other lead volunteers. We also use publicly available sources to carry out due diligence on donors in line with the charity’s Gift Acceptance Policy and to meet money laundering regulations. 

The type of information we collect can include: 

• Career overview 

• Gift capacity 

• Areas of interest 

• History of giving to us and others 

• How the individual is connected with us and others 

• Publicly available information on any philanthropic activities. 

If you would prefer us not to use your data in this way, please email us at hello@railwaychildren.org.uk or call us on 01270 757596  

 

1. iv) Networking and High Value event planning

We use publicly available information to produce short biographies of people who are due to meet with our leadership or attend an event we are hosting. 

1. v) Ethical screening and minimising risk

Railway Children is registered with the Fundraising Regulator. We ensure all our fundraising is compliant with the Code of Fundraising Practice. We carry out appropriate due diligence of donors, check donations and implement robust financial controls to help protect the charity from abuse, fraud and/or money laundering and/or terrorist financing before we accept a donation. 

We screen supporters to minimise risk of creating an association with an individual or group that conflicts with the standards set out in our ethical policy. 

 

Lawful Basis

Data protection legislation identifies a number of lawful basis on which personal data may be processed. We need to identify the purpose for processing the data and the most appropriate lawful basis for doing so. 

Most of our processing of personal data is carried out on the basis of consent. Consent must be informed, freely given, specific and unambiguous. The information provided in this Privacy Notice is the information needed for informed consent to be given. 

Consent maybe withdrawn. If you want to stop or change our use of your personal data for marketing and fundraising activities, you can do so at any time by contacting our supporter services team hello@railwaychildren.org.uk. 

 

Legitimate interests

We rely on this lawful basis when it is necessary for a legitimate business interest of the organisation or a third party to use personal data as long as its use does not unduly impact the rights of the individual concerned. For example 

• Where we contact you via post about the various ways you can help Railway Children 

• Sending information or updates about donations, events,  

• Using personal information for data analysis or profiling 

• Conducting research to better understand who our supporters are and improve the way we communicate 

• To improve our services or for our legal purposes, for example, dealing with complaints and claims. 

• Contacting you or your employer with regard to a training programme 

Before processing on this basis we carry out a Legitimate Interest Test. 

 

Sharing personal information

We will only use personal information for the purposes for which it was obtained. This may include sharing within the organisations that make up Railway Children . We will not sell or share personal information with any third party for their purposes and no one will receive marketing from any other companies, charities or other organisations as a result of giving your details to us. 

We share personal data for the following purposes: 

• Third party suppliers: we share information with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. These providers act under our instruction and are subject to pre-contract scrutiny and contractual obligations. 

• Where legally required: where disclosure is required by law, for example, to the government for tax investigation purposes, or to law enforcement agencies for the prevention and detection of crime. We may also share personal information with the emergency services if we reasonably think there is a risk of serious harm or abuse to a person. 

 

Keeping your details up to date

We will use publicly available sources to ensure that the information we hold is accurate and up to date. For example, where a redirection service is signed up to, we use the Post Office’s National Change of Address database to keep in touch. We may use other services to cross-check the accuracy of the contact details we hold. 

Changes of address or other details can be notified by contacting us at the address given below. 

 

Keeping your information safe

Protecting your personal data is a serious responsibility in which we take great care.  We implement a range of technical, physical and organisational measures to ensure that your personal data is kept confidential and secure; these include but are not limited to 

1. role based access controls to restrict view of personal data to those who have a necessity to access or process the data for the purposes set out in this Privacy Notice  

1. maintaining our internal data protection and security policies which govern the use, storage, protection and general processing of personal data including considering updates to policies where necessary; 

1. implementing firewalls, password protections and encryption; and 

1. delivering mandatory regular data protection training to all employees  

1. Any debit or credit card details which we receive on our website are passed securely to our payment processing partner, in accordance with  the Payment Card Industry Security Standards. 

 

International transfers of information

The personal data that we collect from you may be transferred to and processed in a country/jurisdiction which is outside of the UK and/or the European Economic Area (which means all the European Union (EU) countries plus Norway, Iceland and Liechtenstein, together EEA). For example, we may need to share your personal data with our partnered companies, our other offices in India or Tanzania or with our suppliers who may be based in or operating in countries outside of the UK and/or the EEA. 

If we were to transfer your data outside of the EEA, we would ensure that that appropriate protective measures are in place to keep your personal data safe.  At the least, we will comply with guidelines set by UK Data Protection Laws such as entering into the UK’s International Data Transfer Agreement with the recipient to whom we are transferring personal data to (this is a set of contractual wording which has been issued by the UK’s data protection regulator to safeguard transfers compliantly in accordance with Data Protection Laws).  

 

How long we hold your information for

We only keep your information if it is reasonable and necessary for the relevant activity and in line with our Data retention Policy – Contact hello@railwaychildren.org.uk 

Feel free to contact us via the details in section ‎10 if you have any questions or would like more information on our retention of your personal data 

 

Data Subject Rights 

There is a right to request the following 

1. the right to access your personal data: you are entitled to a copy of the personal data we hold about you and certain details of how we process it;  

1. the right to rectification: you can ask us to correct any information about you that may be out of date, incorrect or incomplete; 

1. ​​​​​​​the right to restrict processing: you are entitled to ask us to stop using your personal data in limited circumstances, for example where you think the personal data we hold about you is inaccurate or no longer necessary;  

1. right to erasure: you have the right to ask us to erase your personal data in certain circumstances, for example where you withdraw your consent (if we rely on consent) or where the personal data we obtained is no longer necessary for the original purpose. However, please note that this right, will need to be balanced against other factors such as our legal obligations which mean we cannot comply with your request; 

1. right to data portability: you have the right, under certain circumstances, to ask that we transfer personal data that you have provided to us to another third party of your choice; 

1. the right to object to marketing: you can ask us to stop sending you marketing messages at any time. You can exercise this right by clicking on the “unsubscribe” link which is contained in any email that we send to you;  

1. ​​​​​​​the right to object to processing: where we process your personal data based on our legitimate business interests (as indicated in this Privacy Notice), you can object to our processing, however whilst will always consider your objection, please note that such objection will only be carried out if legitimate business interests prejudice your privacy rights;  

1. the right to withdraw consent: we have set out above where we may ask for your consent for certain uses of your personal data however you have the right to withdraw your consent at any time;  

1. rights related to automated decision-making: you can ask us to review automated decisions we make about you, and you can ask us to not hold you to a decision that is been made solely in an automated way.  

1. right to lodge a complaint with the UK’s data protection regulator, the Information Commissioner’s Office (ICO) at the ICO website: https://ico.org.uk/. Making a compliant will not affect any of your legal rights or remedies under the Privacy Notice but we encourage you to contact us first if you have any ​​complaints​​​​​​ so that we can have an opportunity to resolve your complaint.   

Please note that not all of your data subject rights will be absolute if we cannot comply with your request, we will tell you the reason and we will always respond to any request you make. This is because there may be some circumstances where we may not be able to comply with your request for example if it would conflict with our responsibility to comply with our legal obligations. 

Notification of changes to this Privacy Notice

Please visit this page to keep up-to-date with the changes to our Privacy Notice. This version was last updated on Friday 12th December 2025 at 18:03.

 

Concerned about our use of personal data?

Please talk to us directly so we can help resolve any problem or query.  

Our Supporter Services Team will be happy to help resolve any issues, queries or concerns: 

Supporter Services Team
Telephone: 01270 757596 Email: supporterservices@railwaychildren.org.uk 
Railway Children, Unit 1, Unipart Rail, Gresty Road, Crewe, CW2 6EH  

 

The fundraising preference service (FPS) service is run by the Fundraising Regulator and allows a person to stop email, telephone, addressed post, and/or text messages from a selected charity or charities by using the online service or by calling 0300 303 3517. Once a request is made through the FPS, we will ensure that your new preferences take effect within 28 days. 

Alternatively, contact our Data Protection Officer Kath Backhouse 

Email: k.backhouse@railwaychildren.org.uk