THE POLAR EXPRESS™ Train Ride at Wensleydale Railway ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website (https://yorkshiredalesthepolarexpressride.com) and participate in our event. We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our services, you agree to the terms of this Privacy Policy.

PNP Events Ltd, the organiser of THE POLAR EXPRESS™ Train Ride at Wensleydale Railway, is the data controller responsible for your personal data. If you have any questions regarding this policy or your rights, you can contact us at:

PNP Events Ltd
Unit J12, Halesfield 19, Telford, TF7 4QT

[email protected]
01952 946 050

Information You Provide Directly

• Name

• Email address

• Postal address

• Phone number

• Payment details (processed via third-party payment providers)

• Any additional information provided via customer support queries

Information We collect automatically

• IP address

• Browser type and version

• Device type and operating system

• Referring website

• Behavioural data (pages visited, time spent on site, etc.)

Information from third parties

We may receive personal data from third parties, such as ticketing platforms, marketing affiliates, and social media platforms, where applicable and where You have opt-in.

We use your personal data for the following purposes:

• Customer Support: To handle enquiries, complaints, or refund requests.

• Marketing & Communications: To send promotional emails and newsletters if you have opted in. We will use Your data if you have opted into marketing and communications via our ticketing partner also.

• Security & Fraud Prevention: To protect against unauthorised access and fraud.

• Legal Compliance: To comply with UK laws, including tax and accounting requirements.

• Website Analytics: To improve our website functionality and user experience.

Please note. Our ticketing partner, Etix, will process Your personal data in order to process Your bookings, verify payments and send confirmations. You can see the Etix privacy policy on their website

We process your data based on the following lawful grounds:

• Contractual Necessity: When processing is necessary for fulfilling your ticket purchase or providing event-related services.

• Legitimate Interests: When processing is in our legitimate business interest, such as improving customer service, securing transactions, and marketing.

• Consent: When you have explicitly given us permission (e.g., opting into marketing emails).

• Legal Obligations: When required to comply with legal obligations (e.g., tax records, fraud prevention).

We do not sell your personal data. However, we may share your data with:

• Event Partners: Wensleydale Railway for operational event purposes.

• Booking Platform: Etix.com where your booking is processed.

• Customer services: Secure third-party services such as Freshworks and Microsoft for customer service purposes.

• Payment Processors: Secure third-party services such as Stripe to handle payments.

• Marketing Providers: Email and digital marketing services for promotional content (only if you have opted in). This includes, Meta, Google, Brevo & Microsoft

• IT & Security Providers: Cloud hosting and cybersecurity services.

• Legal Authorities: If required by law or for fraud prevention.

All third parties are required to process your data securely and in compliance with GDPR.

If we transfer your data outside the UK, we ensure appropriate safeguards, such as:

• UK GDPR-compliant contractual clauses.

• Transfers to countries deemed adequate by the UK Government.

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Ticket purchase data: Retained for up to 7 years (for tax and legal obligations).

• Marketing data: Retained until you opt out.

• Customer support records: Retained for up to 3 years.

When no longer required, your data is securely deleted or anonymised.

Under the UK GDPR, you have the following rights:

• Right to Access: Request a copy of your data.

• Right to Rectification: Request correction of inaccurate data.

• Right to Erasure: Request deletion of your data under certain conditions.

• Right to Restrict Processing: Limit how we use your data.

• Right to Data Portability: Obtain your data in a transferable format.

• Right to Object: Object to processing based on legitimate interests or direct marketing.

• Right to Withdraw Consent: If processing is based on consent, you may withdraw at any time.

To exercise these rights, contact us at [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO) (https://ico.org.uk) if you believe your rights have been violated.

We use cookies to improve user experience.

We may update this Privacy Policy. Any changes will be posted on this page, and, where necessary, we will notify you via email or website pop-ups.

This Privacy Policy is in compliance with the UK GDPR and the Data Protection Act 2018.