Website and marketing privacy policy

Data Protection Officer

We have appointed a Data Protection Officer, who is responsible for overseeing Nomad’s ongoing commitment to data protection and privacy. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact our Data Protection Officer using the details set out below.

How to contact us

Email address: dpo@nomadrail.com

Postal address: FAO Data Protection Officer, Nomad Digital, One Trinity, 5th Floor, Broad Chare, Newcastle upon Tyne, United Kingdom NE1 2HF

Telephone number: +44 (0) 3300889320

Your right to complain

You have the right to make a complaint at any time to the ICO or your local supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach the ICO or your local supervisory authority, so please Contact Us in the first instance.

You can contact the ICO on 0303 123 1113 or www.ico.org.uk/concerns.

If you are based outside the UK, you have the right to lodge your complaint with the supervisory authority in your country of residence.

Personal data that we collect about you

Personal data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed.

We may collect, use, store and/or transfer different kinds of personal data about you, which we have grouped together as follows:

• Identity Data – includes your first name, last name, title, the company that you work for and the geographic region in which you are located
• Contact Data – includes your email address
• Usage Data – includes information about how you use our website, products, services and solutions
• Marketing and Communications Data – includes your preferences in receiving marketing from us

Please note that we do not collect any special categories of personal data about you. This includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data.

How is your personal data collected?

You may give us your Identity, Contact, and Marketing and Communications Data by filling in forms, or by corresponding with us by email or otherwise. This includes personal data that you provide us with when you request marketing to be sent to you.

If you do not agree with how we will process your personal data (i.e. in accordance with this privacy notice), then we ask you not to provide your personal data to us.

How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where you have provided your consent
• Where it is necessary for our legitimate interests, e.g. where we have business or commercial reasons to use your personal data, however, we will never put our legitimate interests about what is best for you

The below table demonstrates the purposes for which we may use your personal data, including the type of personal data and the lawful basis:

Personal corporate email addresses

We may collect your personal corporate email address when – for example – we exchange business cards with you at an event, or as part of our day-to-day business relationship with you. Whilst personal corporate email addresses – i.e. firstname.lastname@company.com – constitute personal data and will be subject to the relevant data protection legislation, they generally do not benefit from the rules on direct marketing and consent. This means that organisations – including Nomad Digital – may market to you by email without receiving your opt-in consent. That said, it serves little purpose for us to contact you if you do not want to hear from us, so you can unsubscribe at any time. You will always be given a clear opportunity to unsubscribe each time you receive a communication from us.

Third parties

We do not share your personal data with any third parties outside the Group unless we are legally required to do so. We may disclose your personal data if we are under a legal obligation to do so, to prevent fraud, or to protect our rights, property, or the safety of our customers, suppliers or employees.

We may share your personal data in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets, or if we or substantially all of our assets are acquired by a third party, in which case personal data held by us will be one of the transferred assets.

If your personal data is provided to any third parties, you are entitled to request details of the recipients of your personal data or the categories of recipients of your personal data.

Cookies

You can set your browser to disable cookies. If you disable cookies, some parts of our website may become inaccessible or not function properly. For more information about how we use cookies, please refer to our Cookies Policy.

Change of purpose

We will only use your personal data for the purposes for which we originally collected it. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis upon which we propose to do so.

International transfers

We may share your personal data within the Group. This may involve transferring your personal data outside the European Economic Area (“EEA”), including Australia, the USA, Canada and the UK (post-Brexit).

With the exception of the USA, Australia and the UK (post-Brexit), all Group entities are situated in countries that have received some form of adequacy decision by the European Commission, meaning that ND only transfers your personal data to and between countries where they are deemed to provide an adequate level of protection and have appropriate data protection and security practices in place. The transfer of personal data between ND entities – including the USA, Australia and the UK – is nevertheless governed by the Standard Contractual Clauses in their entirety and without amendment, which all ND entities have signed up to. The transfer of personal data between ND entities is subject to regular review; ND regards its current safeguards as appropriate.

There may be exceptional circumstances where your personal data is transferred outside of the Group, to a country not covered by the GDPR or in receipt of some form of adequacy decision by the European Commission. If this happens, ND will ensure that your personal data is transferred in such a way that is adequately safeguarded, either by ensuring that the Standard Contractual Clauses are in place or – more likely – by managing the flow of your personal data to ensure that any transfer to a non-Group third-party occurs in-country.

Data security

We have put in place appropriate security measures to prevent your personal data being accidentally lost, used or accessed in an unauthorised way, or altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach, and we will notify you and any applicable supervisory authority of a breach where we are legally required to do so. We are obliged to notify the Information Commissioners Office without undue delay, and where feasible, no later than 72 hours of becoming aware of a personal data breach, unless we consider that the personal data breach is unlikely to result in a risk to your rights and freedoms.

In relation to its EU entities, ND previously relied on the One-Stop-Shop concept, meaning that the ICO would be the lead authority in relation to cross-border processing. In practice, this meant that, if – for example – ND needed to report a personal data breach involving data subjects in the UK, France and Belgium, it would report to the ICO (as its local supervisory authority) and the ICO would investigate in the context of the UK, France and Belgium. Post-Brexit, however, ND will be unable to continue to rely on the One-Stop-Shop concept. As a result, in the example of a personal data breach involving data subjects in the UK, France and Belgium, ND would report to the ICO plus one of France or Belgium (who would act as the One-Stop-Shop for affected data subjects in the EU).

Data retention

We will only retain your personal data for as long as is necessary to fulfil the purposes for which we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. You may also provide information to us when completing forms on our website. In these circumstances, this information will be held by us for 30 days before being deleted. Please note, however, any information provided to us for marketing purposes will only be deleted when you unsubscribe.

In certain circumstances, we may anonymise your personal data so that it can no longer be associated with you so that we can use this for business planning and other business uses which are in our legitimate interests. When we do this, we may use such anonymised information without further notice to you.