Privacy Policy

UK TRAIN DRIVER ACADEMY LTD (trading as Train Driver Foundation (TDF)) is the data controller for personal data collected through this website. Our registered company number is 13240841.

For any data protection enquiries, contact our Data Controller at datacontroller@traindriverfoundation.com.

We collect only the information we need to provide our services:

• Contact enquiries: your name, email address and the content of any message you send us through the contact form.
• Newsletter sign-ups: your email address and the sign-up source.
• Purchases: billing name, email and payment details handled by our payment provider (Stripe). We do not store card or bank details on our servers.
• Course access & post-checkout pages: the CV files, answers or uploads you choose to submit after purchasing a product (e.g. CV Review).
• Website usage: anonymous technical data such as pages visited, timestamps, referrer, approximate location (country/region) and device/browser type.

We use personal data to:

• Reply to your enquiries through the contact form.
• Deliver the products and services you have purchased.
• Send newsletter updates where you have opted in.
• Provide, maintain and improve our website and courses.
• Comply with our legal and accounting obligations.
• Protect the site from fraud, abuse and security threats.

We do not sell your personal data and we do not use it for automated decision-making or profiling.

We rely on the following UK GDPR legal bases:

• Contract: to deliver products and services you have purchased.
• Consent: for marketing emails, newsletter sign-ups and any non-essential cookies.
• Legitimate interests: to respond to your enquiries, secure our site and improve our services, in a way that does not override your rights.
• Legal obligation: for financial, accounting and regulatory record-keeping.

We only share personal data with trusted processors who help us operate the service. They are contractually bound to process data only on our instructions. Our current processors include:

• Stripe — secure payment processing for product purchases.
• Resend — transactional and newsletter email delivery.
• MongoDB Atlas — encrypted database hosting.
• Kuula — hosts the embedded 360° cab VR content.

We may also disclose personal data where required by law, court order, or to protect the rights, property or safety of our users, staff or the public.

Some of our processors (including Stripe and Resend) may transfer data outside the United Kingdom, including to the European Economic Area and the United States. Where this happens, we rely on adequacy decisions or Standard Contractual Clauses to ensure your data remains protected to UK GDPR standards.

We keep personal data only for as long as we need it for the purposes it was collected, including any legal, accounting or reporting requirements. Typical retention periods:

• Contact form enquiries: up to 24 months.
• Newsletter sign-ups: until you unsubscribe.
• Purchase records: 7 years for UK tax and accounting compliance.
• CV files and submissions: up to 12 months after your last activity, unless you ask us to delete sooner.
• Website analytics: up to 26 months.

Our site uses essential cookies to keep the site working and, where you consent, limited analytics cookies to understand how visitors use the site so we can improve it. We do not use third-party advertising or cross-site tracking cookies. You can control cookies through your browser settings at any time.

You have the following rights over your personal data. You can exercise any of them by emailing datacontroller@traindriverfoundation.com.

• Access — a copy of the data we hold about you.
• Rectification — correction of inaccurate data.
• Erasure — deletion of your data where applicable.
• Restriction — limiting how we use your data.
• Portability — a machine-readable copy of your data.
• Object — to direct marketing or legitimate-interest processing.
• Withdraw consent — at any time, where consent is our legal basis.

If you are unhappy with how we handle your data, you can also complain to the UK Information Commissioner's Office at ico.org.uk.

We use appropriate technical and organisational measures to protect your data, including HTTPS encryption, secure hosting, access controls and regular backups. No online service can be guaranteed 100% secure, but we take reasonable steps to reduce risk.

Our services are intended for adults (18+) preparing for a career in the UK rail industry. We do not knowingly collect personal data from children under 16. If you believe a child has submitted personal data, please contact us and we will delete it.

We may update this policy from time to time to reflect changes to our services or legal obligations. The "Last updated" date at the top of this page shows when it was last revised. Material changes will be communicated on the website or by email where appropriate.

For any questions about this policy or about how we handle your personal data, please contact: