Northern Recover and Resolution Team Privacy Notice

1. What personal data do we collect?
2. Cookies
3. How do we use your personal data and what is the legal basis for such processing?
4. Sharing your information
5. Data retention
6. Information security
7. Updates to this Privacy Notice
8. Your data protection rights
9. Questions about this Privacy Notice

Date published: 24 September 2026

Date last updated: 24 September 2026

Northern Trains Ltd (“We”) are committed to protecting and respecting your privacy.

This policy (together with our Website Terms and Conditions and Conditions of Travel) sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.  Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting northernrailway.co.uk/PayMyNotice or providing your information in the circumstances described below, you are accepting and consenting to the practices described in this policy.

In accordance with the Data Protection Act 2018 (the “Act”), the data controller is Northern Trains Ltd, and the data processors are PCI Telecoms Ltd, Raspberry Software Solutions Ltd, Carlisle Security Services Ltd and Amulet (Churchill Security Solutions) Ltd.

Individuals are advised that when using the “Website”, those pages with a web address prefixed by www.northernrailway.co.uk these pages are managed by Northern as the data controller (a company registered in England and Wales with registration number 0307644 and registered to Albany House, Floor 8, 94-98 Petty France, London SW1H 9EA).

Individuals who pay notices from Northern are advised that the “Pay My Notice” transactional pages prefixed by www.pcitelecom.uk/northernrailway are managed by  PCI Telecoms Ltd as Northern’s data processor and processor of payments (a company registered in England and Wales with a registration number of 10310998 and registered to 35 Croft Road, Thame, Oxfordshire, OX9 3JF).

Individuals who provide personal information to Northern during a fare dispute or enforcement action are advised that the electronic application used is managed by Raspberry Software Solutions Ltd as Northern’s data processor (a company registered in England and Wales with a registration number of 07979037 and registered to 9 Deben Mill Business Centre, Old Maltings Approach, Melton, Woodbridge, Suffolk,  IP12 1BL).

Individuals who provide personal information to Northern during a fare dispute or enforcement action are advised that personnel inputting this data are managed by either Northern or Carlisle Security Services as Northern’s data processor (a company registered in England and Wales with a registration number of 02654100 and registered to 800 The Boulevard, Capability Green, Luton, LU1 3BA).  Alternatively, Amulet (Churchill Security Solutions) Ltd also acts as Northern’s data processor (a company registered in England and Wales with a registration number of 07317266 and registered to First Floor, Cedar House, Parkland Square, 750a Capability Green, Luton, LU1 3LU).

References to “Northern”, “Northern Railway”, “we”, “us” or “our” can also refer to our data processor PCI Telecoms Ltd who processes payments and information on our behalf; Raspberry Software Solutions Ltd who manages the electronic application; Carlisle Support Services who manages Revenue Enforcement Officers; or Amulet (Churchill Security Solutions) Ltd who manages Travel Safety Officers.

1.    What personal data do we collect?

Information provided by you

You may give us information about you by filling in forms on our site www.pcitelecom.uk/northernrailway or by corresponding with us by phone, email, or otherwise.  This includes information provided to our Revenue Enforcement Officers or Travel Safety Officers.  The information you give us may include your name, address, email address, phone number, date of birth, financial and credit card information, personal description, photograph, image, and geographical location.

Information we collect about you

With regard to each of your visits to our sites, we may automatically collect the following information:

• Technical information including the internet protocol (IP) address used to connect your computer to the internet, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform.
• Information about your visit including the full Uniform Resource Locators (URL) clickstream, to, through and from our sites (including date and time); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.

Information we receive from other sources

We may receive information about you if you use any of the other websites we operate or the other services we provide.  We are also working closely with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them.

Sensitive personal data

We will not intentionally or systematically seek to collect, store or otherwise use information about you classed as ‘special categories of data’ or ‘sensitive data’) for example, information relating to any trade union membership, ethnic origin or health.

2.    Cookies

Our site uses cookies to distinguish you from other users of our site.  This helps us to provide you with a good experience when you browse our site and also allows us to improve our site.  For detailed information on the cookies we use and the purposes for which we use them, see our Cookie Policy.

3.    How do we use your personal data and what is the legal basis for such processing?

The collection of the personal data described above is usually mandatory and, if such personal data is not provided, we will not be able to provide the information, products, and services to you. Where the collection of any personal data is not mandatory, we will inform you of this prior to collection, as well as the consequences of failing to provide the relevant personal data.

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific content in which we collect it.

However, we will normally process your personal information only:

• Where we have your consent to do so;
• Where the processing is necessary to perform our contract with you; or
• Where the processing is in our legitimate interests or those of a third party and such interests are not overridden by your data protection interests or fundamental rights and freedoms; and 
• Where we have a legal obligation to process your personal information

Information provided by you

We use your personal information as follows:

Information we collect about you

We use your personal information as follows:

Information we receive from other sources

We may combine this information with information you give to us and information we collect about you.   We may use this information and the combined information for the purposes set out above (depending on the types of information we receive).

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “Questions about this Privacy Notice” heading below.

4.    Sharing Your Information

We may disclose your personal data to the following categories of recipients for the purposes described in this Privacy Notice:

• PCI Telecoms Ltd, payment of notices
• Raspberry Software Solutions Ltd, processing fare disputes
• Carlisle Security Services, processing fare disputes and anti-social behaviour disputes
• Amulet (Churchill Security Solutions) Ltd, processing anti-social behaviour disputes

We may also disclose your personal data to any competent law enforcement body, regulator, government agency or other third parties, where we believe disclosure is necessary (i) as a matter of applicable law or regulation; (ii) to exercise, establish or defend or legal rights; or (iii) to protect your vital interests or those of any other person.

We may also transfer your personal data to a buyer or potential buyer (and its agents and advertisers) in connection with any reorganisation, restricting, merger or sale, or other transferring of assets provided that we inform any receiving party it must use your personal information only for the purposes disclosed in this Privacy Notice.

Finally, we may disclose your data to any other person to whom you request us to make disclosure or if you consent to such disclosure.

5.    Data Retention

We will not retain your personal data for longer than is necessary to fulfil the purposes for which we collected that personal information, unless the law permits or requires that we retain it for longer.

The table below explains in more detail how long Northern will store different types of customer information:

6.    Information Security

We apply appropriate administrative, technical, and organisational security measures to protect your personal data that is under our control from unauthorised access, collection, use, disclosure, copying, modification, or disposal. All information you provide to us is stored on secure servers. We provide routine training to our employees on our data privacy policies and procedures and permit authorised employees to access personal data on a need to know basis, as required for their role. We also take steps to ensure that any service provider that we engage to process personal data on our behalf takes appropriate technical and organisational measures to safeguard personal data.

7.    Updates to this Privacy Notice

We may update this Privacy Notice from time to time in response to changing legal, technical, or business developments. When we update our Privacy Notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Notice changes if and where this is required by applicable data protection laws. You can see when this Privacy Notice was last updated by checking the “last updated” date displayed at the top of this Privacy Notice.

8.    Your Data Protection Rights

You have the following data protection rights:

• If you wish to access, correct, update or request deletion of your personal information, you can do so at any time by contacting our Customer Experience Centre on 0800 200 6060 or via email at [email protected].  Alternatively, you can write to the Customer Experience Centre at FREEPOST Northern Railway.
• In addition, you can object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. Again, you can exercise these rights by contacting us as above.
• If we have collected and processed your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with the applicable data protection laws.

9.    Questions about this Privacy Notice

If you have any questions, concerns or complaints about this privacy notice or our handling of your personal data, you can contact us by:

Email 

[email protected]

Post

Northern Trains Ltd, Data Protection Officer, George Stephenson House, Toft Green, York, YO1 6JT

You can also lodge a complaint with your national supervisory data protection authority. In the UK, the data protection authority is the Information Commissioner's Office, contactable via:

Post

Information Commissioner's Office, Wycliffe house, Water lane, Wilmslow, Cheshire, SK9 5AF

Telephone number

0303 123 1113 (local rate)

01625 545 745 if you prefer to use a national rate number