On Track Group ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and share personal information when you visit our website, apply for a role, engage our services or otherwise interact with us. It is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
On Track Group is the data controller responsible for your personal data. Our registered address is 4th Floor 14 Museum Place, City Centre, Cardiff, Wales, CF10 3BH. You can contact our Data Protection team at info@ontrack.group.
2. The data we collect
We may collect and process the following categories of personal data:
- Identity & contact data includes name, job title, employer, email address, phone number, postal address.
- Recruitment data includes CV, work history, qualifications, certifications, right-to-work documentation, references.
- Client & commercial data includes company name, billing details, project requirements, correspondence.
- Technical data includes IP address, browser type, device information, pages visited, referring URL.
- Marketing preferences covers your consent choices for newsletters and updates.
3. How we use your data (lawful bases)
We process personal data on the following lawful bases under Article 6 UK GDPR:
- Contract basis to deliver maintenance, engineering and recruitment services.
- Legitimate interests to manage client relationships, respond to enquiries, improve our website and prevent fraud.
- Legal obligation to comply with tax, employment, health & safety and rail-industry regulations.
- Consent for marketing communications and non-essential cookies (which you may withdraw at any time).
4. Sharing your data
We share personal data only where necessary, with:
- Clients and end employers (for recruitment candidates) with your prior consent.
- Vetted suppliers and processors (IT, payroll, hosting, communications) under written data-processing agreements.
- Regulators, auditors and law-enforcement bodies where legally required.
We never sell your personal data.
5. International transfers
Where personal data is transferred outside the UK or EEA, we rely on safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision.
6. Data retention
We keep personal data only for as long as necessary for the purposes for which it was collected, including any legal, accounting or reporting requirements. Recruitment records are typically held for up to 2 years after the last contact (or longer with your consent). Client contract records are held for 7 years for accounting and audit purposes.
7. Your rights under UK GDPR
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request erasure ("right to be forgotten") in certain circumstances.
- Restrict or object to our processing.
- Request data portability.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk).
To exercise any of these rights, email info@ontrack.group. We will respond within one month.
8. Security
We use appropriate organisational and technical measures to protect personal data from unauthorised access, loss or disclosure, including access controls, encryption in transit, staff training and regular security reviews.
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated on this page with an updated revision date.