Snowdon Mountain Railway Privacy Policy

Privacy statement

Dated: 5th December 2023
1. Who is responsible for managing my information?
This website is owned and maintained by
Heritage Attractions Limited
Registered office is:
5th Floor,
88 Church Street,
Liverpool
L1 3HD
England (“Heritage”, “we” or “us”).
This is our Privacy Notice and it explains how we collect, use, share and protect your personal data.
We are responsible for the collection and proper management of any personal information you give to
us. We will keep your personal details secure and use the information you provide consistently with
applicable privacy and data protection laws and the terms of this Privacy Notice.

2. What information do we collect?
The information we collect, and hold is likely to include your name, contact details, information about
your organisation and any additional information we may need to help meet your specific requirements.
We also collect website usage information and do this using “cookies”. For further information about
cookies and how we use them please see our Cookie Policy.

3. How do we use your information?
The information you provide/which we collect may be used in a number of ways, for example:
• to process, manage and administer bookings or orders you place with or through us;
• to enable us to provide products and/or services to you and/or your organisation;
• to answer questions, you have raised;
• to facilitate and improve your access to our websites;
• to personalise repeat visits to our websites;
• to help to ensure the safety and security of our staff and customer;
• in the prevention and investigation of crime;
• to tell you about events we think may be of interest to you;
• to tell you about other products and services we think may be of interest to you;
• to manage service queries;
• to conduct customer surveys and carry out research; and
• to help us to provide details or information you may have requested.
• To help us to manage and improve our operations

4. On what legal basis will we process your information?
We will always process your personal information on lawful grounds and in particular on the grounds set
out below: –
Performance of a Contract/Service
We will use your personal information to allow us to provide and manage the services or products you
have ordered or booked.
This information is likely to include your name, contact details (including email and telephone number)
and payment details, credit/debit card details, details of your visits to our websites (including, but not
limited to, traffic data, location data, weblogs and other communication data) and any additional
information we may need to help meet your specific requirements and to respond to your specific
requests.
If you do not provide us with the information set out in this paragraph, then we may not be able to
provide you with the products and/or services you have ordered or booked.
Legitimate Interest
We may use your name and contact details to tell you about our own products and services which we
think may be of interest to you. You can ask us to stop doing so at any time.
We may collect information about your computer, including where available, your IP address, operating
system and browser type, for system administration and marketing intelligence purposes. This is
statistical data about our users’ browsing actions and patterns and does not identify any individual. Your
IP address may also be used to diagnose problems with our server, monitor visitor traffic patterns and
site usage to help us develop and improve our site further.
In the event that we buy or sell any business and/or assets we may disclose your personal data to the
prospective buyer or seller of the business and/or assets
The above are done on the basis that they are in the legitimate interest of our managing, administering
developing and marketing our business.
Consent
We may ask your consent to share your name and contact details with selected third parties so that they
can tell you about their products and services.
You can withdraw your consent at any time.
Legal Obligation
We may also use and disclose your personal data for compliance purposes, to the extent that we are
required to do so by law or regulation, by a law enforcement or taxation agency or for the purposes of
preventing crime.

5. Who will you share my information with?
In order to provide you with the products and services that we supply and/or in our legitimate interests
we may share your information with:
• credit/debit card companies;
• our group companies;
• our preferred insurance provider(s) health and safety advisers and consultants; and
• other third parties who we may need to work with to deliver services or fulfil requests on your
behalf, for example ticketing companies and other suppliers.
We may also use and disclose your personal data for the purposes of compliance, to any legal or taxation
authority, in connection with any legal proceedings or prospective legal proceedings, in relation to the
prevention or investigation of crime and in order to establish, exercise or defend our legal rights.

6. How do you manage my information?
We may from time to time appoint third party service providers, to help us manage efficient systems
within the business. Some of these systems may for operational reasons be located in countries overseas.
We will only transfer your information to service providers who help manage our systems, or overseas,
where we are satisfied that this is lawful and that adequate levels of protection are in place to protect the
integrity and security of any information being processed and in compliance with applicable privacy laws.
We will always use and apply appropriate physical, electronic and procedural safeguards when we
process your personal data.
We will not transfer your personal data to service providers outside the United Kingdom and the
European Economic Area

7. Updating Your Details?
If you would like to change any of your preferences relating to the way in which we may use your information
for direct marketing, then please update your user preferences online at GDPR@heritagegb.co.uk

8. How long will we hold your information for?
We have a system of retention periods in place to ensure that your information is only stored whilst it is
required for the relevant purposes or to meet legal requirements. Where your information is no longer
required, we will ensure it is disposed of or deleted in a secure manner.
If you have any questions in relation to our retention periods, please contact us by sending an email to:
GDPR@heritagegb.co.uk.

9. Your rights
You have the right to ask us at any time: –
• to confirm whether we hold any of your personal data;
• to send you a copy of any personal data that we hold about you;
• to correct any inaccuracies in your personal data and to add relevant details where the personal
data we hold is incomplete;
• to delete (to the extent possible) any of your personal data, where we are required by law to do
so;
• to stop or restrict processing your personal data, where we are required by law to do so;
• to let you have a portable copy of the personal data we hold about you, where we are required
by law to do so;
• to stop processing any of your personal data that we process on the basis of our legitimate
interests; and
• to stop sending you marketing material. However please note that we may continue to send you
service related (i.e. non-marketing) communications, such as emails relating to the services we
provide.
If we reach a decision that affects you by processing your personal data automatically then you have the
right to speak to someone to discuss that decision.
We do not use your personal data for the purpose of profiling.
Where we process your personal data on the basis that you have given us your consent to do so then you
may contact us at any time to withdraw your consent
If you wish to exercise any of these rights or wish to object to our use of your personal information,
please contact us by email at: GDPR@heritagegb.co.uk.

10. Does the notice apply to linked websites?
Our websites may contain links to other websites. This privacy notice only applies to this website and to
Heritage Attractions Limited so when you link to other websites you should read their own privacy
policies.

11. When do you monitor telephone calls?
We may from time to time record telephone calls you have with our staff for training purposes and to
improve the quality of our service.

12. How do we update this privacy notice?
We keep our privacy notice under regular review, and we will place any updates on our webpage.

13. Who can I contact if I have queries about this privacy notice?
You can also contact us directly if you have any questions about our privacy notice or information, we
hold about you.
Please contact us by email on: GDPR@heritagegb.co.uk.
If you are dissatisfied with our handling of any query or complaint you also have the right to raise
concerns with The UK Information Commissioner: https://ico.org.uk

DigiTickets Privacy Policy

Policy Owner

This policy is owned and distributed by IT and Compliance manager of Digital Ticketing Systems Limited

Who we are

In this Privacy Policy, references to "we", "us", and "our"" are to Digital Ticketing Systems Limited (Company number 07044584). References to "our Website" or "the Website" are to *.digitickets.co.uk.

Digital Ticketing Systems Limited is the data controller responsible for the personal information collected through this Website.

Information We Collect

We may collect and process the following categories of personal information:

Information You Provide Directly

When you contact us, make a purchase, register for services, or complete forms on our Website, we may collect information such as:

• Name
• Postal address
• Email address
• Telephone number
• Purchase and booking information
• Any other information voluntarily provided by you

Payment Information

Payments made through our Website are processed by authorised payment service providers. We do not store your full credit or debit card details on our systems.

Our payment providers may process payment information and carry out fraud prevention and verification checks. Where international transfers are required, appropriate safeguards will be applied in accordance with applicable data protection laws.

Digital Ticketing Systems is PCI DSS v4.0.1 compliant and are annually assessed/certified.

Website Usage Information

When you visit our Website, we may automatically collect:

• IP address
• Browser type and version
• Device information
• Screen resolution
• Operating system
• Referral source
• Pages visited and actions taken on the Website
• Date and time of access

Marketing Preferences

If you choose to receive marketing communications, we will record your preferences and any interactions with our emails, including whether emails are opened or links are clicked.

Cookies and Similar Technologies

We use cookies and similar technologies to operate our Website, remember your preferences, analyse usage, and improve user experience. Further information is provided in our Cookie Policy below.

How We Use Your Information

We process personal information for the following purposes:

• To provide products and services you request
• To process transactions and fulfil orders
• To provide customer support and after-sales services
• To manage bookings and accounts
• To improve our Website, products, and services
• To ensure Website security and prevent fraud
• To comply with legal and regulatory obligations
• To send marketing communications where we have your consent or another lawful basis to do so

Lawful Basis for Processing

Under UK GDPR, we rely on one or more of the following lawful bases:

• Performance of a contract: to provide goods or services you have requested.
• Legal obligation: where processing is necessary to comply with legal requirements.
• Legitimate interests: to manage and improve our business, Website security, and customer experience.
• Consent: where required, including for certain cookies and marketing communications.

Where we rely on consent, you may withdraw it at any time.

Sharing Your Information

We may share your personal information with:

• Payment processors
• Hosting and IT service providers
• Delivery and fulfilment partners
• Marketing and communications providers
• Analytics and Website performance providers
• Professional advisers and auditors
• Regulatory authorities, law enforcement agencies, or courts where required by law

All third-party service providers are required to process personal information only on our instructions and in accordance with applicable data protection laws.

We do not sell personal information to third parties.

International Transfers

Where personal information is transferred outside the United Kingdom, we will ensure appropriate safeguards are in place, such as:

• Transfers to countries deemed to provide an adequate level of protection; or
• Approved contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms.

Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, regulatory, and reporting requirements.

Retention periods vary depending on the type of information and the purpose for which it is processed.

Cookie Policy

What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly, remember preferences, improve performance, and provide analytics information.

How We Use Cookies

We use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of the Website and cannot be disabled through our cookie management tools.

Cookie	Purpose	Duration
PHPSESSID	Maintains user session and shopping basket functionality	Session / 24 minutes
dtAnalyticsConsent	Records cookie consent preferences	1 year

Analytics Cookies

These cookies help us understand how visitors interact with the Website so that we can improve performance and usability.

These cookies are only placed with your consent.

Google Analytics

Examples include:

• _ga
• _ga<container-id>
• _gid
• _gat_<tracker-name>

Used to collect aggregated statistical information about Website usage.

Google Privacy Information:

https://support.google.com/analytics/answer/6004245

Microsoft Clarity

Examples include:

• _clck
• _clsk
• CLID
• ANONCHK
• MR
• MUID
• SM

Used to analyse user interactions and improve Website usability.

Microsoft Clarity Information:

• https://clarity.microsoft.com/blog/cookies-in-clarity/
• https://learn.microsoft.com/en-us/clarity/

Performance Monitoring Cookies

Performance monitoring tools help us identify technical issues and improve Website reliability.

Examples may include cookies used by services such as New Relic.

Managing Cookies

When you first visit our Website, you will be presented with a cookie banner allowing you to:

• Accept all cookies
• Reject non-essential cookies
• Choose your cookie preferences

You may change your preferences at any time through our cookie settings tool.

You can also manage cookies through your browser settings. Disabling certain cookies may affect Website functionality.

Your Data Protection Rights

Under UK GDPR, you may have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Restrict processing
• Object to processing
• Request portability of your data
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO)

For more information about your rights, visit:

https://ico.org.uk/

Automated Decision-Making

We do not generally make decisions producing legal or similarly significant effects using solely automated processing.

Where automated tools are used for fraud prevention, security monitoring, or service administration, appropriate safeguards will be applied in accordance with applicable data protection legislation.

Childrens Data

Our Website is not intended to knowingly collect personal information from children unless necessary to provide services requested by a parent, guardian, school, attraction, venue, or authorised organisation.

Where we process children's personal information, we take additional care to ensure appropriate protections are in place.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact:

Digital Ticketing Systems (t/a DigiTickets)

Sentio House, Pynes Hill, Exeter, Devon, EX2 5AZ

www.digitickets.co.uk/compliance-request

If you have concerns about how we use your personal information, you may submit a privacy complaint to us using the contact details above.

We will acknowledge your complaint and investigate it in accordance with applicable data protection legislation. We aim to respond without undue delay and within the timescales required by law.

If you remain dissatisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).

Other Websites

This Privacy Policy applies only to this Website. Links to third-party websites are provided for convenience only. We are not responsible for the privacy practices of those websites, and we encourage you to review their privacy policies before providing any personal information.

Last Updated: 5 August 2026