Privacy and contact

Last updated: 11 September 2026

Gerald Brockie operates Scotland’s Railways and is responsible for the personal information described in this notice. You can contact us about the site, a photograph or railway-memory contribution, or your data-protection rights at info@railwaysofscotland.com.

Information we collect

When you browse the site, the website and its hosting systems may process technical information such as your IP address, browser and device type, requested pages, dates and times, and security or error records.

If you send a photograph contribution enquiry, we collect your name, email address, preferred public credit, the photograph’s location and date or period, your description, your rights declaration, and your consent record. The first enquiry does not upload or publish a photograph.

If you send a railway-memory enquiry, we collect your name, email address, selected railway, station or place, approximate date or period, whose account it is, the account itself, preferred public credit, any description of photographs and their rights, and your privacy and commercial-use acknowledgements. We record the modification date of the linked privacy notice. The form accepts text only: no photograph is uploaded through it.

For memory-form submission limits, a salted hash derived from the connection address and a counter are retained for one hour. The raw address is not stored in the memory enquiry. Hosting security logs may separately contain connection information, as described in this notice.

If comments are available and you leave one, WordPress collects the information in the comment form together with your IP address and browser user-agent string for administration and spam prevention. If Gravatar is enabled, a hash derived from your email address may be sent to Automattic to check for an avatar.

Administrators and editors have WordPress user accounts. WordPress stores the account information and security records needed to operate those accounts.

How and why we use it

We use technical and security information to deliver, protect, troubleshoot and improve the website. Our lawful basis is our legitimate interest in running a safe, reliable heritage and research website.

We use photograph-enquiry information to reply, assess the railway evidence and copyright position, agree an appropriate credit, and decide whether material can be accepted. We rely on your consent to contact you about the enquiry. If material is accepted, we rely on our legitimate interests in preserving provenance, attribution and the record of the permission granted. Nothing is published automatically.

We use memory-enquiry information to contact you, assess the contribution, check its source and rights, agree editing and public credit, and decide whether to accept it. We rely on your consent to contact you about the enquiry. Sending an enquiry does not give permission to publish it. Any commercial website publication permission is agreed separately for identified text and images.

Memory enquiries remain in a private administrative queue. A notification is sent to the site’s editorial mailbox, so the supplied information is also processed by our email provider. Only authorised website administrators can access the enquiry queue. Email verification and any later photograph transfer are arranged by the editor; the form does not automatically verify an address or send an upload invitation.

We use comment information to display and administer comments, prevent abuse and respond where appropriate. Our lawful basis is our legitimate interest in running and protecting the discussion service. Comment cookies that remember a visitor’s details are optional.

We do not use contact details from contribution enquiries for newsletters or marketing. Any future email update service will use a separate, specific sign-up and an unsubscribe facility.

Analytics and cookies

WordPress uses necessary cookies for administrators who sign in. If comments remain enabled, a commenter can choose whether WordPress remembers their name and email in convenience cookies.

Google Analytics will remain disabled until the site provides the required visitor information and control. If analytics is enabled later, this notice and the visitor control will explain what is collected, its purpose, the provider, retention and how to consent or object before non-essential tracking begins.

The interactive railway maps obtain map resources from MapTiler. This necessarily sends technical request information, including an IP address, to deliver the map. The site uses the map for the visitor-requested Explorer and does not use it to profile visitors.

External films are selected by the visitor and do not autoplay. Pressing play may connect to YouTube or another named film provider, which can receive technical information and use its own storage technologies. A source link is available where an embedded player is unsuitable. Some photographs are delivered from Wikimedia servers, which receive the technical request needed to supply the image.

Who receives information

Information may be processed by organisations that provide website hosting, WordPress administration, email, security, mapping and requested media. Relevant services currently include the site’s hosting and email providers, Google/Site Kit, YouTube, MapTiler, Wikimedia and Automattic/Gravatar. We share only what is needed for the relevant service and do not sell personal information.

Some providers may process information outside the United Kingdom. Where UK personal information is transferred internationally, we require an applicable adequacy arrangement or contractual safeguards from the provider. You can contact us for more information about the provider and safeguards relevant to your information.

How long we keep information

• Declined or inactive photograph and railway-memory contribution enquiries are erased 24 months after the last contact.
• Accepted contribution, copyright, permission and attribution records are kept while the material remains in use and for as long as reasonably needed to show the permission and credit agreed.
• Comments and their metadata are kept while the comment remains published or until they are no longer needed for moderation and site integrity.
• Administrator account information is kept while the account is active and for the period needed for security and audit records after closure.
• Security and server logs are kept according to the hosting provider’s documented operational schedule and are deleted or anonymised when no longer needed.

We review stored information and erase or anonymise it when its purpose has ended.

Your rights

Depending on the circumstances, you may ask us for a copy of your personal information, ask us to correct it, erase it, restrict its use, transfer information you supplied, or object to processing based on legitimate interests. Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before it was withdrawn.

To make a request or a data-protection complaint, email info@railwaysofscotland.com. We may need to verify your identity before acting on a request.

You may also complain to the Information Commissioner’s Office. Details are available at ICO complaints information.

Changes to this notice

We will update the date and wording when the site’s services or use of personal information changes.