Legal
Privacy Policy
Last updated: July 2026
Your data, your rights
We do not sell your personal data. We collect only what we need to operate the platform safely and securely. You can request access to, correction of, or deletion of your data at any time — see Section 7.
1. Who we are
SaveMyFare ("we", "us", "our") operates the online marketplace at savemyfare.co.uk, enabling buyers and sellers to transact unused, transferable UK train tickets. SaveMyFare is the data controller responsible for your personal data.
SaveMyFare is in the process of registering with the Information Commissioner's Office (ICO) as required under the UK GDPR and the Data Protection Act 2018. Until registration is confirmed, any data subject requests or complaints should be directed to privacy@savemyfare.co.uk.
2. Data we collect
2.1 Account data
- Name and email address provided at registration.
- Password (stored as a one-way hash — we cannot read it).
- Profile information you choose to add.
2.2 Transaction data
- Ticket details: origin, destination, travel date, departure time, ticket class, and price.
- Ticket images or PDFs uploaded for verification (used solely for OCR and fraud checks).
- Purchase and sale history.
- Payment method details — card type and last four digits only. Full card data is handled exclusively by our payment processor and is never stored on our systems.
2.3 Search and usage data
- Stations searched, travel dates, and result counts — used to improve the platform and match supply with demand.
- Pages visited, time on site, and feature interactions.
2.4 Communications
- Messages sent via our contact form or support email.
- Marketing email preferences and engagement (opens, clicks).
By creating a SaveMyFare account, you consent to receiving marketing emails from us about new features, offers, and relevant listings. You can unsubscribe at any time using the link in any marketing email, or from your account settings, without affecting your use of the platform.
2.5 Technical data
- IP address, browser type, operating system, and device identifiers.
- Session data and error logs used to maintain platform stability and diagnose faults.
3. How we use your data
We process your personal data only where we have a lawful basis to do so under UK GDPR. The table below sets out our purposes and the applicable basis for each.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and managing your account | Account data | Performance of contract |
| Processing ticket purchases and sales | Transaction data, account data | Performance of contract |
| Verifying ticket authenticity via OCR | Ticket images, transaction data | Performance of contract |
| Holding and releasing escrow payments | Transaction data, payment data | Performance of contract |
| Sending transactional emails (purchase confirmations, alerts) | Account data | Performance of contract |
| Fraud detection and platform security | Technical data, transaction data, account data | Legitimate interests |
| Error monitoring and platform stability | Technical data | Legitimate interests |
| Improving search and matching features | Search and usage data (aggregated) | Legitimate interests |
| Sending marketing emails and newsletters | Account data, marketing preferences | Consent (given when you create an account — see Section 2.4) |
| Complying with legal obligations | As required by law | Legal obligation |
4. Who we share data with
We do not sell or rent your personal data to third parties. We share data only where necessary to operate the platform, with the following categories of trusted service providers acting as data processors on our behalf:
- Payment processing — to authorise and settle card transactions and release payouts to sellers.
- Database and cloud hosting — to store and serve platform data securely.
- Email delivery and marketing — to send transactional and, where consented, marketing emails.
- Error monitoring — to detect and diagnose technical faults in real time.
- Analytics — to understand aggregate usage patterns and improve the platform.
All third-party processors are contractually bound to handle your data only as instructed by us and in accordance with UK GDPR. We do not share your personal data with advertisers or unrelated third parties.
We may disclose personal data to law enforcement or regulatory authorities where required by law, or where we reasonably believe disclosure is necessary to prevent fraud or protect the rights, property, or safety of SaveMyFare, our users, or others.
5. International transfers
Some of our third-party service providers operate servers or infrastructure outside the UK or European Economic Area (EEA). Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner or equivalent transfer mechanisms, in accordance with Chapter V of UK GDPR.
6. How long we keep data
| Purpose | Data used | Lawful basis |
|---|---|---|
| Account data | Until account deletion, plus a 30-day grace period for recovery | |
| Transaction records (purchases, sales, payouts) | 7 years from transaction date (UK financial records requirement) | |
| Ticket images and PDFs | Retained for the lifetime of the associated transaction record (7 years) for fraud prevention and dispute resolution purposes | |
| Search history | 12 months from the date of search | |
| Support communications | 3 years from last contact | |
| Error and technical logs | 90 days on a rolling basis | |
| Marketing preferences and engagement data | Until you unsubscribe or withdraw consent |
After the applicable retention period, data is securely deleted or anonymised. You may request earlier deletion of your personal data — see Section 7.
7. Your rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
- Right of access — request a copy of the personal data we hold about you (Subject Access Request).
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — ask us to delete your personal data where we no longer have a lawful basis to hold it.
- Right to restrict processing — ask us to pause processing of your data in certain circumstances.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests, including direct marketing.
- Rights related to automated decision-making — we do not make solely automated decisions that produce significant legal effects on you.
To exercise any of these rights, please email privacy@savemyfare.co.uk. We will respond within one calendar month. We may ask you to verify your identity before processing your request.
8. Cookies
We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the platform is used. Cookies fall into the following categories:
- Strictly necessary — required for the platform to function (e.g. session authentication). These cannot be disabled.
- Functional — remember your preferences and search inputs across visits.
- Analytics — help us understand aggregate usage patterns. No personally identifiable information is shared with analytics providers.
You can control non-essential cookies through your browser settings. Disabling cookies may affect some platform functionality. We do not use advertising or tracking cookies.
9. Changes to this policy
We may update this Privacy Policy from time to time. Where changes are material, we will notify registered users by email before they take effect. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the platform after changes are published constitutes acceptance of the updated policy.
10. Contact & complaints
For any privacy-related queries or to exercise your data rights, please contact us:
SaveMyFare — Privacy
Email: privacy@savemyfare.co.uk
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
- Website: ico.org.uk
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF