The controller is the International Air Rail Organisation (IARO), an unincorporated membership organisation, Suite 3, Charter House, 26 Claremont Road, Surbiton KT6 4QZ, United Kingdom. Privacy contact: patrick.hicks@iaro.com, +44 (0)7770 636613.
What we collect and why
We do not use advertising or analytics cookies. We do not make automated decisions that produce legal or similarly significant effects. Fields marked required on a form are needed for that request; if you do not provide them we cannot reply or assess an application.
| Activity | Data | Purpose and lawful basis | How long we keep it |
|---|---|---|---|
| Enquiries | Name, email, organisation, message | To reply. Legitimate interests, or steps you ask us to take. | 12 months after the enquiry is closed. |
| Membership applications and administration | Contact details, organisation, category, fee band, correspondence, invoice and membership status | Pre-contract steps, performing the membership arrangement, and legal obligations such as accounting. | Unsuccessful applications: 12 months. Member and finance records: the membership term plus up to six years where UK record-keeping rules require it. |
| Member accounts | Username, email, organisation link, hashed password, sign-in and security logs | To deliver member access. Security logs are a legitimate interest. | For the life of the account, then a short closure period. Failed-login records are kept only as long as needed to block abuse. |
| Directory | Approved organisation name, membership category, sector, location, description and website | To run membership. Public listing needs separate approval. We do not publish personal emails in the directory. | While the listing is current. Listings are removed on request or when membership ends. |
| IARO Express | Email address, signup source, and Mailchimp delivery records | Consent. You can unsubscribe in any issue. | Until you unsubscribe. Mailchimp then keeps a suppression record so we do not add you again by mistake. |
| Website security | IP address, request logs, CSRF and session cookies | To operate and protect the site. Legitimate interests. | Hosting and CDN logs follow Render and Cloudflare’s own periods. IARO does not run a separate analytics store. |
If you want a specific record erased, email the privacy contact.
Who processes data for us
- Render hosts the website and the PostgreSQL database in Frankfurt, Germany.
- Cloudflare sits in front of the site as a content delivery and security proxy. Request metadata such as IP address can be processed by Cloudflare to deliver the page.
- Mailchimp (Intuit) sends IARO Express.
- Microsoft 365 is used for secretariat email. Enquiries submitted through this website are stored so the Secretariat can reply.
- Named IARO officers and contracted technical support may access the application and database in order to run the service.
The map and typefaces are served from this application. There is no mapping-tile vendor and no font CDN. Cloudflare and Render see request metadata because they host and deliver the site.
Some processors are outside the UK (including the United States for Mailchimp, and the EU for Render in Frankfurt). We rely on the UK-EU data bridge where it applies, and on the supplier’s standard contractual clauses or equivalent safeguards where it does not.
Cookies
See the cookie notice for names, purposes and lifetimes. We do not use an opt-in banner because we only set cookies needed to run the site.
Your rights
You can ask for access, correction, erasure, restriction or a copy of your data, and you can object to processing based on legitimate interests. For IARO Express you can withdraw consent at any time by unsubscribing. Email patrick.hicks@iaro.com. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint.
Map data that is not personal
Country outlines are Natural Earth (public domain). Airport coordinates come from OurAirports (public domain) and are the airport reference point, not the station entrance. Corrections: use the contact form and see Data and corrections.