Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 1 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
Privacy Notice
This privacy notice applies to the personal information that Network Rail collects about you, or that you
provide to us, for the purposes of providing the Sentinel Authority-to-Work service. It explains how and
why we use your personal information, who we disclose it to and how we protect your privacy.
Contents
1. Introduction.............................................................................................................................................................. 2
2. Definitions ................................................................................................................................................................ 3
3. Who is responsible for the personal information that we collect? ........................................................................ 4
4. What personal information we hold about you and how this information is obtained ....................................... 5
5. How we will use personal information we hold about you..................................................................................... 7
6. To whom we may disclose your personal information ......................................................................................... 10
7. How we protect your personal information .......................................................................................................... 11
8. Where we will transfer your personal information to ........................................................................................... 11
9. How long we will keep your personal information for .......................................................................................... 12
10. Your rights and choices in relation to your personal information ................................................................... 13
11. Website cookies and third-party links ............................................................................................................... 16
12. Changes to our privacy notice ........................................................................................................................... 18
13. Your duty to inform us of changes .................................................................................................................... 18
14. How to contact us .............................................................................................................................................. 18
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 2 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
1. Introduction
We take your right to privacy seriously and want you to feel comfortable when using our services. Should
we ask you to provide certain information by which you can be identified you can be assured that it will
only be used in accordance with this privacy notice.
About this Privacy Notice:
References to we, us or our means Network Rail Infrastructure Limited who are the Data Controller of
data processed within SENTINEL. You can contact us by writing to:
Sentinel Data Controller
Network Rail
The Quadrant:MK
Elder Gate
Milton Keynes
MK9 1EN
References to you or your means the person accessing and using the website (as defined herein) or the
person who otherwise provides their personal information to us or about whom we otherwise collect
personal information as explained in this privacy notice.
References to the website means the SENTINEL website and sub-sites found at
www.info.railsentinel.co.uk.
Personal information is information about you, and which identifies you.
Network Rail have a separate privacy notice which applies to the personal information that we collect
about our employees.
The website and the SENTINEL service are not intended for children and we do not knowingly collect data
relating to children.
It is important that you read this privacy notice together with any other privacy notice or fair processing
notices we may provide on specific occasions when we are collecting or processing personal information
about you so that you are fully aware of how and why we are using your personal information. This privacy
notice supplements the other notices and is not intended to override them.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 3 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
2. Definitions
Initials
Definition
ATW
Authority To Work
COSS
Controller of Site Safety
D.O.B.
Date of Birth
N.I.No.
National Insurance Number
ORR
Office of Rail and Road
QR
Quick Response
RFID
Radio Frequency Identification Device
TVP
Track Visitor’s Permit
VAT
Value Added Tax
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 4 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
3. Who is responsible for the personal information
that we collect?
We are the data controller for the purpose of data protection law, in respect of your personal information
collected or obtained as outlined within this privacy notice. This is because we dictate the purpose for
which your personal information is used and how we use your personal information.
“In line with the Office of Rail and Road (ORR) Operating Licence requirements,
Sentinel is a safety critical service, managed by Network Rail, which provides
near real time visibility, validation and verification of an individual’s Authority
to Work (ATW) on the managed rail infrastructure in the UK.
The Authority to Work decision is taken in consideration of competence and
fitness information retained within the system, as agreed in the Sentinel
Scheme Rules and the Medical Standard.”
If you have any questions regarding this privacy notice or the way we use your personal information, you
can contact the Sentinel Data Controller.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 5 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
4. What personal information we hold about you and
how this information is obtained
We collect and process the following categories of information about you for the purposes of enabling
the ATW (Authority to Work) decision to be taken and recorded, as required by law and regulated by the
independent regulator; the ORR (Office of Rail and Road) :
• Business contact details
Name, company name, company website, supplier licence number, company email address, company
office address, place of work, company telephone number, company mobile number and company fax
number.
• Comments you make
Your views, opinions, feedback, comments, requests, enquiries and complaints.
• Payment information
Details of amounts your sponsor pays us, amounts owed to us, amounts we pay or owe to your sponsor,
relevant bank account or other payment details and any relevant tax information, including VAT number
where applicable.
• Website technical information
Through your internet browser or electronic device, certain information is collected by most websites or
automatically through your electronic device, such as your IP address (i.e., your computer’s address on the
internet), screen resolution, operating system type (Windows or Mac) and version, internet browser type
and version, electronic device manufacturer and model, language, time of the visit and pages visited.
Through Cookies: Cookies allow us to recognise your device and to collect information such as IP address,
internet browser type, time spent using the website and the pages visited.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 6 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
• Website usage data
Information about how you use our website and our services.
This information may be provided:
• During communications between you, your sponsor, a training and/or a medical provider and us
(including by direct system entry, phone, email, post or otherwise, including when making a data
subject access request).
• Via your internet browser or electronic device.
• Via cookies.
We may also receive the personal information about you from the following sources:
• Information you enter directly into “MySentinel”.
• Information you provide to your sponsor for entry and administration by them into the Sentinel
system.
• Information from third party occupational health providers and other medical professionals.
• Information from third party training providers and other training professionals.
• Direct from a third party, e.g. from an employee (such as information about their family members),
your employer, your sponsor, other parties and their advisors involved in transactions with us, other
parties involved in delivering services with us.
You may provide us with personal information relating to third parties.
• We will use this personal information in accordance with this Privacy Notice. If you are providing
personal information to us relating to a third party (e.g. Next-of-Kin), you confirm that you have the
permission of the third party to share such personal information with us and that you have made the
information in this Privacy Notice available to the third party.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 7 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
5. How we will use personal information we hold
about you
We will only use your personal information when there is a lawful basis for us to do so. Most commonly,
we will use your personal information in the following circumstances:
• Where we need to comply with a legal or regulatory obligation (to comply with our legal obligations).
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and
fundamental rights do not override those interests (for our legitimate interests or for a third party’s
legitimate interests)
• Where we or another person need to do so as part of carrying out a task in the public interest or
carrying out public functions which are laid down in law, for example exercising statutory rights and
carrying out our legal duties under our network and station licences to operate and maintain the
national railway infrastructure) (for the performance of public functions).
Your personal information may be used by us, our employees, service providers, and disclosed to third
parties for several different purposes which we have set out below. For each of these purposes, we have
set out the lawful basis we rely on to do so.
Please note: We may process your personal information on more than one lawful basis depending on the
specific purposes required. Please contact our Sentinel Data Controller if you need details about the
specific lawful basis we are relying on to process your personal information where more than one lawful
basis has been identified below.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 8 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
For the health and safety of our staff, visitors, contractors and suppliers
Lawful basis:
• To comply with our legal obligations.
• For the performance of our public functions: namely operating and maintaining the national railway
infrastructure, including ensuring health and safety and security and preventing and detecting crime.
To operate, maintain, repair and manage our facilities, properties, assets, equipment and
infrastructure, including the national railway infrastructure
Lawful basis:
• To comply with our legal obligations.
• For the performance of a contract with you.
• For our legitimate interests or for a third party’s legitimate interests.
• For the performance of our public functions (namely operating and maintaining the national railway
infrastructure).
For fraud prevention
Lawful basis:
• To comply with our legal obligations.
• For the performance of our public functions (namely operating and maintaining the national railway
infrastructure) or the performance of a third party's public functions (namely law enforcement
functions).
For operational reasons, such as improving the performance of our public functions, our business and
services, efficiency, training and quality control
Lawful basis:
• For our legitimate interests or for a third party’s legitimate interests.
• For the performance of our public functions (namely operating and maintaining the national railway
infrastructure).
Complying with our legal or regulatory obligations (including in connection with a court order)
Lawful basis:
• To comply with our legal obligations.
To investigate concerns raised with and reports made to our Speak Out confidential reporting service
or Network Rail's 24 Helpline
Lawful basis:
• To comply with our legal obligations.
• For the performance of our public functions (namely operating and maintaining the national railway
infrastructure).
To make, collect and manage payments, charges, fees and expenses, including the collection and
recovery of money owed to us
Lawful basis:
• For the performance of a contract with you or your sponsor.
• For our legitimate interests or for a third party’s legitimate interests.
• For the performance of our public functions (namely operating and maintaining the national railway
infrastructure).
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 9 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
To manage and respond to requests for information, including freedom of information requests
Lawful basis:
• To comply with our legal obligations.
• For the performance of our public functions (namely operating and maintaining the national railway
infrastructure).
To manage enquiries, comments, complaints, feedback and requests
Lawful basis:
• For the performance of a contract with you.
• For our legitimate interests or for a third party’s legitimate interests.
• For the performance of our public functions (namely operating and maintaining the national railway
infrastructure).
To administer and protect our business records, IT systems and our websites
Lawful basis:
• To comply with our legal obligations.
• For the performance of a contract with you.
• For our legitimate interests or for a third party’s legitimate interests.
• For the performance of our public functions (namely operating and maintaining the national railway
infrastructure).
Failure to provide us with your personal information
We may be required to obtain your personal information to comply with our legal obligations or for the
performance of our contract with you or to fulfil a request you have made. If you do not provide the
relevant personal information to us, we may not be able to enter into the contract with you or properly
perform our obligations under it. We may also be unable to fulfil your request.
Where your failure to provide information breaches a legal obligation, we may be required to report this
to regulators or law enforcement bodies. We will generally notify you of the consequences of failing to
provide us with required information at the time.
Automated decision making
We undertake processing of your personal information by automated means to make decisions about
your ATW (Authority to Work) when you present your Sentinel Card at the time of “swipe-in”. The COSS
(Controller of Site Safety) has the option to complete and record an appropriate risk assessment and
override the automated decision, if necessary.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 10 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
6. To whom we may disclose your personal
information
We may share your personal information with:
• Our group companies
Other companies and entities within the group of Network Rail Group, which we are a member of.
• Our service providers
Our business partners, suppliers, contractors and their sub-contractors for the performance of any
contract we enter into with you or for the performance of any contract we enter into with them
which relates to our business and under which they deliver works and services to us, including works
and services which may involve processing personal information on our behalf such as IT service
providers.
• Third parties involved in engineering and maintenance works and other aspects of railway
business
Including third-party contractors (such as Training and Medical Providers), trade unions, etc.
• Our professional advisers and agents
Including our banks, accountants, lawyers, insurers, brokers, agents, consultants and other
professional advisers that assist us in carrying out our activities and public functions.
• Governmental, regulatory and legal authorities and third parties involved in legal action
Government departments, governmental agencies, regulatory organisations and justice agencies
(including the courts, tribunals, police, security services, Her Majesty's Revenue and Customs, local
authorities, the Home Office, the Office of Rail and Road, the Information Commissioner, the Health
and Safety Executive, the British Transport Police, and other regulators and law enforcement
bodies.
• Prospective sellers or buyers of our business and assets or our corporate group
In the event that we sell or buy any part of our business or assets we will disclose your personal
information to the prospective seller or buyer of such business or assets. If we or substantially all of
our assets are acquired by a third party (or are subject to a reorganisation within our corporate
group), personal information held by us will be one of the transferred assets.
• Health professionals and emergency services
In the event of an emergency we may disclose personal information to health and medical
professionals and emergency services where the health, safety or security of a person is at risk.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 11 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
7. How we protect your personal information
We have put in place appropriate technical and organisational security measures to prevent your personal
information from being accidentally lost, altered, used, disclosed or accessed in an unauthorised way. In
addition, we limit access to your personal information to those employees, agents, contractors and other
third parties who have a business need to access this only and who are subject to a duty of confidentiality.
In the case of third-party data processors, they will only process your personal information on our
instructions and have their own legal obligations under data protection law to protect your personal
information and keep it secure.
We have put in place procedures to deal with any suspected personal data breach and will notify you and
any applicable regulator of a breach where we are legally required to do so.
8. Where we will transfer your personal information
to
To deliver services to you, it is sometimes necessary for us to share your personal information outside the
UK, e.g.:
• With companies within the Network Rail Group with offices outside the UK
• With your and our service providers located outside the UK
• If you are based outside the UK
• Where members of our staff need to access your personal information remotely while they are
travelling outside the UK
These transfers are subject to special rules under data protection law. In those circumstances, we
undertake an assessment of the level of protection in light of the circumstances surrounding the transfer.
We will make sure that any transfers are limited to the minimum amount of personal information possible
and will always take steps to ensure that your personal information is adequately protected.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 12 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
In certain circumstances, we may need to seek your consent, unless there is an overriding legal need to
transfer the personal information.
Our IT support is provided from across the world and when support is provided remotely, your personal
information may be accessed from and therefore transferred to that country. If we transfer personal
information outside the UK, we will implement appropriate and suitable safeguards to ensure that such
data will be protected as required by applicable data protection law.
9. How long we will keep your personal information
for
We will only retain your personal information for as long as necessary to fulfil the purposes we collected
it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal information we hold, we consider the amount,
nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or
disclosure of your personal information, the purposes for which we process your personal information (and
whether we can achieve those purposes through other means), and the applicable legal requirements.
In some circumstances, we may anonymise your personal information (so that it can no longer be
associated with you), for research or statistical purposes in which case we may use this information
indefinitely without further notice to you.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 13 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
10. Your rights and choices in relation to your
personal information
You have certain rights with respect to your personal information. The rights may only apply in certain
circumstances and are subject to certain exemptions. Please see the information below for a summary of
your rights. You can exercise these rights by contacting the Sentinel Data Controller.
Right of access to your
personal information
You have the right to receive a copy of your personal information that
we hold about you, subject to certain exemptions.
Right to rectify your
personal information
You have the right to ask us to correct your personal information that
we hold where it is incorrect or incomplete.
Right to erasure of your
personal information
You have the right to ask that your personal information be deleted in
certain circumstances. For example:
Where your personal information is no longer necessary in relation to
the purposes for which they were collected or otherwise used.
If you withdraw your consent and there is no other legal ground which
we rely on for the continued use of your personal information.
If you object to the use of your personal information (as set out below).
If we have used your personal information unlawfully.
if your personal information needs to be erased to comply with a legal
obligation.
Right to restrict the use of
your personal information
You have the right to suspend our use of your personal information in
certain circumstances. For example:
Where you think your personal information is inaccurate and only for
such period to enable us to verify the accuracy of your personal
information.
The use of your personal information is unlawful, and you oppose the
erasure of your personal information and request that it is suspended
instead.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 14 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
We no longer need your personal information, but your personal
information is required by you for the establishment, exercise or
defence of legal claims.
You have objected to the use of your personal information and we are
verifying whether our grounds for the use of your personal information
override your objection.
Right to data portability
You have the right to obtain personal information that you have
provided to us in a structured, commonly used and machine-readable
format and for it to be transferred to you or another organisation,
where it is technically feasible. The right only applies where the use of
the personal information you provided was with your consent or for the
performance of a contract with you, and when the use of your personal
information is carried out by automated (i.e., electronic) means.
Right to object to the use of
your personal information
You have the right to object to the use of your personal information in
certain circumstances:
Where you have grounds relating to your situation and we use your
personal information for our legitimate interests (or those of a third
party) or for our public functions, including for profiling.
If you object to the use of your personal information for direct
marketing purposes.
Right to withdraw consent
You have the right to withdraw your consent at any time where we rely
on your consent to use your personal information.
Right to complain to the
relevant data protection
authority
You have the right to complain to the Information Commissioner where
you think we have not used your personal information in accordance
with data protection law.
We aim to resolve any concerns and requests you have, quickly and
would ask that you contact us via our Sentinel Data Controller in the
first instance. However, if you are not satisfied with the outcome of
your enquiry to us, you can raise a complaint to the Information
Commissioner's Office:
Information Commissioner's Office
Wycliff House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 15 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights).
However, we may charge a reasonable fee if your request is vexatious, repetitive or excessive.
Alternatively, we may refuse to comply with your request in these circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your
right to access your personal information (or to exercise any of your other rights). This is a security
measure to ensure that your personal information is not disclosed to any person who has no right to
receive it. We may also contact you to ask you for further information in relation to your request to speed
up our response.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a
month if your request is particularly complex or you have made a number of requests. In this case, we will
notify you and keep you updated of our timescales.
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 16 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
11. Website cookies and third-party links
Third party links
Our website may include links to third-party websites, plug-ins and applications. Clicking on those links or
enabling those connections may allow third parties to collect or share data about you. We do not control
these third-party websites and are not responsible for how they handle your personal information. When
you leave our website, we encourage you to read the privacy notice or policy of every website you visit.
A cookie is a small text file that’s stored on your computer or mobile device when you visit a website.
We use cookies to:
• Remember your preferences.
• Tailor our sites and services to your interests.
You can set your browser to not accept cookies and the above websites tell you how to remove cookies
from your browser. However, in a few cases some of our website features may not function as a result.
Information about deleting and controlling cookies can be found at www.aboutcookies.org
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 17 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
You can find more information about the cookies used on our site and the reasons why in the table
below.
Cookies used on this website
Here are the details for the cookies used on this website
Cookie Name
Expiry/Duration
ASP.NET_SessionId
Per logged in user session
only
.ASPXAUTH
Per logged in user session
only
_ga
2 years
_gat
Immediate Expiry
_gid
Immediate Expiry
Back to Contents page
Sentinel Privacy Notice 2022-02-22 V5 0 Page 18 of 18
Network Rail Infrastructure Limited Registered Office: Network Rail, Waterloo General Office, London, SE1 8SW
Registered in England and Wales No. 2904587 www.networkrail.co.uk
OFFICIAL
12. Changes to our privacy notice
This privacy notice was last updated in October 2021.
Any changes we make to this privacy notice in the future, will be posted on this page of the website and
where appropriate, notified to you by email. The updated privacy notice will take effect as soon as it has
been updated or otherwise communicated to you.
13. Your duty to inform us of changes
Please keep us informed via the “MySentinel” portal, if your personal information changes during your
relationship with us.
14. How to contact us
Questions, comments and requests regarding data protection matters are welcomed and should be
addressed to our Sentinel Data Controller.
Sentinel Data Controller
Network Rail
The Quadrant:MK
Elder Gate
Milton Keynes
MK9 1EN