Data Processing Agreement

Version 1.1. Last updated 14 October 2026.

1. Who this agreement is between

• Railhop: KMR Digital Ltd, a company registered in England and Wales (company no. 17516682), trading as Railhop (registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ). Contact: hello@railhop.app.
• The company: the organisation named when its Railhop for Business workspace was created. The person who creates the workspace accepts this agreement on the company's behalf and confirms they may do so.

This agreement forms part of the company's use of Railhop for Business. It meets the requirements of Article 28(3) of the UK GDPR. If it conflicts with any other terms between Railhop and the company about personal data, this agreement applies.

2. Roles

• For the company's travel data (section 4), the company is the controller and Railhop is its processor. The company decides why that data is processed: to find and claim the Delay Repay compensation it is owed on rail tickets it bought.
• For the accounts of the company's users, billing, security and Railhop's own emails to company contacts (section 8), Railhop is a controller in its own right, as described in its Privacy Policy.

3. Subject matter, nature, purpose and duration

• Subject matter: the company's rail booking records and the Delay Repay claims that come from them.
• Nature of processing: receiving booking records the company uploads; matching each journey to the train it was booked on and checking that train's recorded running; working out whether compensation is due and roughly how much; preparing claims; sending a claim, at the company's request, to the traveller who made the journey so they can submit it themselves; keeping the records for the period in section 9; and producing totals, exports and the company's reports.
• Purpose: to find, prepare and track Delay Repay claims for the company. Railhop never submits a claim to a train company. The company or its traveller submits each claim on the train company's own form, and the train company pays the compensation.
• Duration: for as long as the company's workspace exists, and afterwards only for the retention and deletion periods in section 9.
• Anonymised statistics: the company also instructs Railhop to create anonymised, aggregated statistics from its data (for example, delay and compensation totals by train company, route or month), as clause 12.2 of the Terms of Service allows. Railhop may use and publish them. They do not identify any customer, company or person, so they are not personal data.

4. The personal data and the people it is about

People: the company's travellers (employees, contractors and anyone else whose rail tickets the company bought) and the company's users of Railhop for Business (owners and admins).

Data Railhop processes for the company:

• Travellers: the company's own reference for the person (for example a staff number), their name and email address (both encrypted), and when they last appeared in an upload.
• Journeys: date, booked departure time, stations, ticket type and description, price, operator, cost centre, the booking's status (for example "Refunded"), the booking reference (encrypted), and the result of the check (train, delay, estimated compensation, claim deadline).
• Claims: the journey and train, status, who is to submit it, the train company's claim reference, the amounts estimated and claimed, how compensation is paid as a kind only ("bank", "card", "voucher" or "other", never the details), a traveller's reason for declining a claim, and the commission fixed when the claim is submitted.
• Send to Traveller records: which claims were sent to which traveller, how (the Railhop app or email), when the link was opened, any reminder sent, and the traveller's answer to "Did you take this train?".
• Audit log: which user did what in the workspace (imports, sends, role changes, exports) and when, with an id or short label, never personal data in the label.

Data Railhop never holds: the uploaded files themselves (a file is read in memory to bring its journeys in; only its file name and row counts are kept), bank details, card numbers, ticket images, and passwords for train company or booking accounts.

5. Railhop's obligations as processor

Railhop will:

1. Instructions. Process the company's personal data only on the company's documented instructions, which are this agreement and the company's use of the service (uploads, sends, settings, exports and deletion requests), including for transfers outside the UK (section 7), unless UK law requires otherwise. In that case Railhop will tell the company first, unless the law forbids it. Railhop will tell the company straight away if it believes an instruction breaks UK data protection law.
2. Confidentiality. Only authorised personnel of KMR Digital Ltd, bound by confidentiality, have access to the company's data. Everyone Railhop authorises to process it has committed to confidentiality or is under a statutory duty of confidentiality.
3. Security. Take the measures in section 6.
4. Sub-processors. Use sub-processors only as section 7 allows.
5. Rights requests. Help the company answer requests from people exercising their data protection rights (section 10).
6. Other help. Help the company meet its duties on security, breach notification, data protection impact assessments and consulting the ICO, taking into account the nature of the processing and the information available to Railhop.
7. End of processing. Delete or return the data as section 11 says.
8. Information and audits. Make available the information needed to show it meets Article 28, and allow for and contribute to audits, including inspections, by the company or an auditor it appoints, on reasonable notice and with reasonable confidentiality terms. Railhop will usually answer by written questionnaire first.

6. Security

The measures in place today:

• Traveller names and email addresses, and booking references, are encrypted in the database (AES-256-GCM), with lookups by a one-way keyed hash. Sign-in tokens and links are stored only as hashes.
• Every request for a workspace's data checks that the signed-in user belongs to that workspace and has the right role. Automated tests check that one workspace cannot read another's data.
• Sign-in is by one-time email code or link, or by Google or Apple sign-in. Railhop for Business holds no passwords. Business accounts are separate from personal Railhop accounts and never share sessions.
• Connections to Railhop use HTTPS. The database provider encrypts stored data at rest.
• Webhooks from Stripe and Resend are accepted only with a valid signature.
• Uploads and sends are rate-limited per workspace, and CSV exports are protected against formula injection.
• Application logs record counts only, never names, stations or times.
• The audit log in section 4 records who did what in the workspace.

Railhop does not currently hold any security certification (such as Cyber Essentials or ISO 27001). If it gains one, it will say so on this site.

7. Sub-processors

The company gives general authorisation for Railhop to use the sub-processors below. Railhop will tell the company's owners by email at least 14 days before adding or replacing a sub-processor of the company's data. The company may object on reasonable data protection grounds within that time. If the parties cannot resolve the objection, the company may close its workspace and its data will be deleted as section 11 says. Railhop puts data protection terms in place with each sub-processor that give the company's data the protection Article 28 requires, and remains responsible to the company for them.

Where data leaves the UK, Railhop relies on UK adequacy regulations or appropriate safeguards (such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses).

8. Data Railhop handles as its own controller

• Company users' accounts: each user's email address (hashed and encrypted), sign-in methods, sessions, workspaces and roles.
• Billing: as in section 7 (Stripe).
• Emails to company contacts. Railhop sends owners and admins service emails (sign-in codes, claim reminders, notices about their workspace) and lifecycle emails about getting value from Railhop for Business (for example, a reminder to upload a booking report, or that compensation found is close to its claim deadline). Lifecycle emails:
  • go only to owners and admins, never to travellers;
  • are limited to one a day and three a week per address, and sent 08:00 to 20:00 UK time on weekdays (weekends only when a claim deadline is close);
  • follow the Privacy and Electronic Communications Regulations: sole traders and partnerships (other than LLPs and Scottish partnerships), which the law treats as individuals, and addresses at personal email providers get only emails about the service they signed up for, unless they agreed to more;
  • carry a one-click unsubscribe (in the email and in the mail headers) and a link to email preferences, which apply across every company the address belongs to;
  • stop to an address that bounces or is reported as spam (a suppression list, kept as a one-way hash of the address so the opt-out keeps working);
  • contain no tracking pixels, so Railhop does not record when an email is opened. If link click tracking is turned on for Railhop's sending domain, Resend reports that a link was clicked, and Railhop keeps only the time of the latest click per address.
  A log of which emails were sent to each address, and when, is kept for 2 years (section 9).
• Sales follow-up. Railhop records when the company's account is created, when it starts and submits its free claim, and when the prompt to subscribe is shown or clicked, and may contact the user who created the account at their work email about subscribing (Railhop's legitimate interests). These emails follow the same rules as lifecycle emails above, including the unsubscribe link and email preferences, and the records are kept while the company's account exists.
• Free claim contact and follow-up calls. Before the company starts its free claim, Railhop asks for the company name, the name of the user starting it and a UK telephone number, and says it will call that number about the free claim and setting up a subscription (Railhop's legitimate interests). The name and number are stored encrypted and kept while the company's account exists. Calls are not recorded: Railhop keeps only the notes its team types (status, date and short notes), encrypted, and deletes them 2 years after the last contact.
• Marketing email choices. The same step records how Railhop may email the user about Railhop for Business: for a limited company, LLP or Scottish partnership, under legitimate interests with an unsubscribe link in every email (the form says so); for a sole trader or other partnership, only if they tick an optional box (consent, never a condition of the free claim). Each choice is kept with its time, the wording shown and its version, while the company's account exists. A user can download this data and delete it (with their contact name, telephone number and follow-up notes) from Settings at any time; it is all deleted when the company's account is closed.

9. Retention

The company instructs Railhop to keep its records for 2 years so they are available for the company's expense and audit records. Billing lines for submitted claims are kept for 6 years for tax records, as HMRC requires.

These periods are applied by a daily automatic deletion job.

10. Rights requests

If a traveller or other person asks Railhop directly to exercise a data protection right over the company's data, Railhop will pass the request to the company without undue delay and will not answer it itself unless the company asks it to. Owners can export the workspace's journeys and travellers as CSV at any time from the workspace. For anything the exports don't cover, such as removing one traveller and their journeys or correcting a record, an owner can email hello@railhop.app and Railhop will act on it within 30 days, and sooner where the company needs to meet the one-month deadline for a request.

11. Deletion and export at the end

An owner can ask for the workspace to be closed by emailing hello@railhop.app from their account's address. Before closing, they can download the CSV exports, or ask Railhop for a copy of the workspace's data in CSV. Railhop deletes the workspace's personal data within 30 days of closing, except billing records, which are kept as in section 9 and then deleted. The database provider's restore history keeps earlier copies of the database for a limited period set by the provider; Railhop uses it only to recover from a failure.

12. Railhop's review queue

Once company inbox addresses are in use, an operator's reply about a claim that cannot be matched automatically goes to a review queue that only authorised personnel of KMR Digital Ltd, bound by confidentiality, can read. It is used only to match the reply to the right claim, and is deleted within 14 days. Outcome emails are not otherwise stored; Railhop keeps only the outcome (for example, paid and the amount). Redacted examples are kept to test matching only with a company's written consent.

13. Personal data breaches

Railhop will tell the company's owners by email without undue delay, and no later than 48 hours, after becoming aware of a personal data breach affecting the company's data. The notice will say, as far as Railhop then knows, what happened, the data and people affected, the likely consequences, and what Railhop has done and will do. Railhop will update the company as it learns more and help it decide whether to notify the ICO (within 72 hours of the company becoming aware) and the people affected.

14. The company's responsibilities

The company:

• has a lawful basis for giving Railhop its travel data and for its instructions;
• tells its travellers that it uses Railhop for this purpose (Railhop's Privacy Policy has a section for them headed "If your employer uses Railhop");
• decides who receives compensation (the company's account or the traveller's) under its own policy and each train company's rules;
• uploads only the data the service needs.

15. Changes

Railhop may update this agreement to reflect changes in law or in the service. It will email the company's owners at least 30 days before a change that reduces the protection of the company's data, and will ask an owner to accept a new version where the law requires it. The version accepted is recorded with the workspace.

16. Law

This agreement is governed by the law of England and Wales.