Heritage Tickets — Operator Data Processing Agreement (DPA)

_Last updated: 3 October 2026_

Accepted by the heritage operator at install of the LopoRail

heritage-connector plugin. Between LopoRail ("Controller") and the

heritage operator ("Processor"). Contact: [email protected].

1. Roles and scope

1.1 LopoRail is the controller of buyer data for ticket sales (LopoRail is

the merchant of record). The Operator processes that data as a processor

to admit visitors to the booked visit.

1.2 Separately, the Operator acts as an independent controller for its own

on-site obligations (for example health and safety); this DPA does not cover

that processing.

2.1 Data: the buyer's **name, email address, visit date, and ticket

type/quantity. The Processor must not receive or process payment

data** (card details, etc.).

2.2 Data subjects: ticket buyers. Purpose: admitting the visitor and

administering the booked visit. Duration: for the term of the plugin

install plus the retention in §7.

3.1 Process the data only on LopoRail's documented instructions and only

for §2.

3.2 Keep the data confidential; ensure staff are bound by confidentiality.

3.3 Apply appropriate technical and organisational security measures.

3.4 No cookies / no analytics from the connector plugin.

3.5 Sub-processors: none without LopoRail's written authorisation; any

authorised sub-processor is bound by equivalent terms.

3.6 Assist LopoRail with data-subject requests (access, erasure, etc.) and

with breach/DPIA obligations.

3.7 Breach notification: notify LopoRail without undue delay (and within

24 hours) of any personal-data breach.

4.1 The Operator will provide the information needed to demonstrate compliance

and allow audits reasonably requested by LopoRail.

5.1 The Operator will not transfer the data outside the UK/EEA without

LopoRail's authorisation and appropriate safeguards.

6.1 On termination the Operator will delete or return the buyer data (at

LopoRail's choice) and confirm deletion in writing, subject to any legal

retention.

7.1 The Operator keeps visit data only as long as needed to admit the visitor

and meet its own legal obligations, and in any event **no longer than the

retention set by LopoRail**.

8.1 Installing the connector plugin and enabling ticket selling constitutes the

Operator's acceptance of this DPA.