Introduction

This policy explains how Rail Production ("Rail One") collects and protects your personal data, in accordance with the Swiss FADP and the EU GDPR. By using railone.ch, you acknowledge this policy.

Data Controller

Data we collect

Contact form

• Name, email address, message content

Newsletter

• Email, first name (optional), language — via MailerLite (EU servers). Unsubscribe anytime via the link in every email.

ICS calendar subscription

• IP address, User-Agent, anonymised token

Visit statistics (with consent)

• Anonymous visitor ID (railone_visitor_id)
• Pages, time spent, device, browser, estimated location, traffic source

Stored exclusively on our Infomaniak servers (Switzerland) — never shared with third parties.

Cookies

Change your preferences anytime via the Cookies link at the bottom of the page.

Third-party services

• Infomaniak Network SA — hosting & email (Geneva, Switzerland)
• MailerLite — newsletter delivery (EU)
• YouTube / Google — video thumbnails and embeds

YouTube API Services (Rail One Postprod)

Rail One Postprod is an internal post-production tool used exclusively by the Rail Production team. It uses the YouTube API Services to publish and manage the videos of our own YouTube channel. It is neither distributed nor publicly accessible.

By using this tool, you agree to the YouTube Terms of Service. Data processed through the YouTube API Services is also subject to the Google Privacy Policy.

Data accessed and used

• Information about our channel (name, ID, public statistics)
• Metadata of our own videos: titles, descriptions, translations, tags, chapters, thumbnails, captions, playlists, recording date, status and publication date

This data is used solely to upload our videos and manage their metadata. The tool does not access any data of viewers or other YouTube users, and does not collect personal data of third parties.

Storage and sharing

The OAuth authorisation token is stored only on our servers (internal server and Infomaniak hosting in Switzerland), in locations not accessible from the web, with access restricted to authorised team members. Video files and metadata remain on our servers. None of this data is sold or shared with third parties. The tool uses no cookies and stores no information on users' devices.

Revocation and deletion

The tool's access can be revoked at any time via the Google security settings page. After revocation, the stored token is deleted within 7 days. Data obtained through the YouTube API Services is not kept for more than 30 days without being refreshed. Deletion requests: [email protected].

International data transfers

YouTube and Google may transfer data to the United States. These transfers are based on the Standard Contractual Clauses approved by the European Commission. MailerLite processes data exclusively within the EU. Infomaniak is based in Switzerland (adequate protection level recognised by the EU).

Data security

This site uses HTTPS (TLS encryption). Access to personal data is restricted to authorised team members. Backups are managed by Infomaniak.

Minors

This site does not knowingly collect personal data from individuals under 16 years of age. If you believe a minor has submitted their data, please contact us at [email protected] for deletion.

Retention periods

• Contact data: deleted within 12 months of last exchange
• Newsletter: retained until unsubscription
• Statistics: 24 months, aggregated & anonymised
• ICS subscriptions: deleted after 12 months of inactivity

Your rights

Access, rectification, erasure, consent withdrawal, portability, objection.

To exercise your rights, send an email to [email protected] with the subject "Personal data request". We will respond within 30 days.
Supervisory authority: FDPIC (Switzerland)

Changes

This policy may be updated at any time. The current version is always available on this page.