The Finger Lakes Rail Experience (“FLX,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit flxrailexperience.com or another website or online service we operate; purchase tickets or merchandise; attend an event; subscribe to communications; interact with our social media accounts; or otherwise communicate with us.

1. Information We Collect

Depending on how you interact with FLX, we may collect:

• Contact information, including your name, mailing address, email address, and telephone number.
• Account information, login credentials, and communication preferences.
• Transaction information relating to purchases, registrations, reservations, refunds, and prior orders.
• Volunteer, vendor, partner, event-participation, and purchaser information.
• Communications, comments, photographs, videos, recordings, testimonials, suggestions, and other material you submit to us.
• Technical information, such as your Internet Protocol address, browser type, device information, referring pages, pages viewed, and approximate location.
• Information obtained through cookies, analytics services, social media platforms, advertising services, and similar technologies.
• Any other information you voluntarily provide.

You may browse many portions of our website without creating an account or directly identifying yourself. However, our systems and service providers may still collect technical information about your visit.

2. How We Use Information

We may use personal information to:

• Process purchases, donations, memberships, registrations, reservations, and other requested transactions.
• Deliver tickets, merchandise, services, receipts, confirmations, and transaction updates.
• Administer memberships, volunteer programs, events, train rides, fundraising campaigns, and restoration projects.
• Create and maintain accounts and personalize your experience.
• Respond to questions, requests, comments, and customer-service inquiries.
• Send newsletters, announcements, fundraising appeals, special offers, surveys, event information, campaign updates, and other communications.
• Send SMS or text messages when you have provided the required consent.
• Operate, maintain, secure, analyze, and improve our websites, programs, communications, and services.
• Detect fraud, misuse, security incidents, or other unlawful activity.
• Maintain business and organizational records and comply with legal obligations.
• Carry out other purposes disclosed when information is collected or authorized by you.

3. Email and Mass Email Communications

If you make a purchase or otherwise provide your email address, we may send you transactional or organizational communications. These may include receipts, ticket information, service announcements, safety information, event changes, notices, and responses to your inquiries.

Where permitted by law or with your consent when required, we may also send newsletters, mass emails, event promotions, project updates, surveys, and other marketing or informational messages.

Marketing emails will include an unsubscribe method. You may unsubscribe at any time by following the instructions in the email or contacting us. Unsubscribing from marketing messages will not prevent us from sending necessary transactional, safety, legal, or administrative communications.

We do not sell or transfer an email address to another party for that party’s independent email marketing. We may provide email addresses to service providers that help us distribute and manage communications on our behalf.

4. SMS and Text Messages

You authorize FLX and its service providers to send messages to the mobile number you provide as part of transactions, ticket purchases, and event enrollment. Messages may include transaction notices, event information, schedule or safety updates, fundraising communications, promotions, and other information described when you enroll.

Consent to receive marketing text messages is not a condition of purchasing goods or services, making a donation, becoming a member, volunteering, or attending an event. Message frequency may vary. Message and data rates may apply.

You may revoke your consent at any time by replying STOP to a message or by contacting us. Reply HELP for assistance. We may send one final message confirming an opt-out. Carriers are not responsible for delayed or undelivered messages.

You represent that you are the authorized user of the telephone number you provide. Please notify us if your number changes or is reassigned. We do not sell or share SMS opt-in information or consent records with third parties for their independent marketing purposes. We may disclose this information to vendors that provide messaging services on our behalf or when required by law.

5. Social Media

FLX maintains accounts on social media and other third-party platforms. When you follow, mention, tag, message, comment on, or otherwise interact with us through those services, we may receive information made available by you or the platform.

Content posted publicly may be visible to and shared by others. We may respond to, repost, reshare, or display public posts that mention or tag FLX, subject to applicable law and platform functionality. When appropriate, we may request additional permission before using such content in advertising, fundraising, merchandise, or other promotional materials.

Social media platforms independently control the information they collect. Your use of those services is governed by their own privacy policies and settings, which we encourage you to review.

6. Photographs, Video, Audio, and Likeness

FLX events, excursions, programs, activities, and facilities may be photographed, filmed, livestreamed, or otherwise recorded. Images and recordings may include attendees, passengers, members, volunteers, staff, or members of the public. By attending or participating, you grant to us your perpetual permission.

By entering an FLX event or facility, or by attending or participating in an FLX excursion, program, or activity, you grant FLX and its authorized representatives a perpetual, worldwide, royalty-free right and permission to photograph, record, reproduce, edit, publish, display, distribute, livestream, and otherwise use your name, image, voice, appearance, statements, and likeness in any lawful medium. Such uses may include FLX websites, social media, newsletters, advertisements, fundraising materials, exhibits, publications, press materials, educational materials, historical archives, and other promotional or organizational communications.

You understand that these materials may be used without additional notice, inspection, approval, attribution, or compensation. To the extent permitted by law, you release FLX and its authorized representatives from claims arising from the authorized capture or use of your name, image, voice, appearance, statements, or likeness.

If you do not wish to be prominently photographed or recorded, please notify an FLX representative before participating. Although FLX will make reasonable efforts to accommodate such requests, it cannot guarantee exclusion from incidental, crowd, background, livestream, news, or archival images and recordings.

A parent or legal guardian must provide any permission required for the featured or promotional use of an identifiable minor’s name, image, voice, or likeness. FLX may use crowd or incidental images that include minors to the extent permitted by law.

7. Payment Security

FLX does not intentionally store complete payment-card numbers or card security codes on its own servers. Online credit-card and electronic-check transactions are processed by third-party payment providers, including Authorize.net or any successor provider identified during checkout.

These providers receive and process payment information under their own privacy and security practices. Although we use reasonable safeguards and reputable payment providers, no payment or information system can be guaranteed to be completely secure.

8. When We Disclose Information

FLX does not sell personal information for money. We may disclose information:

• To payment processors, ticketing providers, website hosts, email and SMS providers, analytics services, fulfillment companies, consultants, and other vendors performing services for us.
• To complete a purchase, donation, registration, membership, reservation, or other transaction you request.
• To affiliated organizations or event partners when necessary to provide a jointly offered program or service, with appropriate notice or consent.
• When you direct or authorize us to make the disclosure.
• To protect the rights, property, security, or safety of FLX, our visitors, participants, volunteers, employees, or others.
• To comply with a subpoena, court order, legal process, regulatory requirement, or other applicable law.
• In connection with a merger, reorganization, transfer of assets, or similar organizational transaction.

Service providers are permitted to use personal information only as necessary to provide contracted services or as otherwise allowed by law.

9. Cookies, Analytics, and Similar Technologies

Our websites and service providers may use cookies, pixels, log files, analytics tools, and similar technologies to remember preferences, maintain sessions, understand website traffic, measure communications, prevent fraud, and improve our services.

You may be able to restrict cookies through your browser or device settings. Disabling certain technologies may affect website functionality. If we use technologies that require additional consent under applicable law, we will provide an appropriate choice or notice.

10. Feedback and Submissions

We may use comments, suggestions, ideas, testimonials, historical materials, or other contributions you voluntarily provide for operational, educational, archival, or promotional purposes, consistent with any notice or agreement presented when they are submitted.

We will not promise public attribution in every instance. If we plan to identify you, we may use your name, city, state, role, or other attribution information with your permission or as otherwise reasonably expected from the context. You may ask us to withhold your name when submitting, although anonymous use may not always be possible.

11. Children’s Privacy

Our general website is not intended to collect personal information directly from children under 13 without appropriate parental or legal-guardian involvement. Children under 13 should not submit personal information, create accounts, enroll in communications, or upload identifiable photographs, video, or audio without authorization from a parent or guardian.

If we learn that we collected personal information online directly from a child under 13 without legally required consent, we will take reasonable steps to delete it. A parent or guardian who believes a child has provided information to us should contact us.

12. Data Retention

We retain personal information for as long as reasonably necessary to provide services, administer our organization, maintain historical and transaction records, fulfill the purposes described in this policy, resolve disputes, enforce agreements, and comply with legal, tax, accounting, insurance, and safety obligations.

Retention periods vary according to the nature of the information and the reason it was collected.

13. Information Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information. However, no website, network, electronic transmission, or storage system is completely secure, and we cannot guarantee absolute security.

If a security incident requires notification under applicable law, we will provide notice as required.

14. Your Choices and Requests

Depending on applicable law, you may request that we:

• Update or correct certain contact or account information.
• Stop sending marketing email or text messages.
• Close an account.
• Review a concern regarding our use of an identifiable image or recording.
• Answer questions about our information practices.

We may need to verify your identity before fulfilling a request. Certain information may be retained when necessary for transactions, safety, fraud prevention, recordkeeping, archival integrity, or legal compliance.

15. Third-Party Websites and Services

Our websites and communications may link to ticketing services, payment providers, social networks, partner organizations, or other third-party websites. FLX does not control and is not responsible for the privacy, security, or content practices of those third parties. Review their policies before providing personal information.

16. Changes to This Policy

We may update this Privacy Policy as our activities, services, vendors, or legal obligations change. We will post the revised policy with a new “Last updated” date. When appropriate, we may provide additional notice of material changes.

17. Contact Us

info@flxrailexperience.com

MAILING ADDRESS