NARCOA Privacy Policy

Last updated: July 17, 2026

1. PURPOSE AND SCOPE

The North American Railcar Operators Association (“NARCOA,” “we,” “us,” or “our”) respects the privacy of its members, Website users, applicants, excursion participants, volunteers, officers, directors, and other persons who provide information to NARCOA.

This Privacy Policy explains the types of personal information NARCOA collects, how that information is used and disclosed, the choices available to individuals, and the steps NARCOA takes to protect the information.

This policy applies to information collected through the NARCOA website (“Website”), membership and insurance processes, online and paper forms, correspondence, member services, publications, and other NARCOA activities.

This policy does not govern a website, service, payment processor, railroad, affiliate, insurer, or other third party that maintains its own privacy policy.

By using the Website or providing personal information to NARCOA, you acknowledge the practices described in this policy. Where applicable law requires consent for a particular use, NARCOA will request that consent separately.

2. INFORMATION NARCOA COLLECTS

NARCOA collects information reasonably needed to administer the Association, provide member services, operate the Website, support excursions and insurance programs, communicate with members, and comply with its governing documents and legal obligations.

A. Information provided directly

Depending on the service or activity, NARCOA may collect:

1. Name.

2. Postal address.

3. Email address.

4. Telephone number.

5. Year of birth or age-related information.

6. NARCOA membership number and membership status.

7. Affiliate membership or organizational affiliation.

8. Account username and authentication information.

9. Membership application, renewal, payment, and transaction information.

10. Insurance application, eligibility, and participation information.

11. Excursion registration and participation information.

12. Rulebook or Excursion Coordinator testing and certification information.

13. Motorcar, hi-rail, or other on-track-equipment information.

14. Communications, comments, photographs, articles, corrections, and other material submitted to NARCOA.

15. Information supplied in connection with a complaint, incident report, rules matter, Judicial Committee investigation, insurance matter, or other official NARCOA proceeding.

16. Any other information a person voluntarily provides to NARCOA.

B. Payment information

When a person pays dues, fees, or other charges online, payment-card information may be collected and processed directly by a third-party payment processor.

NARCOA may receive limited transaction information, such as the payer’s name, billing contact information, payment amount, transaction date, payment status, and a partial card identifier. NARCOA should not receive or retain a complete payment-card number unless a particular authorized process requires it.

C. Information collected automatically

When a person visits the Website, the Website or its service providers may automatically collect technical and usage information, including:

1. Internet Protocol address.

2. Browser type and version.

3. Device type and operating system.

4. Pages viewed and links selected.

5. Date and time of access.

6. Referring and exit pages.

7. Time spent on pages.

8. Approximate geographic location derived from an Internet Protocol address.

9. Cookie identifiers and similar technical information.

10. Website error, security, and performance information.

This information may be collected through server logs, cookies, analytics services, security services, and similar technologies.

D. Information from other sources

NARCOA may receive information from:

1. NARCOA Affiliates.

2. Excursion Coordinators.

3. Railroads and event hosts.

4. Insurance administrators, insurers, and brokers.

5. Payment processors and other service providers.

6. Members, passengers, guests, witnesses, or complainants.

7. Publicly available records and sources.

8. Governmental or regulatory authorities.

E. Information NARCOA generally does not request

NARCOA generally does not request a Social Security number, driver’s-license number, full date of birth, religious belief, political affiliation, sexual orientation, or gender identity through ordinary membership or Website processes.

A particular authorized form, insurance process, investigation, or legal requirement may occasionally require information not ordinarily collected. When that occurs, NARCOA should collect only the information reasonably necessary for the stated purpose.

3. HOW NARCOA USES PERSONAL INFORMATION

NARCOA may use personal information to:

1. Process membership applications, renewals, dues, cancellations, and membership records.

2. Establish and maintain Website or member accounts.

3. Provide member services, publications, directories, notices, and other benefits.

4. Process payments and maintain transaction records.

5. Administer insurance applications, eligibility, certificates, and related matters.

6. Administer excursions, registrations, operating privileges, qualifications, testing, and certifications.

7. Communicate with members, applicants, volunteers, officers, directors, Affiliates, and other interested persons.

8. Maintain the member lookup roster described in Section 6.

9. Publish information submitted for THE SETOFF, the NARCOA calendar, the Website, historical archives, or other authorized NARCOA uses.

10. Respond to questions, requests, complaints, corrections, and technical-support matters.

11. Investigate incidents, alleged rules violations, misconduct, insurance claims, safety matters, and security concerns.

12. Enforce the NARCOA bylaws, Rulebook, Policy Book, Operations Manual, agreements, releases, policies, and Website Terms of Service.

13. Protect the safety, rights, property, systems, and operations of NARCOA, its members, Affiliates, railroads, and others.

14. Detect and prevent fraud, misuse, unauthorized access, and other unlawful or harmful activity.

15. Maintain, analyze, secure, and improve the Website and member services.

16. Meet accounting, tax, corporate-record, insurance, and legal obligations.

17. Carry out another purpose disclosed when the information is collected.

18. Carry out another purpose with the individual’s consent.

NARCOA will not use membership records, in whole or in part, for a purpose unrelated to a member’s reasonable interest as a member, Association administration, or another lawful NARCOA purpose.

4. COOKIES AND SIMILAR TECHNOLOGIES

The Website may use cookies and similar technologies to:

1. Keep users signed in.

2. Remember account or Website preferences.

3. Maintain Website security.

4. Process forms and transactions.

5. Measure Website use and performance.

6. Diagnose errors.

7. Understand which Website material is useful to visitors.

Some cookies may be necessary for the Website to function. Other cookies, including analytics cookies, may be optional depending on NARCOA’s Website configuration and applicable law.

A user can usually configure a browser to reject or delete cookies. Disabling necessary cookies may prevent account access or interfere with certain Website functions.

5. WHEN NARCOA DISCLOSES PERSONAL INFORMATION

NARCOA does not sell personal information for money.

NARCOA may disclose personal information in the following circumstances:

A. Within NARCOA

Information may be disclosed to authorized officers, directors, committee members, volunteers, administrators, editors, and other persons who need it to perform an official NARCOA function.

B. Member roster

Certain information may be made available to other NARCOA members through the restricted member lookup roster, as described in Section 6.

C. Affiliates, Excursion Coordinators, railroads, and event personnel

Information may be disclosed when reasonably necessary to verify membership, insurance, eligibility, qualifications, certifications, registration, equipment information, releases, or compliance with rules and event requirements.

D. Insurance purposes

Information may be disclosed to insurance administrators, insurers, brokers, claims personnel, attorneys, investigators, and other persons involved in insurance placement, eligibility, incident reporting, claims, or risk management.

E. Service providers

NARCOA may use service providers for Website hosting, membership administration, email delivery, payment processing, document storage, analytics, security, printing, mailing, technical support, and similar functions.

Those providers may process personal information only as needed to provide their services, subject to their contracts, privacy policies, and legal obligations.

F. Publications and submitted material

Information, photographs, articles, letters, event listings, or other material submitted for publication may be published or distributed in accordance with the submission, the NARCOA Terms of Service, and applicable NARCOA policies.

G. Legal and safety reasons

NARCOA may disclose information when it reasonably believes disclosure is necessary to:

1. Comply with a law, regulation, subpoena, court order, or lawful government request.

2. Protect the safety, rights, or property of NARCOA or another person.

3. Investigate fraud, security incidents, misconduct, rules violations, accidents, or insurance matters.

4. Establish, exercise, or defend a legal claim.

5. Enforce NARCOA’s governing documents or agreements.

H. Organizational changes

If NARCOA reorganizes, transfers a Website service, changes a service provider, or transfers records to a lawful successor organization, relevant information may be transferred as part of that process, subject to applicable law and NARCOA’s nonprofit purposes.

I. With consent

NARCOA may disclose information for another purpose with the individual’s consent or at the individual’s direction.

6. NARCOA MEMBER LOOKUP ROSTER

NARCOA may provide a member lookup roster that is accessible only to authenticated NARCOA members.

The roster may contain selected member information. The precise fields displayed should be approved by NARCOA and stated on or near the roster.

The roster is provided only for legitimate purposes reasonably related to NARCOA membership. A member may not use roster information for:

1. Commercial solicitation.

2. Mass marketing.

3. Political campaigning.

4. Harassment.

5. Data harvesting.

6. Sale, rental, or distribution to nonmembers.

7. Any unlawful purpose.

8. Any purpose not reasonably related to a member’s interest as a NARCOA member.

A member may request removal from the online roster by emailing narcoamembers@gmail.com or by writing to the address in Section 15.

Removal from the online roster does not require NARCOA to delete information that it must retain in its official membership, insurance, transaction, corporate, safety, or legal records.

7. DATA RETENTION

NARCOA retains personal information only as long as reasonably necessary for the purpose for which it was collected and for legitimate operational, historical, insurance, accounting, corporate-record, safety, dispute-resolution, and legal purposes.

Retention periods may vary according to the type of record. For example, NARCOA may retain:

1. Current membership and account information while membership or an account remains active.

2. Former-member records needed to document membership history and termination.

3. Financial and transaction records for applicable accounting, tax, and audit periods.

4. Insurance, excursion, incident, release, and claims records for periods appropriate to the potential legal and insurance obligations.

5. Board, committee, corporate, historical, publication, and archival records for long-term or permanent preservation.

6. Security logs for a limited period appropriate to security and troubleshooting needs.

7. Submitted material already published or incorporated into an archive for continued historical use.

NARCOA should adopt a written records-retention schedule identifying specific retention periods and secure disposal procedures.

8. DATA SECURITY

NARCOA uses administrative, technical, and physical safeguards reasonably appropriate to the nature of the information and the size and activities of the Association.

These measures may include:

1. Limiting access to persons with a legitimate NARCOA need.

2. Password and account controls.

3. Secure Website connections.

4. Security updates and backups.

5. Use of established payment and Website service providers.

6. Procedures for handling paper and electronic records.

7. Training or instructions for officers, directors, volunteers, and administrators who handle personal information.

8. Secure disposal of records no longer required.

9. Response procedures for suspected security incidents.

No method of Internet transmission, electronic storage, or physical storage is completely secure. NARCOA therefore cannot guarantee absolute security.

A person who believes personal information or a NARCOA account has been compromised should promptly contact NARCOA using the information in Section 15.

9. DATA-BREACH RESPONSE

NARCOA will investigate a suspected unauthorized acquisition, access, use, or disclosure of personal information.

When notification is required, NARCOA will provide notice to affected individuals, governmental authorities, insurers, or others in accordance with applicable law and contractual obligations.

The timing, content, and method of notice may depend on the facts of the incident and the laws applicable to the affected individuals.

10. INDIVIDUAL REQUESTS AND PRIVACY RIGHTS

A person may contact NARCOA to request:

1. Access to personal information NARCOA maintains about that person.

2. Correction of inaccurate or outdated information.

3. Removal from the online member roster.

4. Deletion of information that NARCOA is not legally or operationally required to retain.

5. Information about the purposes for which information is used.

6. Withdrawal of consent when processing is based on consent.

7. Another privacy right provided by applicable law.

NARCOA may need to verify the requester’s identity before acting. NARCOA may deny or limit a request when permitted by law, including when the information must be retained for membership administration, insurance, safety, legal compliance, dispute resolution, historical archives, corporate records, or the rights of another person.

Submitting a privacy request will not result in unlawful discrimination or retaliation.

NARCOA does not presently state that it engages in targeted advertising, sells personal information, or uses personal information to make decisions through solely automated profiling. If any of those practices are introduced, this policy and any required choice mechanisms should be updated before the practice begins.

11. CHILDREN’S PRIVACY

The Website and NARCOA membership services are not directed to children under 13.

NARCOA does not knowingly collect personal information online directly from a child under 13 without authorization from a parent or legal guardian when such authorization is required.

A parent or guardian who believes a child under 13 has provided personal information to NARCOA should contact NARCOA. NARCOA will review the matter and delete or otherwise handle the information as required by law.

Information about a minor who participates in an excursion or other activity may be collected from the minor’s parent, legal guardian, responsible adult, operator, or applicable event personnel under the governing forms and safety procedures.

12. INTERNATIONAL USERS

NARCOA is based in the United States. Information submitted from outside the United States may be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in the user’s jurisdiction.

13. THIRD-PARTY WEBSITES AND SERVICES

The Website may contain links to third-party websites or use third-party services.

NARCOA does not control and is not responsible for the privacy, security, or content practices of those third parties. Users should review the privacy policy of a third party before providing information to it.

14. CHANGES TO THIS PRIVACY POLICY

NARCOA may revise this Privacy Policy as its practices, Website, services, or legal obligations change.

The revised policy will be posted on the Website with a new “Last updated” date. Changes apply prospectively unless otherwise stated.

When a change materially alters how NARCOA uses or discloses previously collected personal information, NARCOA will provide additional notice or obtain consent when required by applicable law.

Continued Website use after an updated policy becomes effective acknowledges the updated policy, but does not constitute consent when applicable law requires a separate affirmative choice.

15. CONTACT INFORMATION

Questions, corrections, roster opt-out requests, privacy requests, and security concerns may be directed to:

NARCOA
P.O. Box 9035
Cincinnati, OH 45209

Email: narcoamembers@gmail.com