Privacy Policy

Last Updated: July 29, 2026

Finger Lakes Railway Company, Inc. ("Finger Lakes Railway," "we," "us," and "our"), values the privacy of individuals who visit our website. This Privacy Policy ("Policy") explains how we collect, use, disclose, and protect information when you visit https://www.fingerlakesrail.com/ or any other website or online service that we operate and links to this Policy (collectively, the "Websites"). This Policy applies to information collected through the Websites, including online forms such as our contact form and freight rate request, and other electronic communications between you and the Websites.

This Policy does not apply to information collected offline or through other channels unless we expressly state that this Policy applies. It also does not apply to third-party websites, platforms, services, or applications that are not operated by Finger Lakes Railway.

By using the Websites, you acknowledge that you have read this Privacy Policy. If you do not agree with our privacy practices as described in this Privacy Policy, you may choose not to use the Websites.

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by law.

Throughout this Policy, we refer to the term "Personal Information." "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household. Depending on the law that applies, similar terms such as "personal data" or "personally identifiable information" may be used. Personal Information does not include publicly available information, deidentified information, or aggregated information that cannot reasonably be used to identify a particular individual.

We may also collect information related to businesses, companies, institutions, or other entities rather than individuals ("Business Information"). We do not consider Business Information, such as a business name, business address, general business telephone number, professional title, employer name, business email address, business phone number, or similar business contact information, to be Personal Information except where applicable law requires otherwise.

Information We Collect or Process

When you use or access the Websites, we may collect Personal Information directly from you, such as the following:

• Identifiers, such as first name, last name, email address, mailing address, phone number, company name, and similar contact information.
• Information you submit through online forms, including our contact form and freight rate (shipping) request, and the contents of any message or inquiry you submit.
• Professional or business-related information, such as your employer, company, job title, business contact details, and information about your shipping needs, freight, or other inquiry.

We also may collect certain limited technical information automatically when you visit the Websites. Like most websites, our hosting provider may log basic technical information, which may include:

• Internet Protocol (IP) address;
• Browser type and version;
• Pages visited and interactions with the Websites; and
• Date and time of visit.

We collect this limited technical information through standard server logs maintained by our hosting provider, and we use it to operate, secure, and maintain the Websites. We also use Google Analytics to understand how visitors use the Websites, as described under Cookies and Analytics below.

Cookies and Analytics

The Websites use Google Analytics 4 ("GA4"), a web analytics service provided by Google LLC, to help us understand how visitors find and use the Websites — for example, which pages are viewed and whether an inquiry form was submitted. GA4 sets first-party cookies (such as "_ga") to distinguish visitors and measure traffic. The information generated is transmitted to and processed by Google. We do not send Google the contents of any form you submit, such as your name or email address, and we do not use advertising or remarketing cookies. You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout) or through your browser's cookie settings. For more information on Google Analytics, including how Google Analytics collects, uses, and discloses information, refer to the following page: www.google.com/policies/privacy/partners. If we add other analytics or similar technologies in the future, we will update this Policy accordingly.

Third-Party Service Providers

We use third-party service providers to support the operation and functionality of the Websites. For example, form submissions on the Websites are processed by Formspree, a third-party form-handling service, which delivers them to us by email. Information you submit through our forms is handled in accordance with the applicable service provider's own privacy policy.

The Websites also embed Google My Maps on certain pages, including the home and contact pages. When you view or interact with an embedded Google My Maps feature, Google may receive certain technical information about your visit, such as your IP address and browser information, and may set or read cookies or similar technologies in accordance with Google's own privacy practices.

Certain features of the Website, including our truck-to-rail savings calculator, may retrieve publicly available reference data, such as the U.S. Energy Information Administration's weekly average diesel price, directly from government or other third-party data providers. When your browser accesses those resources, the applicable provider may automatically receive technical information associated with the request, such as your IP address and browser information. Finger Lakes Railway does not separately provide your contact information or form-submitted information to these providers through the calculator. Any information collected by a third-party provider is governed by that provider's own privacy practices.

We do not control how third-party service providers use information collected through their services. If you have questions about a third party's practices, you should review that third party's privacy policy or contact that provider directly.

Your Choices

You may choose not to provide the Personal Information we request through the Websites. However, not providing information we request may restrict your ability to use certain features of the Websites, such as submitting an inquiry or requesting a freight rate.

You may also contact us at any time to ask what information we hold about you, to correct it, or to request that we delete it, using the contact details in the Contact Information section below. We will respond within a reasonable time and as required by applicable law.

How and Why We Use Your Information

We may use, disclose, transmit, transfer, store, and otherwise process the information described in the Information We Collect or Process section for various purposes, including:

• Providing, developing, maintaining, protecting, and improving the Websites and our business operations.
• Responding to your inquiries, online form submissions, requests for information, quotes, or other communications.
• Following up with you about freight, transload, storage, or development opportunities.
• Managing and maintaining customer, prospect, supplier, and business partner relationships.
• Operating, evaluating, debugging, identifying and repairing errors, and improving our Websites and services.
• Maintaining business records.
• Maintaining the safety, security, and integrity of the Websites, our technology assets, our organization, and our business.
• Protecting against malicious, deceptive, fraudulent, or illegal activity.
• Enforcing our policies, terms of use, contracts, or other legal rights.
• Evaluating or participating in an actual or potential merger, divestiture, restructuring, reorganization, dissolution, acquisition, financing, or other sale or transfer of some or all of our assets.
• Complying with law and legal obligations.

We use Personal Information for the purposes described in this Policy, for purposes disclosed at or before the time of collection, and for other purposes authorized by applicable law or with your consent where required.

Our employees, advisors, contractors, and agents may access Personal Information as necessary to perform their duties and support our business operations. Access is limited to those with a legitimate business need and subject to appropriate confidentiality and security obligations.

Social Media Features and Links

The Websites may include links to our social media pages (such as LinkedIn) or other social media features. If you choose to interact with those features or visit a third-party social media platform through the Websites, information may be collected and processed by the applicable platform in accordance with its privacy policy and terms of use. We do not control the privacy or data-handling practices of third-party platforms and encourage you to review their policies before providing information or interacting with their services.

Disclosure of Your Personal Information

We do not sell, rent, or lease Personal Information. We may disclose Personal Information as described below:

• To our affiliates and operating companies for business and operational purposes.
• To third-party service providers, vendors, contractors, and business partners who help us operate, secure, host, and improve the Websites, process inquiries, and provide business, technology, or support services.
• To comply with applicable law, legal requirements, and industry standards.
• To enforce our policies, terms of use, contracts, or other legal rights.
• To investigate or prevent unlawful activities, security incidents, fraud, misuse of the Websites, or other harmful activity.
• To protect the legal rights, property, safety, and security of Finger Lakes Railway, our affiliates, our users, our employees, our customers, our vendors, and others.
• When required by law, regulation, subpoena, court order, legal process, or duly authorized request from law enforcement or governmental authorities.
• In connection with an actual or potential merger, acquisition, financing, divestiture, restructuring, reorganization, dissolution, sale, transfer, or other transaction involving some or all of our assets or business.

Children's Information

The Websites are intended for a business audience and are not directed to children. We do not knowingly collect Personal Information from anyone under the age of 13. If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us using the information in the Contact Information section below, and we will take appropriate steps to remove such Personal Information from our systems.

Data Transfers

Finger Lakes Railway is located in the United States. If you access the Websites from outside the United States or provide information to us from outside the United States, your information may be collected, transferred to, stored in, or otherwise processed in the United States or other jurisdictions where we, our affiliates, our operating companies, or our service providers process information. These jurisdictions may have privacy and data protection laws that are different from those in your jurisdiction.

Where required by applicable law, we will implement appropriate safeguards for international transfers of Personal Information. By using the Websites or providing information to us, you acknowledge that your information may be transferred to and processed in the United States and other jurisdictions as described in this Policy.

International Users

The Websites are operated from the United States and are intended primarily for business users, customers, suppliers, and other visitors located in the United States. We recognize, however, that visitors from outside the United States may access the Websites or contact us regarding business opportunities. If you are located outside the United States, including in the European Economic Area, the United Kingdom, or Switzerland, you may have rights under applicable privacy laws in your jurisdiction. To exercise any such rights, please contact us using the information in the Contact Information section below.

This Policy includes general information regarding our privacy practices and international transfers. It is not intended to create a separate consumer-facing service directed specifically to residents of any non-U.S. jurisdiction unless required by applicable law or expressly stated by us.

Your Privacy Rights

Depending on where you live, you may have certain legal rights regarding your Personal Information under the privacy laws that apply to you. These rights vary by jurisdiction, and not all rights are available to all individuals or in all jurisdictions. Where a privacy law grants rights that apply to us, we honor those rights for residents of the jurisdictions in which they are in effect. To exercise any rights that may be available to you, please use the contact information in the Contact Information section below.

Depending on the jurisdiction in which you reside and the law that applies to the Personal Information at issue, these rights may include:

• Being informed about how we collect and use your Personal Information;
• Confirming whether we process your Personal Information;
• Accessing and obtaining a copy of the Personal Information we maintain about you;
• Correcting inaccurate Personal Information we maintain about you;
• Requesting deletion of Personal Information we maintain about you;
• Obtaining a portable copy of certain Personal Information, where applicable;
• Appealing our denial of a request, where applicable;
• Not receiving discriminatory treatment for exercising your privacy rights; and
• Filing a complaint with us or the appropriate governmental authority.

The specific rights available to you, and how they apply, depend on the privacy laws of your jurisdiction. Some of these rights may not be available to you, or may be subject to limitations or exceptions, depending on where you reside and the law that applies.

We may require that you verify your identity before exercising your individual rights. In most circumstances, individual rights are not absolute, and where applicable law permits or requires, we may choose to limit or deny a request. If we limit or deny a request, we will provide an explanation in writing where required by law.

We will respond to your request within the time period required by applicable law. If we need additional time, we will inform you of the reason and extension period in writing where required by law.

Security and Retention

We maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Information from unauthorized access, use, disclosure, alteration, and destruction. We also require our third-party vendors and service providers to implement reasonable safeguards appropriate to the information they process on our behalf. Unfortunately, no data transmission or information system can be guaranteed to be 100% secure. Thus, we cannot guarantee or warrant the security of any information you transmit to us, and you do so at your own risk.

We keep Personal Information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law, including for tax, accounting, legal, compliance, dispute resolution, or business record purposes, after which it is deleted or anonymized. We determine the appropriate retention period for each category of Personal Information based on the amount, nature, and sensitivity of the information, the purposes for which we process it, and applicable legal requirements.

Third-Party Links

The Websites may include links to other websites, applications, information, and services provided by third parties, such as our Class I rail partners, affiliated services, or social media pages. We are not responsible for the privacy policies or practices of those third parties. We encourage you to review the applicable privacy policies of third parties if you elect to follow links provided through the Websites.

Policy Updates

We may update this Policy to reflect changes in our privacy practices at any time and without prior notice to you, except as required by law. When we do so, we will update the effective or last modified date above.

Contact Information

If you have any questions or comments about this Policy or our privacy practices, or if you would like to exercise any of your rights, please contact us by email at info@fingerlakesrail.com or by mail at:

Finger Lakes Railway Company, Inc.
PO Box 1099
Geneva, NY 14456
Phone: 315-781-1234