West Midlands Rail is a partner of West Midlands Combined Authority and as such West Midlands Combined Authority is the data controller for personal data for West Midlands Rail.
https://www.wmca.org.uk/policies