City Hopper Pass
Privacy Policy
Last updated 23 July 2026
This service sells a one-day bus pass for Gibraltar. It is operated by Cycle It Ltd (Gibraltar), the data controller for the personal data described here. We built the service to need as little of your data as possible: no account, no sign-up, no marketing, no advertising trackers, and no analytics cookies.
What we collect, and why
| Data | Why | Kept where |
|---|---|---|
| Travel date & passenger counts | To issue your pass and price your order | Our order records |
| Email address (optional) | Only to send your pass as a backup copy, and to re-send it if you ask. Never used for marketing, never shared for marketing. | Our order records |
| Payment card details | We never see or store them. Payment happens inside our payment provider's PCI-certified checkout; we receive only confirmation that your order was paid, and the amount. | Payment provider only |
| Pass details (code, date, passenger counts) | To display and validate your pass. The QR code contains only the pass code, travel date and passenger counts — no personal data. | Our pass records |
| Scan events | When crew scan a pass, we record the scan count and time against the pass code, to detect misuse (e.g. a shared screenshot). No location or personal data is recorded. | Our pass records |
| Language preference | To show the site in your language | Your device only |
| A copy of your pass | So the pass still works if you lose signal | Your device only |
Your location never leaves your phone
If you tap the location button in the journey planner, your position is used on your device to find your nearest bus stop. It is not sent to our servers and we cannot see it. The "Walk me there" and "Open in Google Maps" buttons open Google Maps with your chosen stops; from that point Google's own privacy policy applies.
Who processes data on our behalf
- Payment provider — processes your card payment. Card data goes directly to them and never touches our systems.
- Email delivery provider — sends your pass email to the address you gave, on our instruction.
- Hosting provider — runs the website and our order records. Like all web hosts, it keeps short-lived technical logs (such as IP addresses) for security and operations.
Each acts only on our instructions under a data-processing agreement. We do not sell personal data to anyone, ever.
What the bus companies see
The Gibraltar bus operators receive aggregated sales reporting only: how many passes were sold per day, at what times, and the amounts. They do not receive your email address or any other personal data.
Cookies and device storage
We use no advertising or analytics cookies. The site stores your language choice and a copy of your pass in your browser's local storage, on your device. Crew validating passes receive one functional cookie that keeps them signed in for a shift. That is the complete list.
How long we keep data
Order and sales records are kept for up to six years, as required for accounting and tax purposes. Your email address is kept with your order; you can ask us to delete it at any time — the anonymous sales record (date, counts, amount) remains, as it contains nothing personal.
Legal bases
We process order data to perform our contract with you (selling and honouring your pass); scan events under our legitimate interest in preventing fraud; and accounting records to meet our legal obligations.
Your rights
Under Gibraltar data-protection law (the Gibraltar GDPR and Data Protection Act 2004) you may ask for a copy of your data, ask us to correct or delete it, or object to our processing. Write to us at the address below and we will respond within one month. You may also complain to the Gibraltar Regulatory Authority (gra.gi).
Children
Passes for children are bought by adults. The service is not directed at children and collects no data about them beyond a ticket count.
Contact
Cycle It Ltd, Gibraltar — admin@cycleit.gi, or use the contact form.
Changes
If we change what we collect or how we use it, we will update this page and the date at the top before the change takes effect.