Nature Reserve to Town
Privacy Policy
Last updated 7 August 2026
This service sells a bus ticket for the journey from the Gibraltar Nature Reserve to town. It is operated by Cycle It Ltd (Gibraltar), the data controller for the personal data described here. We built the service to need as little of your data as possible: no account, no sign-up, no marketing, no advertising trackers, and no analytics cookies.
What we collect, and why
| Data | Why | Kept where |
|---|---|---|
| Travel date & ticket count | To issue your ticket and price your order | Our order records |
| Email address (optional) | Only to send your ticket as a backup copy, and to re-send it if you ask. Never used for marketing, never shared for marketing. | Our order records |
| Payment card details | We never see or store them. Payment happens inside our payment provider's PCI-certified checkout; we receive only confirmation that your order was paid, and the amount. | Payment provider only |
| Ticket details (code, date, ticket count) | To display and validate your ticket. The QR code contains only the ticket code, travel date and ticket count — no personal data. | Our ticket records |
| Scan events | When staff scan a ticket, we record the scan and its time against the ticket code, to detect misuse (e.g. a shared screenshot). No location or personal data is recorded. | Our ticket records |
| Language preference | To show the site in your language | Your device only |
| A copy of your ticket | So the ticket still works if you lose signal | Your device only |
Who processes data on our behalf
- Payment provider — processes your card payment. Card data goes directly to them and never touches our systems.
- Email delivery provider — sends your ticket email to the address you gave, on our instruction.
- Hosting provider — runs the website and our order records. Like all web hosts, it keeps short-lived technical logs (such as IP addresses) for security and operations.
Each acts only on our instructions under a data-processing agreement. We do not sell personal data to anyone, ever.
What our commercial partner sees
Our operator partner receives aggregated sales reporting only: how many tickets were sold per day, at what times, and the amounts. They do not receive your email address or any other personal data.
Cookies and device storage
We use no advertising or analytics cookies. The site stores your language choice and a copy of your ticket in your browser's local storage, on your device. Staff validating tickets receive one functional cookie that keeps them signed in for a shift. That is the complete list.
How long we keep data
Order and sales records are kept for up to six years, as required for accounting and tax purposes. Your email address is kept with your order; you can ask us to delete it at any time — the anonymous sales record (date, counts, amount) remains, as it contains nothing personal.
Legal bases
We process order data to perform our contract with you (selling and honouring your ticket); scan events under our legitimate interest in preventing fraud; and accounting records to meet our legal obligations.
Your rights
Under Gibraltar data-protection law (the Gibraltar GDPR and Data Protection Act 2004) you may ask for a copy of your data, ask us to correct or delete it, or object to our processing. Write to us at the address below and we will respond within one month. You may also complain to the Gibraltar Regulatory Authority (gra.gi).
Children
Tickets for children are bought by adults. The service is not directed at children and collects no data about them beyond a ticket count.
Contact
Cycle It Ltd, Gibraltar — admin@cycleit.gi, or use the contact form.
Changes
If we change what we collect or how we use it, we will update this page and the date at the top before the change takes effect.