Skip to Main Content
Follow Us

Privacy and data retention policy

What information do we hold and use?

iTravel York collects and processes the following types of personal data in order to offer personalised services:

  • Name, address, gender, approximate age.
  • email address.
  • Telephone number.
  • Whether there are children in your household.
  • Your York by bus smartcard serial number.

On what grounds do we use the information?

myTravelYork account information is used to contact you with news, events and offers, providing you have previously opted in to receive this information. If you have registered a York by bus smartcard on your account, we will use your details to get in touch if your card is lost and handed in to us.

If you ask us a question, we will use the information provided to help us respond to your enquiry.

How do we collect this information?

Personal data is provided by you when you create an account at myTravelYork, register your details with us at one of our events, register for a York by bus smartcard or ask us a question.

Who do we share your information with?

iTravel York is a service provided by City of York Council. We will not share your myTravelYork account details with any other organisations unless you have specifically opted in using the tick boxes in the myTravelYork account settings page.

If you have specifically opted in to receive occasional promotional offers from bike shops, public transport operators and other project partners, we may share your information with cycle shops and transport operators in the York area. You may revoke your opt-in at any time by visiting your myTravelYork account page and deselecting this option.

If you ask a question about Park & Ride, your name and email address will be shared with First York Ltd, the operator of York Park & Ride.

If you ask a question about York Health Walks, your name and email address will be shared with the volunteer Health Walk coordinator.

All other questions will be answered by employees of City of York Council.

In certain circumstances service providers, professional advisers and auditors may also be classed as data controllers.

How long do we store it and is it secure?

iTravel York will ensure that information is only held for as long as it is needed. Pending (unactivated) myTravelYork account information will be deleted after 12 months. Active account information will be retained until you ask us to delete it.

All information is stored securely on the iTravelYork server, which is owned and maintained by our technology partners Castlegate IT. Castlegate IT will not use or share your information for any purpose.

What rights do you have?

For the purpose of delivery and administration, legal obligations, statutory duties and discretionary services and/or to comply with contractual obligations relating to them, you have the following rights:

  • The right of access - You are entitled to see the information iTravelYork holds about you and can request a copy by asking us.
  • The right to rectification - If you believe any information iTravelYork holds about you to be incorrect, please update your details on your myTravelYork account page.
  • The right to erasure/right to be forgotten – To request your account be deleted, ask us.
  • The right to restrict processing - Should you wish us to limit how we use your data please ask us.
  • The right to data portability – If you require an extract of your data to be provided to you in csv format, please ask us.
  • The right to object - In addition to the right to limit the use of your data, you also have a right to object to the use of your data for certain actions.

Should you exercise your right to object, iTravel York will take appropriate steps to ensure your request is complied with but that it also fulfils any legal obligation or statutory duty it has to provide you with information or services.

Where can I find out more?

If you want to know more about how iTravel York and the council uses information, your rights or have a concern about the way we are collecting or using your personal data, we request that you contact us in the first instance.

Alternatively, you can contact the Information Commissioner’s Office.