Last updated: August 14, 2025
Citymapper Ltd. ("Citymapper", "we", "us", or "our") is an innovative journey planning and transportation technology company dedicated to transforming urban navigation. Citymapper is a wholly owned subsidiary of Via Transportation, Inc., and we provide technology solutions that cities, transit agencies, and other organizations can use to encourage urban journey planning by various methods and to promote public transit usage.
Citymapper is committed to the principles of transparency and protecting our users' privacy. This Privacy Notice explains how we collect, use, share, disclose, and otherwise process your personal information. It also explains how you can exercise the choices and rights you have regarding your personal information.
This Privacy Notice applies to:
All users of our apps (including both free and paid versions of the "Citymapper App").
Our website's users and visitors (including "www.citymapper.com").
3. Users of our platforms and dashboards, and other Citymapper products and services including those that Citymapper makes available to Enterprise Customers defined below.
Items 1 through 3 are collectively referred to in this Privacy Notice as the "Services". Accordingly, the covered users include but are not limited to individuals using our journey planning tools, visitors to our website, and any other individual interacting with our Services (collectively, "Users" or "you").
Enterprise Customers are cities, transit agencies, transport operators, school districts, educational agencies or institutions, universities, corporations and other governmental or institutional customers which use the Services — whether provided directly by Citymapper or jointly with its parent company, Via Transportation Inc., or any of its affiliates — to establish, monitor, optimize, operate and/or manage transportation, delivery, and logistics networks, as well as business partners or other entities which may use Services in order to arrange for transportation, delivery, or logistics services for Users.
Please note that all corporate entities and organizations referenced throughout this policy are defined to include their affiliates and agents. For example, when we say that we share information with Enterprise Customers, we may share information with employees, agents, affiliates, consultants, or subcontractors designated or authorized by these Enterprise Customers to receive such information.
Please read this Privacy Notice to ensure you understand it and agree with its terms before using the Services.
Citymapper is the "data controller" (as such term, or equivalent, is defined under applicable data protection laws) of the personal information collected through the Services which is subject to this Privacy Notice. Meaning, we control the processing of personal information described under this Privacy Notice and decide upon the purpose and means of collection and processing.
Our company is registered in England and Wales under company number 07370388 with a registered office at 138 Fetter Lane, London, EC4A 1BT, United Kingdom.
If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please contact our Data Protection Officer at support@citymapper.com. You can also reach us by mailing:
Attn: Data Protection Officer
Citymapper Ltd.
138 Fetter Lane
London, EC4A 1BT
Citymapper has appointed the Via Mobility DE GmbH, Rosa-Luxemburg-Str. 14.; 10178 Berlin, Germany, as its representative in the European Union pursuant to Article 27 GDPR.
We may provide different or additional disclosures to residents in certain countries, regions, or states, or as we are otherwise required in accordance with applicable laws in such jurisdictions, so please be sure to review such notices in addition to consulting this primary Privacy Notice. Specifically, our GDPR Notice further details specific information regarding our data processing practices we are required to disclose under the EU and the UK General Data Protection Regulations, including our lawful basis for processing personal data (collectively "GDPR").
As used in this Privacy Notice, "personal information" or "personal data" is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual.
Depending on the nature of your interaction with us and our Services, we may collect the types of personal information detailed below, as follows (1) information you provide to us, (2) information collected automatically when you use the Services, and (3) information collected from other sources.
Personal information you provide to us
User Account Information: To use our Services, you may create an account, provide us with information about you, such as your email address and, if you choose to, your name and telephone number. We use your email address to ensure that you can easily access your account, your saved places and other personalised features across multiple devices. Note that if you elect to use an external service (e.g., Google, Apple, or Facebook) to create a user account, we will receive certain information from such platforms. See the "Single Sign On" below for more information.
In addition, when you plan a journey using our Services, and enter journey data, such as destinations and preferences, we collect and process this information. Some journey data may also be collected in real-time via location services. See "Location Information" for more details.
Note that you do not need to create a user account to use the Services. If you do not create a user account and use our Services, we will still collect personal information like journey data, destinations and preferences, as described in this Privacy Notice, including Location Information. The data will be linked to a unique ID randomly generated by Citymapper each time you install the Citymapper App, as further detailed under the "Device Information & Online Identifiers" below. This helps us keep track of your previous journey planning searches and enables us to find the best route for you. Note that if you do not create a user account, you may not be able to take advantage of certain features offered in the Services.
Payment Information: If you elect to pay to access or use any element of the Services (including premium versions of the Citymapper App or features that enable you to purchase third-party transportation services), we collect and maintain information about the transaction and your payment methods (e.g., amount, ticket, time and date, credit card holder, and the last 4 digits of your payment method), available voucher or credit balances, and information about attempted and actualised transactions, however, we do not directly collect or store full debit or credit card numbers. Payments for any purchases you make are made through third-party payment processors providers or in-app payment through the app stores. Note that, in some cases the purchase of transportation services will be made through integrated services of our transit partner's service providers and in such event, any information you provide, including payment information is collected directly by such third party and we do not collect, receive, or have access to such information. Accordingly, all payment information is provided by you directly to the third parties detailed above, and their use of your information is further governed by their privacy notices and practices.
Saved and Shared Preferences: You may choose to select preferences and provide us with information on your home address, work address, and other saved places to receive personalised journey-planning Services and to expedite your searches. If you enable these in-app permissions, you may also share information with us from other apps, including through your third-party calendar app, so that you can get information about your upcoming events and help you get to them on time.
Contact Information and Contact Communications: Whenever you contact us (for example, through online contact forms available through the Citymapper's websites, by seeking customer support, providing feedback, responding to one of our messages or survey requests, by signing up to our Newsletter, etc.), we will collect any information you provide, which may include the content of your messages to us and any attachments, and depending on the communication, your name, and contact information such as email address or telephone number, organization and title, country or mailing address (if you contact us on behalf of an actual or potential Enterprise Customer). We will also collect information which is apparent from your communication (for example, the email address or phone number from which you contacted us) and our communications and correspondence. If you communicate with us by telephone or other audio or video communication platforms, we may record the audio or video of our communications, create transcripts, and retain the recordings or transcripts consistent with applicable law. In certain instances, we may provide you an opportunity to indicate your preferences for our future communications, and we will collect any preferences you indicate.
Survey and Rewards Program Information: We may offer you the opportunity to participate in surveys, quizzes, contests, interviews, rewards programs or promotions. If you choose to participate, we may collect or ask you to provide personal information to participate in such opportunities, which may include your contact information, feedback to the survey, other information related to the eligibility of such rewards programs, etc. This information might be provided directly to us, or to our third-party partners which manage the applicable program through their platforms.
Location Information: When you use the Services,
we may collect location data (including GPS, if enabled by you, and
Wi-Fi data) from your device or browser. The way in which we collect
location information depends on the features of the Services you are
using, as well as your mobile device and browser settings. For
example, if you've authorised your device to share your location
with us, we may use your location at the time you open the
Citymapper App to establish the "start" location for a journey; if
you disable your device's location services, you may have to
manually enter the "start" location. Similarly, if you've enabled
location-sharing services, we may collect information about your
location at the time that you report an issue to our customer
support team.
In general, when we collect location information from your mobile
device, we do so when the Citymapper App is running in the
foreground (i.e., when the application is open and on-screen). If
you use certain functions, like the "Go" feature to receive
turn-by-turn navigation, we will also collect real-time location
data throughout your journey in the background (when the application
is open but not on-screen). You can manage or disable location
tracking at any time through your device settings.
In addition, when you use our Services, we may collect approximate location data (for example country, city and ZIP) based on any automatically collected Device Information and Online Identifiers, as defined below.
Device Information & Online Identifiers: We may collect information transmitted from your device or a browser when you use our Services, including when you use the Citymapper Apps, when you access our websites or otherwise use our platforms (for example, as an Enterprise Customer), contact us to report an issue or respond to an in-App survey. This information may include your internet protocol (IP) address, cookie ID, and similar unique online and mobile identifiers - for example a unique installation ID randomly generated by Citymapper each time you install the Citymapper App, tags, mobile advertising identifiers, etc. We collect additional information related to your browser and device, that, where associated with such online identifiers, is considered as personal information, such as operating system, browser type, browser language and time zone, internet service provider, information regarding the mobile device you use to access the Citymapper App (such as hardware model, screen size, and, if enabled by you, device motion information), as well as your preferences regarding data access and collection, for example permissions you have enabled, cookies preferences, etc. We may further extract your approximate geographical location from the online identifiers (for example, country, city and ZIP extracted from IP address). Device information and online identifiers are collected, among others, through our services providers and other business partners' technologies and tools, including cookies, as further detailed below. For details about how this information is automatically collected and used, as well as the choices you may have in relation to those practices, please also review our Cookie Notice.
Usage Information: We collect information about how you interact with our Services. Like most providers of online services and platforms, we automatically collect information about the electronic path you take to our Services, through our Services and when exiting our Services, and your usage and activity on our Services, and may but is not limited to, log data, information about when and how you downloaded the Citymapper Apps or created your User Account; your access and login activity; your preferences; details about any transportation or delivery services you request or participate in through our Services; your transactions; the specific components of the Citymapper Apps, websites, platforms or any other aspect of our Services you visit or use, along with details about your views or use of these components and actions made, such as the links, objects, features, settings, products and benefits you view, click, or otherwise interact with as well as the duration and time and date stamp and URLs which directed you to our Citymapper websites; any alerts or communications we send you in connection with your use of our Services and your interactions with such communications; and any errors that may have occurred during your use of our Services. This information may be collected and stored by us, or by our third-party service providers and business partners, using cookies, related technologies (such as pixels and web beacons), and third-party analytics tools. For more details, please review our Cookie Notice.
Personal information collected from other sources and Third Parties
Although we generally collect the personal information described above directly from you or from your device, we may also collect this information through other third parties that collect and share it with us through the provisions of our Services, as noted below. Please note that these third parties might further independently use your personal information as part of your relationship with them. To learn about third parties' privacy practices, please review their respective privacy notices. The third parties from which we may collect personal information and types of personal information include:
Via: Subject to applicable laws, we may share and receive personal information within our company group as needed to provide, improve and develop our Services. Our company group includes our parent company Via Transportation, Inc. and its other affiliates and subsidiaries ("Via"). We use this information primarily to provide customer support to Citymapper Users in connection with journeys they book through our Services, as well as for analytics and troubleshooting purposes.
Service Providers and Business Partners: We work with a wide range of third-party service providers and business partners who make it possible for us to make the Services available and also help us to improve the Services. These service providers or business partners include third-party transportation services; transit ticketing, booking, and payment services; data storage and processing services, mapping services; customer support services; fraud prevention, security, and troubleshooting services; communications services; translation and accessibility services; research and analytics providers; professional service providers; payment processing services; marketing, advertising, and social media services. These service providers and business partners may collect your personal information when you provide it to them or automatically when you interact with them, and they may share that information with us.
Social Media: If you interact with us through social media, we may collect personal information about you that you have chosen to make available to us through your social media account and social media platform settings. We use personal information collected in connection with your social media account and activity to communicate with you and better understand your interests and preferences. Please note that the social media platform's respective privacy policies further apply to any of your interactions through their platforms and their own collection, use and personal information sharing practices.
Inferences: We may generate inferences or predictions about you and your interests and preferences based on the other personal data we collect and the interactions we have with you.
Single Sign-On: We may provide you the ability to log in to the Services through certain third-party accounts you maintain. When you use these single sign-on protocols to access our Services, you give us your permission to retrieve the relevant information about you, depending on your third party account's settings, which may include your email address, user name or associated tokens and other public profile information, provided however that we do not receive your password or similar login credentials.
Use of Anonymized and Aggregated Data:
This Privacy Notice does not apply to anonymized, aggregated, or de-identified data. Once information is aggregated, anonymized, or de-identified in a way that cannot be associated with or linked to you, we may use and share it for various purposes. For example, we may share aggregated insights about demand patterns with our affiliates, partners, and Enterprise Customers to help them understand passenger behaviour, make smarter planning and operational decisions, or improve the Services and business operations.
Additionally, we may aggregate, anonymize or de-identify personal information for analytics purposes to help understand Users' needs and improve our services and offerings. For example, we may analyse how Users interact with the Services (such as the most viewed content, feature or click stream) to improve the way we present such content or develop better features, to measure effectiveness of our content and advertising campaigns, or otherwise to develop and train our artificial intelligence features and models.
We use the personal information described above to:
Provide and Operate Citymapper Services: We use personal information to enable, operate and provide the Services. For example, we use your contact information to create and maintain your user account including to store your preferences, or otherwise, if you have not signed-in, we use the unique ID associated with your app to enable similar functionality. We further use Device information and Online identifiers to ensure you are using the type and version of our Citymapper App which is compatible with your device. Our journey planner uses the information you provide about your desired origin and destination to suggest possible transit modes and routes you could take. Additionally, if your device's preferences enable you to share your location, we may collect your location information throughout your journey so that we can provide journey support, such as alerting you when to get off a bus. If we make third-party services like transit ticketing platforms available through the Services, we may use your personal information to enable you to access and use such third-party services.
Internal Operations, Monitoring & Records: We use personal information, including Device information and Online identifiers and usage information, to ensure our Services are operated and provided properly, to identify software bugs and troubleshoot errors, for debugging and to resolve technical issues, and to monitor to way the Services are provided.
Personalise Citymapper Services: We use personal information to personalise aspects of the Services. For example, we use your saved preferences, previous routes, and journey preferences to recommend transit options that match your preferences, and we use your usage information to provide you with the most relevant information as efficiently as possible.
Improve Citymapper Services & Analytics: We use personal information to help us continually improve our Services, enhance your experience and develop new products and features and technologies. For example, we may use your personal information to improve our algorithms, to test any aspect or configuration of our Services, to identify potential new processes, features, or initiatives, and to conduct general research and development, for analytics purpose to help understand Users' needs and improve our services and offerings, for example, we analyse how Users use our Services (such as the most viewed content, used feature or click stream) to improve the way we present such content or develop better feature, to measure effectiveness of our content and advertising campaigns.
Safety, Security, and Fraud Prevention: We use personal information to offer the Services safely and securely, and to deter fraudulent, harmful, unauthorised, unethical, or illegal activity. For example, we may use personal information to authenticate Users and verify accounts, and we may use access logs to monitor and detect unauthorised access or usage related to our Services. We may also use Google reCAPTCHA to verify that User interactions with the Services are with real humans. The use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.
Customer Support: We use personal information to provide support to you, respond to your feedback and inquiries, to investigate or otherwise address incidents, claims, or disputes relating to the use of the Services, and to monitor and improve our customer support processes. For example, if you send in a complaint or raise a query, we can use the information you provide or which we collect from you to reply to your communication and help to address the issues you identified.
Communications, Marketing and Advertising: We use personal information to communicate with you about your use of the Services and for marketing and advertising purposes. For example, we may use your personal information to contact you and address your inquiries or other contact communications you have submitted and to send you information you have requested, to alert you about the status of transit services, to send announcements and security alerts, and to deliver marketing communications, news, or advertisements about our Services or products or services offered by business partners, including targeted advertisements (which further depends on your mobile or otherwise cookies' settings and preferences) across the web. In addition, depending on your cookies or other applicable privacy settings and preferences, we share your Device information and Online identifiers, and certain usage information with our advertising partners, to enable placements of ads within our Citymapper Apps in accordance with such preferences. Please note that you can use your in-app, mobile device, and/or browser settings to adjust your advertising preferences. For more information, please see our Cookie Notice.
Compliance, Lawful Requests and Enforcement: We use your personal information as necessary or appropriate to comply with applicable laws, lawful requests, and legal processes as well as to enforce our terms, policies and agreements with Users or Enterprise Customers, demonstrate compliance and defend our rights. For example, we may be required to provide information in response to a subpoena, or we may receive lawful requests for information from law enforcement, regulators, government officials, or other third parties authorised to make such requests. In these circumstances, we may use and disclose personal information as required or permitted by applicable law. In addition, if a User breached our terms, policies or other engagement, or in the event of an actual or threatened claims and legal proceedings, we may use, retain and disclose personal information to defend our rights or demonstrate we have complied with the terms of this Privacy Notice and applicable laws.
We work hard to improve the Services and add functionality, which we think will make it safer, more fun and more useful. New functionality may involve similar or incidental uses of your data to those set out above. We regularly review the way we use data and will update our Privacy Notice if anything changes.
We share your personal information with third parties, including our partners or service providers that help us provide our Services or otherwise for the purpose of improving and marketing our Services, as well as in cases needed to resolve claims. We take your privacy seriously, so when we do share your information with third parties, we try to disclose anonymized or aggregated data wherever possible. We also take reasonable and appropriate steps to limit the scope of information that is disclosed and to ensure that the third party is required to comply with data protection laws. We may share and disclose personal information in the following ways:
Within Via: Citymapper, is a subsidiary of Via Transportation, Inc., and as such, is part of Via. Via works together to provide, manage, operate and improve the Services and we may share personal information among Citymapper's affiliates (meaning Via entities) which are responsible for various aspects of our Services. This sharing is conducted for the purposes set out in this Privacy Notice, helping to improve and develop our Services and provide you with a seamless and enhanced user experience across our services. When sharing information, we limit access to your personal information to employees and affiliates that need access to this information in order to perform their job functions. We may further share anonymized, aggregate or de-identified information for internal or other business purposes.
Service providers: We may share your personal information with our service providers (which may include our affiliates) to perform services on our behalf. Some of the categories of service providers and vendors that we use include:
Data storage and processing services: We host the Services on cloud servers and use third-party vendors for assistance with data collection, processing, storage, retrieval, and aggregation.
Mapping services: We use third-party software to assist with mapping and navigation functions, as well as to suggest relevant addresses and locations based on your origin and destination searches.
Payment processors: We may use payment processors and online payment system providers to process any transactions you may make through the Services.
Customer support services: We work with third party service providers to help us provide customer support to Users of the Services.
Fraud prevention, security, and troubleshooting services: We use service providers to assist us in detecting and preventing fraudulent use of our Services, preserving the data security of our systems and the Services, and identifying and resolving errors or incidents that may affect the Services.
Messaging services: If you decide to use certain messaging or sharing features in the Services, then you may be sharing your information with those companies. For example, if you use the "Share Directions" feature in the Citymapper App, a link with your start and end points will be sent through the messaging app you select.
Communications services: We use vendors to provide communications services for functions such as managing and sending in-app notifications, emails, text messages, and telephone calls.
Marketing, advertising and social media services: We use marketing vendors, including advertising networks, social networks, and marketing communication providers and consultants to assist in designing our marketing campaigns, and targeting our marketing to specific audiences. Some of these third parties might collect or use your personal information under their own policies and practices. Please see our Cookie Notice to learn more about the information we may share for these purposes and your ability to adjust advertising preferences.
Translation and accessibility services: We work with translation vendors and similar service providers to make the Services accessible to Users around the world.
Research and analytics providers: We may use service providers to help us aggregate personal information and receive insights about how the Services are used.
Professional service providers: We may consult with or retain lawyers, accountants, government affairs or subject matter experts, and other professionals.
Transportation and booking business partners: We may offer you the opportunity to use our Services to purchase transit tickets or book journeys with transportation providers (including those made available to you by our affiliates) as well as other features and services such as to connect to a third-party ride hailing or scooter sharing company. In those cases, we may share information with such partners to enable them to provide these services to you including to process transactions, etc. For example, we may share your name, contact information, and location data with transportation providers to facilitate journeys booked through the Services and we may share your journey data through an API integration to enable you to use their services efficiently. Note that these third parties collect and use your personal information under their own policies and practices.
With advertising partners and networks: Our Services may further include display of third-party advertisers' ads. To enable this and depending on your cookies or ads preferences and settings, such third parties' cookies or similar technologies collect certain information when you access our Services, such as online identifiers, device information and usage information, as well as information related to the URL you visited or contact viewed, and location information. We will further share with such third parties your cookies preferences (for example, if you provided consent to targeted ads or opted out). Depending on your cookie's preferences and settings, these third parties might combine your information with other information they independently collected from your online activities through their network. In addition, your personal information they collect, and use shall be further subject to their own policies and practice. Please see our Cookie Notice to learn more about the information we may share for these purposes and your ability to adjust advertising preferences.
In a business transaction, transfer, or reorganisation: We may disclose personal information to a third party in connection with, or during negotiations of, a business transaction such as a merger, acquisition, joint venture, financing or sale of company assets, or in the event that a service we provide is transitioned to another provider. Personal information may also be disclosed in the event of insolvency, bankruptcy, or receivership.
Pursuant to legal obligations and rights: We may disclose personal information to third parties, such as law enforcement, government authorities, issuers of licences and permits, insurers, claimants, and other third parties as we determine to be necessary to (i) respond with civil, criminal, or regulatory inquiries and legal process (including search warrants, subpoenas, summonses, or court orders), (ii) comply with licensing, regulatory, and other legal obligations, (iii) enforce our policies and agreements, (iv) establish, exercise, or defend legal claims, or (v) protect the rights, safety and property of the Company, third parties, or the public.
With your consent and request: We may disclose your personal information publicly or to any third parties not otherwise mentioned in this Privacy Notice.
We take the security of your personal information and our data seriously. We have implemented robust physical, technical, and organisational measures designed to help protect your personal information against unauthorised access, use, or disclosure. However, protecting your user credentials and limiting access to your devices remains your responsibility. Please take appropriate precautions to safeguard your accounts and personal information.
We retain your information for as long as necessary to fulfil the purposes set forth above (see the "How We Use Personal Information" paragraph of this Privacy Notice), all in accordance with applicable laws, or until an individual expresses a preference to delete its personal information (subject to certain exclusions entitling us to decline such request under applicable laws).
We retain your personal information to provide you our Services, or as long as required to fulfil our legal obligations including regulatory, tax, or accounting requirements. For example, we retain your User Account information and activities made thereunder for as long you retain the account, and thereafter, we retain certain information such as transactional information and information about rides or deliveries you make and receive to ensure we can perform legitimate business functions, such as accounting for tax obligations.
We will further retain certain personal information to maintain an accurate record of Users' interactions with the Citymapper Services provided and compliance with our obligations under applicable laws, as well as to have records in the event of any complaints or litigation.
If you request account deletion, or otherwise submit a deletion request, we will delete your information as set forth in the "Your Rights" section.
Unless otherwise required by applicable law, we may, at our discretion, delete or modify information in our systems without prior notice once we determine it is no longer needed.
In connection with the Services, we may send you email messages, SMS messages, push notifications, or other communications, including telephone calls, consistent with applicable laws.
You may ask us not to send you certain types of communications by:
Following any opt-out instructions that are made available in our marketing communications.
Sending a written request to support@citymapper.com clearly stating the nature of your request and identifying the email address or number at which we contacted you.
You may also be able to use your mobile device or in-app settings of our consent management system to opt out of certain types of communications and push notifications.
If you request to opt out of marketing communications, please note that we may continue to send you non-marketing communications where permitted by law, which may include account verification and maintenance, status updates regarding specific transactions (such as transportation or delivery services you arranged using the Services), changes or updates to the Services or our ongoing business relationship, and any technical, administrative, legal, or security-related notices.
Under applicable data protection laws, Users are granted with choices, rights, and controls that they are entitled to exercise in connection with their personal information. Depending on your location, relationship with us, and applicable laws, you may have the following rights regarding your personal information:
Informed: You have the right to be provided with information regarding our personal information processing and privacy practices - all as detailed under this Privacy Notice. If you have any additional questions, please contact us at: support@citymapper.com.
Access: You have the right to access and obtain a copy of your personal information, as well as information relating to its processing.
Correction and Update: You have the right to correct or update any personal information that is inaccurate or incomplete. You control your account information and settings and you may update your User Account information and communication preferences at any time.
Restriction of Processing: You have the right to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
Deletion/ Right to "Be Forgotten": You have the right to request the deletion or erasure of personal information about you if the continued processing of that personal information is not justified. Deletion requests will be subject to our rights and obligations under applicable law, and we may retain certain information as permitted or required by statute, rule, or regulation. You are not required to create an account with us to submit a deletion request.
Portability: You have the right to obtain a copy of personal information about you in an easily accessible format and the right to transmit that personal information to another controller.
Objection to Processing: You also have the right to object to any processing of your personal information based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case.
Withdrawal of Consent: Where we rely on your consent for processing of your personal data,you also have the right to withdraw your consent to such processing, subject to certain limitations at law. In the case of mobile device location services, you can change your location preferences at any time by managing your device settings. In the case of consent to our use of Cookies, you can use our cookie preferences management tool available in our Citymapper App and website, to change your preferences.
Opt-Out: You have the right to opt-out from receiving our marketing communications as set forth under the "Your Communication Preferences" paragraph above.
File a Complaint: You may ask questions or lodge a formal complaint with your national data protection authority. The applicable Supervisory Authority for the Citymapper Services in the UK is the Information Commissioner's Office. For the Citymapper Services in the EEA, please refer to the list of authorities here.
You may exercise your rights as follows:
You can exercise any of the rights listed above by contacting us at support@citymapper.com and using the subject line "Data Subject Request". Please note that we may need to verify your identity before processing your request, which may require us to collect additional Personal Data from you. We may decline a request to exercise the rights listed above, consistent with applicable laws. Please also note that if your exercise of any of the rights listed above limits our ability to process Personal Data, we may not be able to provide some or all portions of the Services to you going forward. We will respond and fulfil your request within the timeframe required under applicable laws.
When you submit a request, we will take steps to verify your identity and your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for denial and how to remedy any deficiencies, where applicable.
Certain rights can be easily executed independently by you without the need to contact us, and for example:
Citymapper Apps have an in-app deletion function, which you may use to delete your account information.
You can use the cookies preference management tool on our Citymapper Apps and websites to change your preferences and withdraw consent to our use of cookies.
You may opt-out of our marketing communications as set forth under the "Your Communication Preferences" paragraph above.
You can change your preferences regarding permissions enabled for the Citymapper App, for example, to disable any GPS location permissions through your device settings.
Our Services are not directed to children, and we do not knowingly collect or solicit personal information directly from children. When we use the word "children", we refer to anyone under the applicable age of consent for privacy purposes in relevant local jurisdictions (typically between 13 and 16 years old). If you are a child, please do not submit any personal information to us or otherwise use our Services without parental or legal guardian consent. We encourage parents and legal guardians to monitor their children's internet use and to help enforce our Privacy Notice by instructing their children never to provide personal information without their permission.
Protecting the privacy of children is important to us. If we learn that we collected information from a child without appropriate parental or legal guardian consent, we will take steps to delete it and may close the relevant account without notice. If you have reason to believe that a child has provided personal information to us without consent, please contact us at support@citymapper.com.
Our websites and Services may include links to or redirect you to third-party websites, plug-ins and applications, including social media services where you may connect with us or where you interact with third party ads displayed on our Services. Third-party websites may also reference or link to our websites and online services. Except where we post, link to, or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to, and we are not responsible for, any personal information practices of third-party websites and online services or the practices of other third parties. To learn about the personal information practices of third parties, please review their respective privacy notices or policies.
Due to our global operation, we share personal information with third parties (such as our service providers and affiliated companies) located globally, including outside the EEA and UK. Accordingly, your personal information might be shared outside the territory from which you use our Services. When transferring your personal information across borders, including to our affiliates and third parties under the circumstances described in this Privacy Notice, we ensure compliance with all applicable legal requirements. We monitor regulatory developments with respect to cross-border data transfer and, where appropriate, we rely on adequacy decisions (meaning transfer to countries the European Commission or the United Kingdom Government has deemed to adequately safeguard such data) or otherwise we transfer personal information based on the Standard Contractual Clauses and the International Data Transfer Addendum adopted by the European Commission and the UK ICO, to ensure your data is protected.
Transfers of personal data to Via affiliates or to our Service providers located in the United States are made based on such entities' certification and compliance with the principles of the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, as set forth by the U.S. Department of Commerce (collectively, the "DPF"). Where an entity is not certified under the DPF, or if the DPF is no longer considered a valid transfer mechanism, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as applicable, to safeguard such transfers. To learn more about the DPF program, and to view Via Transportation, Inc.'s certification in the DPF list of participants, please visit https://www.dataprivacyframework.gov/.
We will update this Privacy Notice from time to time, including to address changes in the Services, clarify or update our processes, and to comply with changing laws and regulations. When we make changes to this Privacy Notice, we will change the "Last Updated" date at the beginning of this Privacy Notice. If the changes apply to only one section of the Privacy Notice, we may update only that section's "Last Updated" date. If we make material changes, we will notify you, including through a pop-up notification on the Citymapper App, websites or by other means, including email or a prominently posted notice at the beginning of this Privacy Notice. All changes shall be effective from the date of publication unless otherwise provided in the notification, and subject to applicable laws. We encourage you to review this Privacy Notice periodically. By using the Services after an update, you agree to the updated version of the Privacy Notice.
Last updated: August 14, 2025
The information in this GDPR Notice supplements the information provided under the main Privacy Notice and provides Users with additional information required to be disclosed under the General Data Protection Regulation ("GDPR"), including our lawful basis for processing personal information. The terms used in this GDPR Notice have the same definitions provided in the Citymapper Privacy Notice, unless they are expressly given a new definition here. Please note that personal data, as defined below and under the GDPR ("Personal Data"), includes the term "personal information" used under the main Citymapper Privacy Notice.
Our legal basis for processing Personal Data depends on the type and the specific context in which we collect and use it. The table below illustrates the categories of Personal Data we collect, provides examples of how we use Personal Data within each category, and describes the legal bases for our processing of each category of Personal Data. Additional details about our use of Personal Data can be found in the "How We Use Personal Information" section of the Privacy Notice.
In the table below, "Performance of a contract" refers to processing for the purpose of performance of our agreements with Users and Enterprise Customers, including our Terms of Use.
As described in the table, in certain circumstances, we may ask for your consent to collect and process Personal Data for the purposes described below. Where we rely on consent, you have the right to withdraw your consent at any time, in which case we will cease that collection and use of your Personal Data for the purpose for which you provided consent.
When we process Personal Data based on our legitimate interests, it is for the purpose of operating our Services, ensuring that the our Services remain relevant and function well for each User, developing new and innovative services and features, and preventing fraud while promoting the safety and security of Users, Enterprise Customers, our Company, our contractual counterparties, and the general public.
| Category of Personal Data | Purposes of Processing | Legal Bases for Processing |
| User Account Information, and Single Sign-On as described in the Privacy Notice. | Setting up and managing User Accounts | Performance of a contract |
| Providing the Services | Performance of a contract | |
| Personalizing the Services |
Legitimate interests; Consent |
|
| Improving the Services & analytics | Legitimate interests | |
| Facilitating safety, security, and fraud prevention | Legitimate interests | |
| Providing & improving customer support | Performance of a contract; Legitimate interests | |
| Internal operations of the Services, monitoring & record keeping | Compliance with legal obligations; Legitimate interests | |
| Compliance with regulations or lawful requests & enforcement of our terms, policies and agreements | Compliance with legal obligations; Legitimate interests | |
| Payment Information, as described in the Privacy Notice. | Providing the Services | Performance of a contract |
| Facilitating safety, security, and fraud prevention | Legitimate interests | |
| Internal operations of the Services, monitoring & record keeping | Compliance with legal obligations; Legitimate interests | |
| Compliance with regulations or lawful requests & enforcement of our terms, policies and agreements | Compliance with legal obligations; Legitimate interests | |
| Saved and Shared Preferences, as described in the Privacy Notice. | Providing the Services |
Performance of a contract. In app permissions are further based on Consent. |
| Personalizing the Services |
Legitimate interests; Consent |
|
| Contact Information and Contact Communications, Social Media as described in the Privacy Notice. | Providing the Services, including sending transactional messages. | Performance of a contract |
| Improving the Services & analytics |
Legitimate interests; Consent (where we use Cookies for such purposes) |
|
| Facilitating safety, security, and fraud prevention | Legitimate interests | |
| Providing & improving customer support | Performance of a contract; Legitimate interests | |
| Advertising & marketing communications |
Legitimate interests; Consent (where we use Cookies for such purposes or when you sign up to receive our marketing communications) |
|
| Internal operations of the Services, monitoring & record keeping | Compliance with legal obligations; Legitimate interests | |
| Compliance with regulations or lawful requests & enforcement of our terms, policies and agreements | Compliance with legal obligations; Legitimate interests | |
| Location Information, as described in the Privacy Notice. | Providing the Services |
Performance of a contract; GPS permissions are based on your consent. |
| Personalizing the Services |
Legitimate interests; Consent (where we use Cookies) |
|
| Targeted advertising | Consent | |
| Improving the Services & analytics |
Legitimate interests; Consent (where we use Cookies) |
|
| Facilitating safety, security, and fraud prevention | Legitimate interests | |
| Providing & improving customer support | Performance of a contract; Legitimate interests | |
| Internal operations of the Services, monitoring & record keeping | Compliance with legal obligations; Legitimate interests | |
| Compliance with regulations or lawful requests & enforcement of our terms, policies and agreements | Compliance with legal obligations; Legitimate interests | |
|
Device Information, Online Identifiers and Usage Information as described in the Privacy Notice. This information may be collected and stored by us, or by our third-party service providers and business partners, using cookies, related technologies, and third-party analytics tools. Certain cookies are processed only with your consent. Please see our Cookie Notice for details about how you can provide or withdraw consent to such processing. |
Providing the Services | Performance of a contract |
| Personalizing the Services |
Legitimate interests; Consent (where we use Cookies) |
|
| Targeted advertising | Consent | |
| Improving the Services & analytics |
Legitimate interests; Consent (where we use Cookies) |
|
| Facilitating safety, security, and fraud prevention | Legitimate interests | |
| Internal operations of the Services, monitoring & record keeping | Compliance with legal obligations; Legitimate interests | |
| Compliance with regulations or lawful requests & enforcement of our terms, policies and agreements | Compliance with legal obligations; Legitimate interests | |
| Survey and Rewards Program Information, as defined in the Privacy Notice. | Personalizing the Services | Legitimate interests |
| Enabling you to participate in a surveys, quizzes, contests, interviews, rewards programs or promotions | Consent | |
| Improving the Services & analytics | Legitimate interests | |
| Internal operations of the Services, monitoring & record keeping | Compliance with legal obligations; Legitimate interest | |
| Facilitating safety, security, and fraud prevention | Legitimate interests | |
| Inferences as defined in the Privacy Notice. | Personalizing the Services | Legitimate interests |
We retain your Personal Data for as long as necessary for the purposes and legal bases set out in the Privacy Notice.
Your rights with respect to your personal data are set forth in the "Your Rights" section of our main Privacy Notice and are subject to certain limitations under applicable laws.
We may revise this GDPR Notice from time to time. When we make changes to this GDPR Notice, we will change the applicable "Last Updated" date. If we make material changes, we will notify you including through a pop-up notification on our apps, websites, or by other means, including email or a prominently posted notice at the beginning of this GDPR Notice. All changes shall be effective from the date of publication unless otherwise provided in the notification and subject to applicable laws. Please review this GDPR Notice from time to time to check whether we have made any changes.