Privacy Policy
1. Who we are
The Jersey Bus Tours Companion app is operated by Jersey Vintage Tours Limited, trading as Jersey Bus Tours, a company registered in Jersey, Channel Islands. Our principal place of business is 19 Esplanade, St Helier, Jersey JE2 3QA. Our website is jerseybustours.com.
We are the data controller for the personal information described in this policy. For privacy questions, data-subject requests, or any concerns about how we use your data, write to info@jerseybustours.com. We respond within 30 calendar days.
2. What this policy covers
This policy applies to the Jersey Bus Tours Companion mobile app on iOS and Android, and the related help pages on jerseybustours.com. Bookings made through our website are covered by our separate website privacy notice and by TicketingHub's privacy policy.
3. What we collect, why, and our lawful basis
| Data | Why | Lawful basis | Where stored |
|---|---|---|---|
Booking reference (e.g. BK-3MV0) and the email address you booked with |
To verify your booking so we can unlock the tour content you've paid for | Contract (Article 6(1)(b) UK/EU GDPR; equivalent under Jersey Law) | Your device (AsyncStorage) + Firebase Firestore in the EU |
| A randomly-generated device identifier | To enforce the 4-device cap on a single booking, so a reference can't be shared more widely than your travel party | Legitimate interests (Article 6(1)(f)) — preventing booking-fraud and protecting paying customers | Firebase Firestore in the EU, tied to your booking record |
| Your phone's GPS location while a tour is active | To trigger the right point-of-interest information when the bus passes a landmark | Contract — the GPS-triggered tour is the service you bought | Processed on your device only — never transmitted to our servers, never stored anywhere except in your phone's memory during the tour |
| Your selected tour, language, favourites, and tour progress | To remember what you like and where you are in your tour | Contract | Your device (AsyncStorage) — never transmitted |
| Crash and error logs (error message, stack trace, screen, app version, device model, OS version, and where applicable, the related booking reference and tour ID) | To diagnose and fix bugs so the app works for the next customer | Legitimate interests — keeping the service safe and reliable | Firebase Firestore in the EU, retained for 90 days |
| Optional feedback comments you choose to send through the in-app feedback form | To improve the app and the tours | Consent — you choose whether to send | Sent as an email to info@jerseybustours.com; retained in our inbox per our normal retention |
4. What we do not collect
- We don't ask for your contacts, photos, microphone, calendar, or files. The Android manifest and iOS Info.plist declare only the permissions we actually use (location).
- We don't track your location in the background. The GPS turns off the moment you close the app.
- We don't take any payment or financial information. Bookings happen on jerseybustours.com (via TicketingHub) — the app only verifies your reference.
- We don't run advertising and we don't sell, rent, or share your data with marketers, brokers, or any third party for their own purposes.
- There is no user account beyond your booking-reference unlock. There is no profile, no social feed, no messaging, no friends list.
- We don't use cookies or web trackers in the mobile app. Our website (jerseybustours.com) uses minimal essential cookies described in its own notice.
5. Who processes data on our behalf (sub-processors)
To run the app we use the following service providers. Each is bound by a data-processing agreement and processes data only on our instructions.
| Provider | What it does for us | Where data is processed |
|---|---|---|
| Google Firebase (Google Ireland Limited) | Firestore database, Cloud Functions, file storage, Google Translation API for trilingual content | EU (europe-west2 / europe-west3 regions). Some operational metadata may be processed in Google data centres outside the EU under Google's EU Standard Contractual Clauses. |
| TicketingHub | Booking-reference verification (only when you unlock the app) | United Kingdom — see their privacy policy |
| Google Maps Platform | Base map tiles inside the app's tour map | Google's standard infrastructure — see privacy policy |
| Wikimedia Commons | Historic photographs for some points of interest, downloaded once and cached on your device | Public-domain / Creative-Commons imagery hosted by the Wikimedia Foundation |
6. International data transfers
Your data is stored primarily in Firebase data centres in the European Union (Ireland and Frankfurt). Some processing may occur on Google infrastructure outside the EU under European Commission-approved Standard Contractual Clauses with appropriate supplementary measures. Jersey itself is covered by an EU adequacy decision, so transfers between Jersey and the EU/EEA require no additional safeguards.
7. How long we keep your data
- Booking reference and email — for 90 days after your tour date, then auto-deleted from our systems. Your device's local copy persists until you tap Forget ticket in Settings or uninstall the app.
- Device identifiers — for the life of your booking + 90 days, so we can free up a device slot if you replace your phone.
- GPS location — never stored. Processed in your phone's memory and discarded immediately after each location update.
- Crash and error logs — 90 days, then auto-purged.
- Feedback emails — retained in our support inbox for as long as we may need to respond or to evidence a customer issue, then deleted.
8. Your rights
Under the Data Protection (Jersey) Law 2018, the UK GDPR + Data Protection Act 2018, and the EU GDPR (Regulation 2016/679), you have the right to:
- Access the personal data we hold about you
- Rectify data that is inaccurate or incomplete
- Erase your data ("right to be forgotten")
- Restrict how we process your data
- Object to processing based on legitimate interests
- Portability — receive a copy of your data in a structured, machine-readable format
- Withdraw consent at any time for any processing based on consent
To exercise any of these rights, email info@jerseybustours.com. We may ask for proof of identity before fulfilling a request. We respond within 30 calendar days; complex requests may be extended by up to 60 further days with notice.
The fastest way to delete the data stored on your phone is to tap Settings → Your ticket → Forget ticket in the app. To delete the data stored on our servers, email the address above.
9. Right to complain
If you believe we have mishandled your data, you can complain to the relevant supervisory authority. We hope you'll write to us first so we can put it right, but you don't have to.
- Jersey: Office of the Information Commissioner (Jersey) — oic.je
- United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
- European Union: the data protection authority in your country of residence — the full list is at edpb.europa.eu
10. Children
The app is suitable for general audiences. We do not knowingly collect personal data from children under 13. The app is not designed for use by children unaccompanied by a paying adult. If you believe a child has provided us with personal data, contact info@jerseybustours.com and we will delete it.
11. Security
All data transmitted between the app and our servers is encrypted using TLS 1.2 or higher. Firebase storage is encrypted at rest by Google. Access to our administrative dashboard is restricted to authorised staff and protected by strong passwords and two-factor authentication. We review our security practices regularly and will notify the supervisory authority within 72 hours of becoming aware of a personal data breach likely to affect your rights.
12. Automated decision-making
We do not make any automated decisions that produce legal effects on you or significantly affect you. The 4-device cap is a simple count, not a profile or assessment.
13. Changes to this policy
We revise this policy as the app evolves. The Last updated date at the top reflects the most recent change. We'll surface material changes inside the app on next launch so you don't miss them, and we'll keep prior versions on request.
14. Contact
Jersey Vintage Tours Limited (trading as Jersey Bus Tours)
19 Esplanade, St Helier, Jersey JE2 3QA
info@jerseybustours.com
jerseybustours.com