Privacy Policy

Effective Date: May 15, 2018

Your Privacy Matters

ByteToken’s mission is to help make transit ticketing and payment app solutions available and accessible to all users of public transport. Central to this mission is our commitment to be transparent about the data we collect about you, how it is used and with whom it is shared.

This Privacy Policy describes which personal data about you ByteToken Ltd. (“ByteToken” or “we”) collects and processes when you set up an account with ByteToken and / or use a ByteToken branded app (“App”). The App is operated by us on behalf of a client issuing the tickets purchased through the App (“Client” ).

Personal data processed

In this section we inform you which categories of personal data (“Data”) we process, for which purpose we process Data of each category and who we may share Data of different categories with. 

Account Data

In order to set up an account with us (“ByteToken Account”), we will collect your first and last name and email address and, if you choose to provide it, your phone details (together “Account Data”).
We will process your Account Data to verify your identity, to maintain and manage your ByteToken Account, to respond to your requests and to notify you if you complete a transaction with our App.

Payment Data

In order to be able to purchase tickets, you may have to provide your credit card information (“Payment Data”).

Your Payment Data will be processed for receiving and managing payments made by you via the App.

Payment Data will be shared with a payment service provider  to carry out the transfer of funds from your bankaccount to ByteToken’s bank account.

Transaction Data (including location data)

Transaction Data is processed in order to provide you with our services (e.g. to issue an electronic ticket to you via the App or to process a refund).

Transaction Data will be shared with the Client to enable him, for example, to provide customer services, for audit and for financial reconciliation purposes. Client will be solely responsible for its own processing of Transaction Data regarding you.

Further information automatically collected via the App

We may process technical information, usage data and device identifiers, such as your IP-address for the following purposes:


Further information regarding the transfer and use of your Data

We will also process Data as reasonably necessary to enforce the applicable terms of use, to establish or preserve a legal claim or defence, to prevent fraud or other illegal activities, including attacks on our information technology systems.

We may transfer your Data to courts, arbitration bodies, law enforcement authorities, regulators or attorneys if necessary to comply with the law or for the establishment, exercise or defence of rights or legal claims.

Your Data will be made available to third parties who perform services on our behalf; in particular vendors who help us operate our apps and our backend infrastructure. Such third parties will process your Data only for the purpose of such services and in accordance with Byte Token’s instructions  (e.g., hosting or IT maintenance and support services).

Sometimes the recipients to whom we transfer your Data are located in countries in which applicable laws do not offer the same level of data protection as the laws of your home country. In such cases, ByteToken takes measures to implement appropriate safeguards for the protection of your personal data.

 In particular, we will only transfer personal data to external recipients in such countries if the recipient has (i) entered into EU Standard Contractual Clauses with ByteToken, (ii) implemented Binding Corporate Rules in its organization or (iii) – in case of US recipients – the recipient is certified under the EU-US Privacy Shield.  More details of the EU-US Privacy Shield can be found here.


Our Apps are meant for adults. We do not knowingly collect personal data from children under 16 without permission from a parent or guardian. If you are a parent or legal guardian and think your child under 16 has given us personal data, you can email us . You can also write to us at the address listed at the end of this policy. Parents, you can learn more about how to protect children’s privacy on-line here.

We use industry standard security measures

We have implemented appropriate technical and organizational measures to protect your Data. Bytemark[1] is a registered level 1 PCI Service Provider. Interaction between the back office and mobile applications are governed by PCI Level 1 certification and is reviewed by a Qualified Security Assessor annually.  No personal information—particularly payment card information—will be stored locally on the mobile applications. Tokens are used to reference payment card information. Any data that is considered personal or proprietary is encrypted with military-strength cryptography when stored or transmitted.


However, the Internet is not 100% secure. We cannot promise that your use of our App will be completely safe. We encourage you to use caution when using the Internet. This includes not sharing your passwords.

We store information in the European Union

We store all Data for our European Union customers in Dublin, Ireland.

If third parties are granted access to Data for maintenance and support services, the safeguards described above will be implemented (see section “Further information regarding the transfer and use of your Data”).

Retention Periods

Unless indicated otherwise above, we erase your Data if the retention of that personal data is no longer necessary (i) for the purposes for which they were collected or otherwise processed, or (ii) to comply with legal obligations (such as retention obligations under tax or commercial laws).

Your rights

Under applicable data protection law you may have the right to:


Feel free to contact us if you have more questions

If you have any questions about this Policy or want to correct or update your information, please email us at

You can also write to us at:

ByteToken Ltd

93 George St.



United Kingdom 


You also have the right to address any issue with the data protection authority:


The Information Commissioner’s Office

Water Lane,

Wycliffe House




Tel. +44 1625 545 745



From time to time we may change our privacy policies. We will notify you of any material changes to our Policy as required by law. We will also post an updated copy on our website.  Please check our site periodically for updates.

© 2018 ByteToken, Ltd.

ByteToken, Ltd Company Number 500947. Registered office, Excel House, 30 Semple Street, Edinburgh EH3 8BL