Version 1: 21 December 2023

Version 2: 27 January 2025

• At point 6 “With whom is the data shared?” building owners have been added as possible recipients of the data.
• At point 3.10 is explained the functionality of the new AI virtual assistant AI (chatbot) implemented for customer care purposes.

Version 3: 20 March 2025 (current)

• Updates regarding the right to lodge a complaint.

• Marketing consent now given and withdrawn in the app settings (was: given at booking, withdrawn by email unsubscribe)
• New purpose — account creation and management: account required to book, via direct registration or Google/Facebook/Apple sign-in; deletion via app settings
• New purpose — analysis of preferences: consent-based analysis of app and stay data to tailor offers
• New purpose — digital marketing: user information provided to social media platforms and search engines for ad campaigns
• New purpose — data transmission to third parties: with consent, sharing with commercial partners across ten named sectors for their own direct marketing

• UK GDPR and Data Protection Act 2018 added alongside the Swiss DSG and EU GDPR; “GDPR” defined to cover both regimes
• Controller structure set out: City Pop AG controller for platforms, apps, accounts, bookings and guest communications; local group companies act as processors, and as controllers only for their own local tax, accounting and regulatory compliance
• EU representative named: City Pop Italia Srl, Milan
• Specific GDPR article now cited for every legal basis
• Job applications: retention cut from 2 years to 4 months after rejection; hires covered by employee/contractor privacy documentation
• Transfers: EU-U.S. DPF named explicitly, UK Extension added, UK transfer rules applied, right to request a copy of the safeguards
• ICO complaint route added for UK users, with a 30-day acknowledgment commitment

Version 6: 14 October 2026

• Merger with the City Pop 2NIGHT Privacy Policy: a single policy now covers all City Pop services, both long stays and 2NIGHT short stays. The General Terms and Conditions reference now points to the long-stay or 2NIGHT terms depending on the service booked.
• Digital marketing: new section on the use of information shared with social media platforms and search engines to plan advertising campaigns. It is based on cookie consent or on the platform’s own terms, and retention follows the cookie retention periods.
• IT and network security: new purpose covering technical logs, including access logs from electronic door locks and Wi-Fi usage data. These are used to protect premises, guests and IT systems, and are kept for up to 12 months unless needed for a specific incident or legal claim.
• Direct marketing:
  • Marketing emails may contain tracking pixels and tracked links to measure opens, clicks and campaign effectiveness. This is covered by the marketing consent.
  • City Pop may periodically ask users to confirm they still want marketing communications. If there is no reply, marketing consent may be considered no longer valid.
• Telephone customer support: new section on processing data when users contact customer service by phone. Some calls may be recorded for quality and training, and callers are informed at the start of the call. Recordings are kept for up to 6 months.
• Customer support and service: phone support and the AI assistant (chatbot) are now grouped under one section.