City Pop Privacy Policy

The main reason why City Pop collects user data is to promote, organise and provide its services to guests. This page provides users and guests who use City Pop’s services – including the app of the same name and browsing the ‘website’ (www.citypop.com) – with the necessary information so that we can process users’ personal data with complete transparency.

 

1                 Who is the data controller?

The processing of personal data relating to the City Pop Service is carried out by one or more companies belonging to the City Pop Group, depending on the specific processing activity and the respective responsibilities in providing the Service.

City Pop AG, with its registered office at Bernerstrasse Süd 169, CH-8048 Zurich, Switzerland, acts as the controller for the operation of the City Pop digital platforms and Apps, user account management, booking management, communications with guests and the other processing activities necessary for the provision of the digital Service. City Pop AG determines the purposes and means of these processing activities and processes personal data in accordance with the data protection principles of Swiss legislation (‘DSG’) and the European Union General Data Protection Regulation (‘EU GDPR’) and where applicable, the United Kingdom General Data Protection Regulation (‘UK GDPR’) and the Data Protection Act 2018. Unless stated otherwise, references in this policy to the ‘GDPR’ include the EU GDPR and, where applicable, the UK GDPR.

 

The provision of accommodation and the operational management of City Pop properties are carried out through local companies of the City Pop Group established in the countries where the properties are located. These companies process personal data on behalf of City Pop AG and in accordance with its instructions, in their capacity as processors. To the extent that any local company is required by applicable law to process personal data for its own compliance purposes (for example, in connection with local tax, accounting or regulatory obligations), it may do so as a controller in its own right, but only for those limited purposes

 

The representative of City Pop AG within the EU is City Pop Italia Srl, Viale Monza 137 20125 – MILANO (MI) Rea: 2662988

Users may contact the Data Protection Officer (DPO) designated by City Pop AG at [email protected] or directly the Customer Support at [email protected] where appropriate.

 

2                 What personal data does City Pop collect?

The data controller collects personal data from users, guests and visitors when they use the City Pop app, when navigating and interacting with the websites, and when registering, booking and using City Pop services.

City Pop collects only data which it is lawfully permitted to use, which it is authorised to collect, and which is necessary for the purposes described below, and always within the limits of those purposes.

2.1                 Is the provision of data mandatory?

City Pop has organised its activities in such a way that the collection of personal data is limited in accordance with the principles of data minimisation and strict necessity. As such,, for most of the purposes described below (e.g. completing a form), failure to provide the data indicated as necessary may result in an inability to access City Pop services and/or to complete the requested transactions.

The collection of contact details does not constitute automatic consent to the carrying out of marketing activities, which are carried out in accordance with section 4.5. In particular, any consent given for the carrying out of marketing activities may be withdrawn at any time via the app’s settings. The user may also withdraw any consents given or exercise their right to object via a link in the footer of emails sent by City Pop AG.

2.2                 Where does the data come from?

We process the data that you provide to us directly. In certain cases, we may receive your personal data from third parties, such as individuals or companies making a booking on your behalf, corporate customers, booking partners or other authorised persons. Where applicable, such third parties are responsible for ensuring that they are entitled to provide your personal data to us.

 

3                 Purpose of data collection

The user’s data may be processed for the following purposes, in accordance with the purposes specified in the descriptions.

 

3.1                 Browsing data

Browsing data relating to the user’s activities whilst using the website and the app is collected and processed using specific tracking tools (e.g. pixels, cookies) for technical, statistical, functional and marketing purposes. All processing is carried out within the limits authorised by the user. Further information can be found in the Cookie Policy at the following links: https://citypop.com/cookie-policy-eu/.

Legal basis: legitimate interest for functional cookies, Article 6(1)(f) of the GDPR; otherwise, consent, Article 6(1)(a) of the GDPR.

 

3.2                 Account creation and management

To complete a booking or use the City Pop services, you must create an account on the platform or authenticate yourself using a Google, Facebook or Apple profile.

Legal basis: contract, Article 6(1)(b) of the GDPR (request to use City Pop services); consent for single sign-on, Article 6(1)(a) of the GDPR

Retention periods: The data associated with the registered account will be retained until the user requests its deletion via the ‘Delete your account’ function, which can be accessed in the app’s settings under the ‘Security’ section. Following a request to delete the account, the owner may retain some user data if this is necessary or mandatory for other purposes (e.g. retention of administrative and accounting data). We delete data from inactive accounts 5 years following the last use.

 

3.3                 Management of bookings and City Pop services

The data of registered users is processed in connection with the administration, provision and maintenance of City Pop services in accordance with the General Terms and Conditions (https://citypop.com/terms-conditions/), primarily for the purpose of carrying out front-office activities (e.g. supporting the user during their stay, providing information on check-in and check-out, responding to enquiries), back-office activities (e.g. administrative and accounting management, planning of activities), and to send communications for purely organisational and operational purposes (e.g. app updates, IT security, data protection, maintenance work on accommodation or in public areas) or to enable the use of technologies and services made available during a stay at a City Pop property.

Legal basis: Contract (General Terms and Conditions), Article 6(1 )(f) the GDPR

Retention periods: The data will be retained for these purposes for up to a maximum of 10 years after the end of use of the services. To avoid any inconvenience, guests are always asked at the end of their stay to disconnect their profiles from any interactive services (e.g. SmartTV) that may have been used during their stay at a City Pop property.

 

3.4                 Security and legal obligations

• Security management and transmission of master data to the relevant authorities

Guests’ personal data and special categories of personal data (may be processed when carrying out procedures to ensure security within the premises or for the prevention, management and documentation of criminal offences or accidents/incidents. City Pop is also obliged to collect personal data in order to comply with the legal requirements specific to the location of the City Pop premises.

Legal basis: Legal obligations, legitimate interests, Article 6(1)(c) or (f) of the GDPR

Retention periods: for the period necessary and sufficient in each individual case to document compliance with the law.

• CCTV

Images of guests and visitors recorded by the video surveillance systems installed in City Pop premises are processed to protect City Pop’s premises and property and to safeguard the physical safety of guests.

Legal basis: Legitimate interests of the controller, Article 6(1)(f) of the GDPR

Retention periods: up to 96 hours after collection, unless there are specific requirements relating to the handling of criminal offences.

 

3.5                 Marketing

• Direct marketing

Users’ contact details are used to send messages relating to reminders, promotional campaigns and suggestions via email or push notifications, which may include, for example, invitations to take part in surveys and competitions, information about events organised by City Pop, news about new services and initiatives, offers and promotional campaigns, including those relating to third-party services.

Legal basis: Consent to ‘marketing’, which may be given or withdrawn at any time via the app’s settings, Article 6(1)(a) of the GDPR

Retention periods: until consent is withdrawn.

• Preference analysis

With the user’s explicit consent, data relating to the analysis carried out via the app and during the user’s session is processed and analysed in order to identify the user’s tastes and preferences and to tailor the offers and promotions sent via direct marketing channels.

Legal basis: Consent to ‘preference analysis’, which may be given or withdrawn at any time via the app’s settings, Article 6(1)(a) of the GDPR.

Retention periods: until consent is withdrawn or two years after the last email was opened.

• Marketing communications to prospects

Users who have provided their contact details through City Pop’s websites, landing pages or other interactive services, for example by joining a waiting list, submitting a pre-booking request, requesting information or downloading information materials, may receive occasional and low-frequency communications relating to City Pop services with which the user has interacted.

Legal basis: (Depending on the applicable legislation and the circumstances in which the contact details were collected) Consent, where required by applicable law (Article 6(1)(a) GDPR); otherwise, legitimate interest of the controller in communicating with users who have expressed an interest in City Pop services (Article 6(1)(f) GDPR).

Retention period: Until withdrawal of consent or objection to marketing communications.

 

• Participation in communication projects

Participation in events, competitions or other initiatives organised by City Pop may involve the collection of images and videos of participants. Subject to the participants’ involvement and consent to these initiatives, and without prejudice to the right of interested parties to object, the multimedia material produced may be intended for publication on the internet and via social media channels.

Legal basis: Consent, Article 6(1)(a) of the GDPR, Article 6(1)(b) of the GDPR  (e.g. video interviews), contract(e.g. participation in a competition) or legitimate interest, Article 6(1)(f) of the GDPR (e.g. organised events), depending on the nature of the project.

Retention periods: until withdrawal of consent.

 

3.6                 Disclosure of data to third parties

With the user’s express consent, their personal data may be disclosed to professionals, companies or organisations with which City Pop AG has entered into commercial agreements and/or arrangements (falling within the following categories: communications and marketing; Legal, financial and insurance services; Arts and culture; Tourism; Education and training; IT/technology; Social and healthcare services; Property; Entertainment, television and film production; Healthcare and personal services), in order to enable them to carry out their direct marketing activities using automated tools.

Legal basis: Consent to ‘data sharing’, which may be given or withdrawn at any time via the app’s settings, Article 6(1)(a) of the GDPR.

Retention periods: until consent is withdrawn or two years after the last email was opened.

 

3.7                 Monitoring and reporting

Data relating to users and guests, including personal data and information on payments for services used, is collected and processed with appropriate safeguards for monitoring and reporting purposes through statistical analysis and in aggregated form. These analyses may be shared with other companies within the City Pop Group and partners (e.g. investment funds) for the purposes of monitoring City Pop services, strategic planning and the continuous improvement of City Pop services.

Legal basis: Legitimate interest of the controller (Article 6(1)(f) of the GDPR) – data that is primarily processed in aggregated form, whereby the methods and logic do not aim to identify individual persons.

Retention periods: up to 10 years after the end of use of City Pop services.

 

3.8                 Job applications and commencement of collaboration

Where an individual submits a job application or proposals for collaboration regarding a position, the data contained in the applicant’s CVs, qualifications, references and photographs will be processed for the purpose of managing the selection process.

Legal basis: Pre-contractual measures (Art. 6(1)(b) GDPR).

Retention periods: In the event of rejection, up to 4 months following notification of the rejection. Where an application leads to employment or another form of engagement, the relevant personal data will be retained and processed in accordance with the applicable employee or contractor privacy documentation.

 

3.9                 Pursuit of legal and defence purposes in court

Personal data collected for other purposes may be processed by City Pop AG in order to establish, exercise or defend a legitimate right.

Legal basis: Legitimate interest of the controller, Article 6(1)(f) of the GDPR

Retention periods: Up to a maximum of 10 years after collection or after the purpose for which it was originally collected has been fulfilled.

 

3.10            AI assistants – customer service

To enhance the user experience, City Pop provides a virtual assistant (chatbot) based on artificial intelligence on certain pages of the website or app. The chatbot offers real-time assistance regarding City Pop’s services, based on the content of the service documentation (e.g. FAQs, brochures, terms and conditions). Where necessary, it directs the user to more detailed instructions and all the necessary contact information. Although the system is configured to provide accurate and useful answers, the responses given may occasionally be incomplete, inaccurate or out of date. Users are advised to check the information in the linked official sources and to interpret and respond to the chatbot’s answers with caution and care. The service does not require authentication, and conversation data is not used to train the artificial intelligence model. Conversations may be recorded and reviewed by our team in order to improve the quality of the answers provided and to identify and rectify any shortcomings in the service’s functionality.

Legal basis: Legitimate interest of the data controller (Article 6(1)(f) of the GDPR) – users are free to use alternative support channels at any time. In particular, users may at any time open a support ticket in the relevant section of the app or contact customer service at [email protected].

The use of the chatbot does not result in any automated decisions with legal effect or significant impact on users within the meaning of Article 22 of the GDPR. The chatbot functions exclusively as a support tool and, in the event of unresolved enquiries, the matter is transferred to the human support team.

Retention periods: Conversations are retained for a maximum period of 12 months for the purposes of quality and security monitoring of the service. Upon expiry of this period, the data is anonymised or deleted.

 

4                 How is the data processed?

All data collected for the purposes set out above is processed using computerised and electronic systems, media and infrastructure, with due regard to appropriate and secure tools that enable organisation closely linked to the aforementioned processing purposes. The operations carried out by City Pop may involve the use of automated processes, always within the limits and exclusively in relation to the purposes described above (in particular for administrative procedures, the implementation of marketing activities and the provision of the services set out in the General Terms and Conditions). Data subjects always retain the right to request the assistance and intervention of competent staff – provided, in all cases, that strict confidentiality obligations are observed and that such staff have received appropriate training in this regard.

 

5                 Where is the data processed and stored?

The data is stored and processed at the physical business premises and within the IT infrastructures of the data controller or its authorised suppliers in Switzerland, within the EU and in the USA (in relation to entities that have joined the ‘EU-U.S. Data Privacy Framework’ and, where applicable for transfers from the United Kingdom, the UK Extension to the EU-U.S. Data Privacy Framework) within the scope of their respective authorisations and in compliance with the restrictions on data processors set out in Article 28 of the GDPR. Where personal data is subject to the UK GDPR, any transfers outside the United Kingdom are carried out in accordance with the applicable UK rules on international transfers and only through secure and lawful transfer mechanisms. Further information on the relevant transfer safeguards, and a copy of them where applicable, may be requested by contacting City Pop AG using the contact details set out in this policy.

Subject to specific initiatives based on the user’s consent (e.g. participation in a competition, participation in communication projects involving multimedia material and personal images of the guest, etc.), no measures are envisaged for the dissemination or disclosure of information.

 

6                 With whom is the data shared?

City Pop AG may share your data with external parties, limited to:

• Professionals, organisations and companies that provide services to support City Pop’s activities (e.g. data centres, IT platforms, messaging and mailing systems, consultancy firms specialising in computer security or the maintenance of hardware and software, service providers closely linked to your stay at City Pop – e.g. laundry services, cleaning companies, maintenance), in their capacity as data processors in accordance with Article 28 of the GDPR;
• other companies within the group, exclusively for organisational and/or administrative purposes;
• the owners of the property where a Pop booking is made, so that they can fulfil their legal obligations, including registering guests with the relevant authorities and complying with tax and safety regulations;
• payment service providers, who may receive information about the credit cards and payment systems used, processing the data as independent data controllers and in accordance with the relevant information.

As part of its marketing communications, City Pop may share links to third-party websites. These websites are not controlled by City Pop and may be subject to privacy policies other than those described in this City Pop policy. Further information on the privacy policies of these third parties can be found in their respective privacy policies.

In certain cases, City Pop is also obliged to share guests’ data with public authorities for security purposes and in accordance with legal requirements (e.g. the local authority in which the City Pop venue is located), and has limited information and access to the security and data processing methods employed by these third parties.

 

7                 Your rights regarding data protection

Data protection regulations grant users specific rights that enable them to control their personal data. City Pop is also committed to assisting users in exercising their rights. City Pop’s customer support team is the point of contact for all enquiries regarding the processing of personal data. City Pop must verify the user’s identity in order to assist them in exercising their rights. Users’ rights include:

• the right to access the personal data in question;
• the right to rectification;
• the right to erasure or to restriction of processing;
• the right to data portability;
• the right to withdraw consent;
• the right to lodge a complaint with the relevant data protection authority. You may contact your local supervisory authority at any time. However, we recommend that you contact us first so that we can assist you directly. If you are in the United Kingdom and you are not satisfied with our processing of your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (or any successor organisation). You can report your concerns by telephoning their helpline on 0303 123 1113 or through their website here: Make a complaint about how an organisation has used your personal information | ICO. However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand. The ICO will expect you to have done this before reviewing your complaint. You can contact us about your complaint by emailing us using the details at the top of this page. We will acknowledge your complaint within 30 calendar days of receipt. We will respond to your complaint without undue delay and aim to resolve all issues promptly
• You have the right at any time on grounds relating to your particular situation to object to the processing of your personal data carried out on the basis of Article 6(1)(f) GDPR . We will process then no longer the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves to establish, exercise or defend legal claims.

Where personal data is processed for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data concerning them for the purposes of such marketing.

 

Below are some tips on protecting your personal data:

• When creating a City Pop account, set a strong and secure password that is used exclusively for this account and must not be shared with others. If you suspect that someone else knows your password, ensure that you change it immediately.
• If you receive a suspicious email and are unsure whether it is from City Pop – for example, regarding your booking number or stay – you are asked to notify City Pop immediately. It is recommended that you do not reply to the email and do not provide any personal data.
• Communications from City Pop regarding special offers or events are always sent via official channels (email, mobile app notifications, social media), and these emails will never ask for users’ personal details.
• If you have any doubts about a message, a social media post or a notification you have received, you can check its authenticity on the City Pop website or send an email to City Pop customer support.

 

 

8                 Updates to the Privacy Policy

To ensure that the information is always accurate and up to date, City Pop AG may update this policy from time to time to reflect changes in data processing practices or applicable requirements. The most recent version will be made available on the City Pop website or mobile app and will take effect from the date of publication. Where changes are minor or administrative in nature, publication of the updated policy will be sufficient. Where changes are material, City Pop will take appropriate steps to bring those changes to users’ attention.

This policy was updated on 21 August 2026. You can track all significant updates to our data processing policies on this page: [https://www.citypop.com/privacy-policy-update].