Privacy policy

Introduction

Your privacy is important to us. City Tales Limited is committed to safeguarding your data in line with the latest data protection and privacy laws.

The data we collect depends on the context of your interactions with us. Unless otherwise defined below, "You" and "Your" means anyone that has visited the City Lates website, signed up for marketing communications or purchased a product provided by City Tales.

What does this privacy policy cover?

It covers the collection, use and disclosure of data, including personal data, from or about you in connection with your use or access of our marketing website: https://www.thecitytales.com or any of our products.

Data collection

Your personal data may be collected on our marketing website. Personal data is defined as any information relating to an identifiable person

We may collect data about you in the following situations:

• Fill in a form or survey for us
• Subscribe to our mailing lists
• Participate in a competition or promotion or marketing activity
• Contact us, for example by email, post, telephone or social media
• Purchase one or more of our products

Through our marketing website, we may collect personal data that you voluntarily provide, such as your title, first and last name, address, email address, phone number, browser type and verision, device IDs or other unique identifiers, the referring webpage and viewing history. To collect this information, we may use cookies, web beacons, pixels and other automatic information gathering technologies.

We may collect data about you from trusted third parties providing us with services and purchased data for marketing purposes, or public sources. These sources may change over time, but could include: service providers that help us determine a location based on your IP address in order to customise our service and for other uses consistent with this privacy policy; security service providers who provide us with data tp secure our systems, prevent fraud and help us protect the security of our users; online and offline data providers, from which we obtain aggregated demographic, interest based and online advertising related data; and publicly available sources such as posts on social media platforms and information available through public databases.

We may also collect, use, and share data such as statistical or demographic data for any purpose. This may be derived from your personal data, but it is still not considered ersonal data in law, as this data does not directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we will treat this combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any special categories of personal data (as defined in the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 (known as the “UK GDPR”)). This includes details about your race, or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, data about your health or genetic and biometric data. Nor do we collect any data about criminal convictions and offences.

The provision of personal data is not mandatory. However, you will not be able to access and use the products and communicate with City Tales Limited without disclosing some personal data to City Tales.

Use of data

We use your personal data for certain legitimate business purposes, which include some or all, of the following:

• Contacting you and sending you communications that we think will be of interest to you
• Providing you with the information you request through our product or marketing website
• Improving our product or marketing website
• Remembering the data you have previously given us to enhance or customise your experience on our product or website
• Personalising the advertising and content you see
• Conducting research and providing statistical reporting to understand how individuals interact with our product or marketing website
• Conducting voluntary user surveys or focus groups
• Determine the effectiveness of promotional campaigns and advertising
• Notify you about changes to our products and services
• Respond to requests where we have a legal or regulatory obligation to do so
• Assess the quality or type of care you have received and any concerns you may raise, so that these can be properly investigated
• Ensure that content is presented in the most effective manner for you and for your computing device
• Enable us to carry out our obligations to you in connection with the products and services we provide

Disclosure of data

We do not disclose personal data about you to third parties except under the following circumstances and for the following purposes:

• When we have your permission to provide you with services you requested and to carry out your instructions
• We may share your data internally with our affiliates, as needed for but not limited to: data processing and storage; providing you with access to our services; providing support services; making decisions about service improvements; content development.
• When required by law to respond to subpoenas, court orders, or legal process by public authorities, including disclosures required by national security or law enforcement agencies
• When we need to establish or exercise our legal rights, or to defend against legal claims, or when we believe it is necessary to share information in order to investigate, prevent, or take action regarding illegal activities, data breaches, suspected fraud, situations involving potential threats to the physical safety of any person, violations of our agreement, or as otherwise required by law
• We may transfer your Personal Data if City Tales is acquired by or merged with another company, to ensure the continuity of our business and services. In such event, City Tales will make public announcement before data about you becomes subject to a different privacy policy
• We may share your personal data with third party IT system support and hosting service providers that we engage to support our business, our products or marketing website
• Third party debt collectors for the purposes of debt collection
• With our marketing partners

Where a third-party data processor is used, we make sure that they operate under contractual restrictions with regard to confidentiality and security, in addition to their obligations under data protection laws. We do not allow third parties to use your personal data for their own purposes.

Our marketing website may include links to third-party websites, plug-ins and applications. We do not control these third-party websites and are not responsible for the privacy and security practices of any third-party websites, which are governed by their own practices.

Data transfers

We may also share personal data with third-party processors who process personal data outside of the UK/European Economic Area on our behalf. We transfer this personal data only where necessary and only where appropriate security measures and controls are in place to protect your personal data in accordance with applicable data protection laws. This means these transfers will take place on the basis of an approved data transfer mechanism, such as UK/EU Standard Contractual Clauses or UK/EU Commission Decisions on Adequacy. Regardless of location, Digital City Tales takes care to ensure that our affiliates, employees, agents, and processors in other countries act in a manner consistent with this privacy policy.

Data security

We use reasonable administrative, logical, physical and managerial measures to safeguard your personal data against loss, theft and unauthorised access, use and modification. All personal data will be stored on our secure servers that have limited access and are in controlled facilities. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a legitimate business reason to have such access and who have undergone a Disclosure and Barring Service (“DBS”) check. We will never send you unsolicited emails or contact you by phone requesting your account ID, password, credit or debit card information or national identification numbers.

To learn more about security, including the security measures we have taken and steps you can take to enhance the security of your information when using our products and marketing website, please contact us using the details set out in the “Contacting us” section of this privacy policy.

Data retention

We may retain your data for as long as you use our services and we reasonably need to use it, having regard to the purpose for which it was collected, and in accordance with all applicable data protection laws. We take reasonable measures to destroy or de-identify personal data in a secure manner when it is no longer required.

Your rights

We are a UK based company supplying products to UK based customers. This means you have rights under UK GDPR. By purchasing our products, visiting our marketing website or communicating with us you acknowledge that we may process your personal data for the purposes described above, either on the basis of your consent or if we have other lawful grounds to do so. Under the GDPR or the UK GDPR, you have the below additional rights in respect of your personal data:

• Withdraw consent to processing, where consent is the basis for processing (withdrawing your consent will not affect the lawfulness of any processing conducted prior to your withdrawal, nor affect processing of Personal Data conducted on reliance on lawful processing grounds other than consent). This includes your right to withdraw consent to us using your Personal Data for marketing purposes.
• Complain to a data protection supervisory authority in your country if you believe that we are processing your Personal Data in violation of applicable laws.
• Access your personal data that we hold and request further details about how it's processed.
• Demand rectification of inaccurate personal data about you.
• Object to the unlawful processing of your personal data, including processing for direct marketing.
• Erasure of past data about you (your “right to be forgotten”).
• Restrict processing of your personal data if you believe we have exceeded the legitimate basis for processing, processing is no longer necessary, or if you believe your personal data is inaccurate.
• Right to data portability of personal data that you provided us in a structured, commonly used, and machine-readable format.
• Right in relation to automated decisions you have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you, unless it is necessary for entering into an agreement with you, it is authorised by law or you have given your explicit consent. We will let you know when such decisions are made, the lawful grounds we rely on and the rights you have.

To learn more about your rights under the UK GDPR, you can visit the Information Commissioner’s Office page: https://ico.org.uk/your-data-matters.

If you want to exercise any of the rights described above, please contact us using the contact details in the “Contacting us” section of this privacy policy. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive, or we may refuse to comply with your request in these circumstances.

Opting out of marketing communications

You may opt out of receiving marketing communications from us by contacting us at any time using the details in the “Contacting us” section of this privacy policy. Please note that you cannot opt out from receiving all communications from us, including administrative messages, service announcements, and messages regarding the terms and conditions of your products because they may contain important information.

Changes to our privacy policy

City Tales may update this privacy policy at any time. We encourage you to review this Privacy Policy regularly to make sure you are familiar with our most updated policies and practices. When we make material changes, such as a change to the purposes of processing of personal data that is not consistent with the purpose for which it was originally collected, we will notify you by email. Your continued use of our marketing website and other products and services following the publication or notification of any changes will constitute acknowledgement and acceptance of those changes. This privacy policy was last reviewed and updated on 16th September 2025.

Contacting us

If you have any questions about this privacy policy, including any requests to exercise your legal rights, all correspondence should be directed to City Tales's data protection officer by email at [email protected].

Please note that if you contact us to assist you, we may need to request specific information from you to ensure that personal data is not disclosed to any person who has no right to receive it.

We try to respond to all legitimate requests within one month. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Complaints

You have a right to make a complaint to a supervisory authority at any time. In the UK, this is the Information Commissioner’s Office: https://www.ico.org.uk. We would, however, appreciate the opportunity to deal with your concerns before you approach the International Commissioner's Office, so please, if you feel comfortable doing so, contact us at: [email protected].