The New York Pass® Privacy Notice 

Go City Group encompasses trading entities of Go City Inc (Inc. in Delaware 3673057), Go City North America, LLC (Inc. in Delaware 6146717) and Go City Limited (Inc. in England and Wales 03497724). This privacy notice gives you information on how we, at Go City, collect and process your personal data through your use of this website and our supporting applications, if you contact us regarding our products and services, and within any of our products or services.  

This privacy notice applies to: 

• Visitors to our Website and users of our supporting application.  

• Users of our products. 

• Business partners and suppliers, specifically regarding the personal data of individuals serving as points of contact. 

• Individuals with whom we interact with and process their personal data. 

We have appointed a Data Protection Officer (DPO) who is responsible for monitoring and providing guidance with our data protection compliance. If you have any questions about this privacy notice, including any request to exercise your legal rights, please contact the DPO using the contact information in section “additional information” of this notice.  

Who is the controller for the personal data processed? 

A “controller” is a person or organisation who determines the purposes for which, and the manner in which, any personal data is processed. This notice is issued by Go City as data controller.  

The personal data we collect about you: 

Personal data includes any information relating to an identified or identifiable natural person. It does not include data that cannot be linked to an individual. 

We collect, use, store and transfer different kinds of personal data about you. We have grouped that data in the following categories: 

Identity data: Your first name, middle names, maiden name, last name, date of birth.  

Contact data: Private and/or commercial contact details including first name, postal and home address, telephone number, e-mail address and similar contact information. 

Professional activities data: Including the company, the nature of the activity, the nature of the goods/services used.  

Financial data: Bank account details. 

Purchase history data: Including information about your travel destinations and people you are traveling with.   

Marketing and Communications Data: Including information on when you receive and read marketing communications from us and marketing and communication preferences. 

Device data: Information about your computer e.g. operating system, storage capacity, region, language, time zone, model number, commissioning date, age and manufacturing date of the device, browser version, computer manufacturer, connection port, guarantee status, unique device identifiers, advert identifiers and various other technical information. 

Website activity data: Information about your visits and activity on our website, including the displayed content (and advertisements), with which you have interacted, the address of the website through which you have arrived at our site and other click sequences (e.g. pages visited, links you have clicked on or items added to the shopping basket). This information is, in part, collected using automatic data collection tools such as Cookies, web beacons and integrated weblinks. For further information please see the Cookie Notice. 

How we use your data 

 We collect your personal data for one or more of the following purposes: 

• To manage communications between you and us, including queries, transactional communications and notifications. 

• To manage, collect and analyse reviews and feedback following the purchase of our products. 

• Where we need to perform the contract we have entered into with you, including delivering our products and receiving payments. 

• To let you reserve, redeem and get into the attractions and experiences included in your pass, including through the ticketing and reservation partners that connect our systems to attractions ("connectivity partners") 

• To provide support to our customers. 

• To provide you with information you have requested or which we may feel may be of interest to you. 

• Administer and maintain our website, services and our IT systems. 

• If you use our app, we will use your information to verify your identity and providing access to your pass. 

• For marketing and advertising purposes. 

• Payment processing of contractors' invoices. 

• Storing payments history data.  

• Improve and develop our products by analysing how they are used and interacted with.  

• Manage our use of tracking technologies such as cookies and analyse collected data to learn about our website and services. 

• Comply with legal and regulatory requirements.  

How we collect your personal data 

We use different methods to collect personal data from and about you, including through the channels set out below.  

Direct interactions: One way of collecting your data is by receiving the data that you provide to us from time to time through our electronic portals, systems and platforms, when you contact us by email, or when you call us.  

Automated interactions: Other data will automatically be collected by our IT systems when you visit our website. This is mainly technical data (e.g. information about internet browser, operating system or time of calling up the website). Please see our Cookie Notice for further details. 

Lawful basis of processing information 

We only collect and use personal information about you when the law allows us to. Most commonly, we use your personal data in the following circumstances: 

Performance of a contract: where we need to perform a contract which we are about to enter into or have entered into with you as a party or to take steps at your request before entering into such a contract. 

Consent: where you have given consent to processing your personal data. 

Legitimate interest: where necessary for our interests (or those of a third party), provided that your fundamental rights do not override such interests. For instance, monitoring your use of our website or preventing fraud. Where legitimate interest is identified as a lawful basis, we will undertake a legitimate interest assessment to consider and balance any potential impacts on your interests, rights and freedoms.  

Legal obligation: where we need to comply with a legal or regulatory obligation that we are subject to. 

Your individual rights 

In this section, we have summarised the rights that you have under General Data Protection Regulation (GDPR). Some of the rights are complex, and not all the details have been included in our summary. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.  

Your rights under the General Data Protection Regulation (GDPR) are: 

The right to object: You have the right to ask us to stop processing your personal data if: 

• Processing relies on legitimate interest. 

• Processing is for scientific or historical research. 

• Processing includes automated decision making and profiling. 

• Processing is for direct marketing purposes. 

The right of access: You have a right to obtain confirmation of whether we are processing your personal data, access to your personal data and information regarding how your personal data is being used by us, and: 

• You or any third party acting on your behalf may request a copy of the personal data we hold about you without charge.  

• We will ask to verify your identity or request evidence from the third party that they are acting on your behalf before releasing any personal data we hold about you.  

The right to be informed: We are required, to provide clear and transparent information to you about how we process your personal data. This privacy notice addresses this right.  

The right of rectification: If you believe the personal data we hold about you is incorrect or incomplete you have the right to have this corrected and you may exercise this right along with the right to restrict processing until these corrections are made.  

The right to erasure: If there is no legal basis or legitimate reason for processing your personal data, you may request that we erase it. If we erase your data, we will also tell the partners we have shared it with and require those acting for us to delete it, unless this is impossible or would involve disproportionate effort. 

The right to restrict processing: You have a right to block the processing of your personal data in certain circumstances This means we will still hold your data but not process it. This is a conditional right which may only be exercised when: 

• Processing is unlawful and you oppose erasure and request restriction instead.  

• We no longer need the personal data, but it is required for a legal process. 

• You have exercised your right to object to processing and require processing to be halted while a decision on the request to object is made.  

• You are disputing the accuracy of personal data. 

The right to data portability: You can request that your personal data is transferred to another controller or processor in a machine-readable format if: 

• Processing is based on consent. 

• Processing is necessary for the fulfilment of a contractual obligation. 

• Processing is by automated means (i.e. not paper based). 

Consent 

Where you have given explicit consent for processing of your personal data, you have the right to withdraw this consent at any time, but this will not affect the lawfulness of processing based on consent before its withdrawal. 

How long we keep personal data for  

We ensure that your personal data is only retained for the period that we need it for, or in accordance with laws, regulations and professional obligations that we are subject to. All personal data collected has a defined retention period, which is in line with our retention policy. If you would like to find out how long your information is being retained, please see "additional information" section of this notice.  

Security of personal information  

We take the responsibility for protecting your privacy very seriously and we will ensure your data is secured in accordance with our obligations under the Data Protection laws. We have in place technical and organisational measures to ensure personal information is secured and to prevent your personal data from being accessed in an unauthorised way, altered or disclosed.  We have in place a robust access control policy which limits access to your personal data to those employees, contractors and other third parties who only have a business need to know. The processing of your personal data will only take place subject to our instruction. 

We have policies and procedures to handle any potential data security breaches and data subjects; third parties and any applicable regulators will be notified where we are legally required to do so.  

Children's information 

Our website and app are intended for adults. Children cannot buy passes or create an account; a parent, guardian or other adult must do this for them. When you buy a child pass, we collect only the information needed for that pass [e.g. the child's name and age category] to issue the pass, allow entry to attractions and provide customer support.  We do not use children's information for marketing or profiling. By providing a child's details, you confirm that you are their parent or guardian, or have their parent's or guardian's permission. If you believe a child has given us their personal information directly, please contact us at [email protected] and we will delete it where appropriate. 

If you fail to provide personal data to us 

If we are legally required to collect personal data or need it to fulfil a contract with you, and you do not provide this personal data when requested, we may be unable to perform the contract we have with you or are trying to enter into. In such cases, we may need to decline to provide or receive the relevant products or services, but we will inform you of this at the time of data collection. 

Automated decision making 

Your personal data is not used in any automated decision making (a decision made solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain conditions about an individual). 

When you use or interact with features on the Go City platform, such as chatbots or digital assistants, these tools may be powered by artificial intelligence, and your data may be processed using automated methods. If an automated decision is made that has legal implications or a similarly significant effect, you have the right to request a review of that decision by a team member. 

Disclosures of your personal data 

We may have to share your personal data with the entities set out below for the purposes described in this Privacy Notice. 

• With service providers to carry out certain aspects of our business operations, such as cloud providers and email delivery suppliers. Our service providers have a contractual obligation to store all the personal data we receive in a secure manner. They must only use personal data for carrying out the services for which they have been contracted by Go City.  

• Certain personal data may be disclosed to other suppliers who also help us run our business but act as controllers. These suppliers process personal data in accordance with their own privacy notices. These suppliers include financial institutions, payment solutions providers and others. 

• With law enforcement agencies or public authorities, where we are subject to a legal obligation to share or disclose your personal data. 

• Attractions and connectivity partners. When you use your pass, reserve a time or redeem a ticket, we share only the details needed to check your pass and complete your booking. That means your order number, pass details and email address, and your name and phone number only where an attraction needs them to confirm a booking. Partners acting on our behalf are bound by written contracts. These allow them to use your data only to provide that service, require them to keep it secure and limit how long they keep it, and require them to delete it when we ask, including when you ask us to erase your data. [Where an attraction uses your data for its own purposes, it does so under its own privacy notice.] 

• With group entities. 

Transfers outside of the EEA and UK 

We may share personal information to third parties outside of the European Economic Area (EEA) and United Kingdom (UK). Any personal information transferred will only be processed on our instruction and we ensure that information security at the highest standard would be used to protect any personal information as required by the Data Protection laws.  

Where personal data is transferred outside of the EEA or UK to a country without an adequacy decision, we will ensure appropriate safeguards are in place prior to the transfer. These could include: 

• International Data Transfer Agreement, or EU Standard Contractual Clauses + UK Addendum 

• Binding Corporate Rules 

• Reliance on the EU-US Data Privacy Framework and the UK Extension  

• An exception as defined in Article 49 of the EU GDPR 

Right to complaint  

If you think that our collection or use of personal information is unfair, misleading, or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance. 

Alternatively, you can contact us: 

To make a complaint, please contact us via email on [email protected]  

Pursuant to the Data (Use and Access) Act 2025 (DUAA), we will acknowledge your complaint within 30 days and provide a response without undue delay in all likelihood within 30 days. 

Alternatively, you can make a complaint to the Information Commissioner’s Office: 

By Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

By Website: click here  

By Phone: 0303 123 1113 (Local rate) or 01625 545 745 (National rate)  

Links to third party websites 

This privacy notice does not apply to applications, products, services, websites or social media functions of third-party providers which are accessible via links which we offer for information reasons in our website. When using these links, you leave the website of Go City, so it is possible that information about you may be collected or passed on by third parties. Go City has no influence whatsoever on the websites of third parties and makes no recommendations or assurances regarding these websites or their data protection practices. We encourage you to read and review the privacy notices of all websites with which you may interact before allowing them to collect, process and use your personal information. 

Additional information 

Your trust is important to us. That is why we are always available to answer any questions concerning how your data is processed. If you have any questions that could not be answered by this privacy notice or if you wish to receive more in-depth information about any topic within it, please contact us via email on [email protected]  

Policy review and amendments 

We keep this privacy notice under regular review. This notice was last updated on 29/09/2026 

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. we may also notify you in other ways from time to time about the processing of your personal information. 

Region and state-specific terms 

Depending on your region we may have to offer some additional information. Please find below any additional provisions applicable to you: 

California Residents 

Scope. This section applies only to California residents. It describes how we collect, use, and share Personal Information of California residents in our capacity as a “business” under the California Consumer Privacy Act (“CCPA”) and your rights with respect to that Personal Information.  

Categories of Personal Information 

You can find the types of personal information we collect about you in the section " The personal data we collect about you" of our Privacy Notice, but since California regulations have specific terms, please find below the correct applicable terms: 

• Identifiers (e.g. unique personal identifiers) 

• Any categories of personal information described in subdivision (e) of Section 1798.80. (e.g name, address, telephone number, bank account number, etc.) 

• Commercial information (e.g. transaction information purchase history and related financial details to an order).  

• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding the interaction with the website, applications, or advertisements (e.g. email conversations). 

• Geolocation data (e.g. your location). 

Your CCPA Rights and Choices 

As applicable, the CCPA provides you (as a CA Resident) with specific rights as to your personal information; these rights are subject to verification and any applicable exceptions. This section helps describes those rights and explains how to exercise those rights.  

Right to Know: You have the right to request that we disclose certain information to you about our collection, use and sharing of your personal information over the past 12 months, as described below: 

• The categories of personal information we collected 

• The categories of sources for the personal information we collected 

• The business purpose for collecting that personal information. 

• The categories of third parties with whom we share that personal information. 

• The categories of personal information for each category or recipient obtained. 

• The specific pieces of personal information collected. 

Right to Correct: You have the right to request that we correct inaccurate information that we collected on you. 

Right to Limit Use and Disclosure of Sensitive Personal Information: You have the right to direct us to only use your sensitive personal information (for example, your social security number) for limited purposes, such as providing you with the services you requested. 

The right of not being discriminated for not allowing to share your data: Providing your personal information for surveys, marketing, or other purposes, is optional. Your refusal to provide your information for these purposes will not have any impact on the entering into or performance of the contract. When requested under Data Protection Laws, we will collect your prior consent before proceeding to process your personal information for these purposes. 

Right to Opt-out of Sales and/or Sharing: Go City use services that help deliver interest-based advertisements to you as described above. The California Consumer Privacy Act (“CCPA”) may classify our use of some of these services as “sharing” your personal information with the advertising partners that provide the services. You can opt-out of the “sharing” of your personal information by contacting us through the contact details provided in section “additional information” of this notice. Go City does not sell your personal information under the CCPA.  

Right to Delete: You have the right to request that we delete personal information that we collected from you and retained, subject to certain exceptions. An exception may allow us to retain the information. We may deny your deletion request if retaining the information is necessary for us or our service providers to:  

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfil the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.  

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities. 

• Debug products to identify and repair errors that impair existing intended functionality.  

• Exercise free speech, ensure the right of another consumer to exercise their free-speech rights, or exercise another right provided for by law. 

• Comply with the California Electronic Communications Privacy Act.  

• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.  

• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us. 

• Comply with a legal obligation.  

• Make other internal and lawful uses of that information that are compatible with the context in which you provided it. As required by applicable law, we will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action. 

How to Exercise Your CCPA Rights To exercise the CCPA rights described above as to your personal information, or for questions or comments about the ways in which we collect and use your personal information, and your choices and rights regarding such use, please submit a verifiable CCPA request or otherwise contact us at: [email protected]  

To fulfil your request, we need to verify your identity and residency in California, authority to make the request and that the personal information relates to you. We may ask for additional information that allows us to properly understand, evaluate and respond to your request. Only you, or someone legally authorized to act on your behalf, may make a verifiable CCPA request related to access to your personal information, and no more than twice within a 12-month period. We will only use personal information provided in a verifiable CCPA request to verify the requestor's identity or authority to make the request. 

We will respond to a verifiable CCPA request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any disclosures we provide will only cover the 12-month period preceding the CCPA request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. We do not charge a fee to process or respond to your CCPA request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why and provide you with a cost estimate before completing your request. 

Information to users located in Brazil 

The provisions contained in this section apply to all Users who are located in Brazil, according to the "Lei Geral de Proteção de Dados". This part of the document uses the term “personal information“ as it is defined in the Lei Geral de Proteção de Dados (LGPD).  

Your Brazilian privacy rights 

We assure you that you will never be discriminated against by exercising your rights. We note, however, that where requests are manifestly unfounded or excessive, in particular because of their repetitive character, Go City shall (i) bear the burden of demonstrating the manifestly unfounded or excessive character of the request; and (ii) refuse to act on the request, indicating the factual or legal reasons that prevent the immediate adoption of the measure. 

The rights of the data subjects under the LGPD differ a little from the rights under the GDPR. Thus, please see below the rights you have over your personal data under the LGPD: 

• The right to confirm the existence of the Processing of their Personal Data; 

• The right to request access to your Personal Data; 

• The right to correct your Personal Data which are incomplete, inaccurate, or outdated; 

• The right to anonymization, blockage or deletion of unnecessary or excessive Data or Data Processed without observing the requirements of the LGPD; 

• The right to request the deletion of the Personal Data Processed based on your consent; 

• The right to request the portability of your Personal Data to another supplier/service provider; 

• The right to request information on the public and private entities with which the Controller has shared your Personal Data; 

• The right to obtain information on the possibility of not providing consent and on the consequences of such refusal; and 

• The right to withdraw the consent for the Processing of Personal Data. 

You can also lodge a complaint related to your personal information with the ANPD (the National Data Protection Authority) or with consumer protection bodies. 

In the event you wish to exercise your right to access your personal data or to confirm the existence of the processing, please let us know that you are performing this request under the LGPD and whether if you wish a simplified or complete disclosure. If you opt for the complete disclosure, please note that it might take up to 15 days to fulfil your request.