Privacy notice

What the Guide contains

Venue pages are generated as static pages. Their venue names, types, addresses, coordinates, facilities and accessibility information may come from venue operators, public/open datasets and licensed data suppliers. Route, map, parking, timetable and fare content may come from OpenStreetMap-based mapping, routing engines, transport operators and aggregators, parking providers, public transport datasets, and our own calculated comparisons. Static page delivery does not itself send a route search to those sources.

Live route searches

When you use the live widget, typed origins and autocomplete queries are sent to the EndMile API. The API uses Google Places to return suggestions and resolve your selected place to an address and coordinates. We combine selected origin coordinates with the venue's destination coordinates and send routing requests to the services needed to calculate options.

Our host and API may process IP address, request time, URL, browser/user-agent, response status and security information in server logs. Live searches may also create operational or journey-usage records. The production logging and search-retention configuration must be verified before launch; until that review is complete, do not rely on this notice as confirmation that raw search terms or coordinates are retained.

Analytics

The Guide has its own Google Analytics 4 property (measurement ID G-EW6G2GYXJE). It is not the analytics configuration of the main site. After analytics consent, GA4 may record page views, live-search use, route-card interactions, outbound app actions and affiliate clicks, together with approximate location derived from IP address and device, browser, operating-system, referrer and session information.

Google Ireland Limited generally provides GA4 to UK customers as a processor, with Google group companies and subprocessors supporting the service. The configured GA4 data retention period and Google contract/entity must be checked in the production property before launch. Google may process data outside the UK; applicable UK adequacy regulations or contractual safeguards and the relevant transfer assessment must be confirmed.

Advertising and affiliate links

If enabled after advertising consent and certified-CMP approval, Google AdSense may process identifiers, consent signals, IP address, device/browser data, viewed pages, ad interactions and fraud/security signals to deliver and measure ads, prevent invalid traffic, and provide contextual or personalised advertising. Google may act as our processor for publisher services and as an independent controller for some advertising purposes; the precise roles and international-transfer safeguards must be confirmed against the signed production terms.

Consent is the intended lawful basis for optional advertising storage, personalised advertising and related access to a device. Legitimate interests may apply to strictly necessary security and fraud prevention only where permitted by PECR and after review. If advertising consent is refused, this implementation does not load AdSense, including contextual ads.

Some outbound booking links are affiliate links. We may receive commission. We record affiliate-link clicks in GA4 only with analytics consent; a booking provider or affiliate network may separately measure a click or conversion after you follow its link under its own notice.

Purposes and lawful bases

• Necessary delivery and security: legitimate interests in serving, protecting and diagnosing the Guide.
• Live searches: taking steps at your request to provide route results; legitimate interests may also support proportionate security logging.
• Analytics: consent.
• Affiliate measurement: consent where EndMile stores or reads analytics information; providers determine their own basis after you leave.
• Advertising: consent for optional advertising and personalisation technologies.

You may object to legitimate-interest processing. We will consider your circumstances and stop unless we have compelling grounds or need the information for legal claims.

Recipients, retention and transfers

Recipients may include our hosting provider, Google (Places, GA4 and, when enabled, AdSense), routing/map and public-transport providers, venue/parking/booking providers, affiliate networks, professional advisers and authorities where legally required. Providers receiving only coordinates or requests can still receive personal information when combined with an IP address or identifier.

• Consent preferences: until you revise them or this policy version changes.
• GA4 cookies: up to 2 years for _ga and _ga_EW6G2GYXJE, subject to user activity and browser controls.
• GA4 event/user data: the production property setting is awaiting verification.
• Server logs and retained searches: awaiting verification against production.
• Affiliate records held by EndMile: awaiting confirmation before conversion tracking launches.

These unresolved periods, controller address, Google roles and safeguards require configuration and UK privacy review before production advertising is enabled.

Your rights and complaints

Depending on the circumstances, you may ask for access, rectification, erasure, restriction, portability, or object to processing. You can withdraw analytics or advertising consent at any time using Cookie settings, without affecting earlier lawful processing. Email us to exercise a right; we normally respond within one month.

You may complain to the Information Commissioner's Office, although we would welcome the chance to address your concern first.

Related policies

See our Cookie policy and Guide terms.