Privacy & Security Policy

1. The data we collect

Information you give us

• Identity and contact details — your name, email address, telephone number, and the name of anyone you are booking for.
• Journey details — pickup and drop-off addresses, date and time, flight or train numbers, passenger and luggage numbers.
• Payment details — the card or payment method used. Full card numbers are handled by our payment provider and are never stored on our systems.
• Special requirements — for example a child seat, an accessible vehicle, or an assistance dog. Where a request relates to health or disability, we treat it as special category data and use it only to fulfil that journey.
• Correspondence — messages, emails, feedback, reviews and complaints, and notes from calls with our support team.

Information we collect automatically

• Technical data — IP address, browser and device type, operating system, and pages viewed on our website.
• Cookies and similar technologies — see section 6.
• Journey records — allocated vehicle and driver, pickup and completion times, and route information used to dispatch and account for the journey.

Calls to our support team may be recorded for training, dispute resolution and quality monitoring. Where a call is recorded, you are told at the start of the call.

2. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and freedoms, and we only proceed where it is not.

3. Who we share it with

We share the minimum data needed, with the following categories of recipient:

• The driver assigned to your journey — your name, contact number, pickup and drop-off details, and any special requirement relevant to the journey. Drivers are bound by confidentiality obligations and may not use your data for any other purpose.
• Payment providers — to authorise and settle payments and refunds.
• Technology suppliers — booking and dispatch systems, hosting, email and SMS delivery, and customer support tools, acting as processors under written contract.
• Partner operators — where a journey falls outside our own coverage area and is fulfilled by another licensed operator on our behalf.
• Regulators and authorities — including Transport for London, licensing authorities, HMRC, and the police, where we are legally required to disclose information or where it is necessary to investigate a serious incident.
• Professional advisers and insurers — where needed to establish, exercise or defend legal claims.

We do not sell, rent or trade personal data.

4. How long we keep it

• Booking and journey records — kept for the period required by our TfL operator licence and for 6 years afterwards, in case of claims.
• Payment and accounting records — 6 years from the end of the relevant financial year, as required by HMRC.
• Support correspondence and complaints — 3 years from resolution.
• Call recordings — 6 months, unless retained longer for an open complaint or investigation.
• Marketing preferences — until you withdraw consent, plus a suppression record so we do not contact you again.
• Website analytics data — up to 26 months.

When a retention period ends, data is securely deleted or irreversibly anonymised.

5. How we protect it

• Traffic between your browser and our site is encrypted in transit with TLS, and booking data is encrypted at rest.
• Access to personal data is restricted to staff and drivers who need it for their role, controlled by individual accounts and role-based permissions.
• Card details are handled entirely by PCI DSS compliant payment providers; we never see or store full card numbers.
• Our systems and suppliers are reviewed regularly, and processors are engaged under written contracts that require equivalent standards of security.
• We maintain a breach response procedure and will notify the ICO — and you, where the risk to you is high — within the statutory deadlines.

6. Cookies

Our website uses cookies in three categories:

• Strictly necessary — needed for the booking form, security and load balancing. These cannot be switched off.
• Analytics — help us understand how the site is used, so we can improve it. Set only with your consent.
• Marketing — used to measure the effectiveness of our advertising. Set only with your consent.

You can accept or reject non-essential cookies when you first visit, change your choice at any time through the cookie settings on our site, and clear or block cookies in your browser settings.

7. International transfers

Your data is normally stored and processed in the UK. Where a supplier processes data outside the UK, we transfer it only where the country is covered by UK adequacy regulations, or under the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You can ask us for details of the safeguards applied to any specific transfer.

8. Your rights

Under UK GDPR you have the right to:

• Be told how your data is used — which this policy sets out.
• Access a copy of the personal data we hold about you.
• Have inaccurate or incomplete data corrected.
• Ask us to delete data where we no longer have a reason to keep it.
• Ask us to restrict how we process your data.
• Receive your data in a portable, machine-readable format, or have it sent to another provider.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time, where consent is the basis we rely on. Withdrawing consent does not affect processing carried out before you withdrew it.

To exercise any of these rights, contact us using the details in section 11. We respond within one month, and will tell you if we need longer because a request is complex. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity before we release information.

Some rights are limited where we are legally required to retain data — for example, booking records we must keep under our operator licence.

9. Marketing

We only send marketing messages where you have asked to receive them, or where you are an existing customer and we are offering a similar service. Every message includes an unsubscribe link, and you can opt out at any time by using it or by contacting us. Opting out of marketing does not stop service messages about a booking you have made.

10. Children

Our services are not directed at children, and we do not knowingly collect data from anyone under 16 except where a parent or guardian provides it as part of a booking — for example a child's age for a child seat. If you believe a child's data has been given to us in error, contact us and we will delete it.

11. Contact us and how to complain

For any privacy question, or to exercise your rights, write to UKTRANSFER2016 LIMITED, 10–16 Tiller Road, London, E14 8PX, or use the contact details published at uktransfer2016.com.

If you are unhappy with how we have handled your data, please give us the chance to put it right first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We are registered with the ICO under reference ZA765654.

12. Changes to this policy

We review this policy regularly and may update it to reflect changes in the law or in how we operate. The date at the top shows when it was last revised. Where a change materially affects how we use your data, we will tell you directly.

This policy should be read alongside our Terms & Conditions.