Taxi Fleet Assistant is a UK-based software service for taxi and private hire operators. Taxi Fleet Assistant Ltd (“we”, “us”) plays two different roles under UK data protection law, and it matters which one applies to you:
If you are a driver or a passenger and want to ask about your data, please contact your taxi company first. We will help them to respond (section 8).
When a company signs up and uses the service we collect:
Name, email address, company name, telephone number and address (if given), and your password (stored as a one-way hash, so we cannot read it).
Which plan and how many vehicles you pay for, invoices, payment records (including payments you make to us in cash or by bank transfer) and the dates of those payments. We never see or store payment card numbers: card payments are taken by our payment provider (Stripe).
IP address, browser and device type, sign-in times and error logs. We use IP addresses to protect the sign-up form from abuse.
Emails you send us, and the service emails we send you (for example your welcome email, payment reminders and notices about your account).
A taxi company using the service decides what to put into it. In practice this usually includes:
Each company’s information is kept in its own separate database. We do not use one company’s information for another, and we do not use it to market to anyone. Some features learn from usage to improve that company’s own results (for example popular pick-up places); anonymous location-quality data such as dead spots in mobile coverage may be shared across companies and contains no personal details.
As controller we use account, billing and technical data to: create and run your company’s system; sign you in securely; take and record payment; send you service messages (welcome, payment reminders, suspension and deletion notices, security notices); prevent abuse; keep accounting records; and answer your questions.
As processor we use a taxi company’s data only to provide the service to that company — for example to dispatch jobs, show driver positions, send driver and passenger notifications, calculate fares, produce reports and keep backups — and otherwise only on that company’s documented instructions.
For the data we control, we rely on the following under UK GDPR:
Taxi companies are responsible for having their own lawful basis, and for telling their drivers and passengers about the data they collect through the service (for example that driver location is recorded during shifts).
We do not sell personal data. We use a small number of carefully chosen service providers (“sub-processors”) to run the service. They may only use the data to provide their service to us:
Within a taxi company, administrators can see the information of everyone in that company, dispatchers can see driver locations and job status, and drivers see their own jobs. We may also disclose data where the law requires it, for example to the police or a licensing authority, and to a successor if our business is sold (you would be told).
Transfers outside the UK. Some of these providers (for example our AI provider, Google and Stripe) may process data outside the UK. Where they do, we rely on the safeguards UK law allows, such as a UK adequacy decision or the UK International Data Transfer Agreement or Addendum, and we only use providers that have committed to appropriate protection.
We will tell customers before we add a new sub-processor that handles their company’s data.
We keep data only as long as there is a reason to.
A taxi company’s information is kept while its account is active. The company decides how long to keep individual records, and is responsible for keeping the records its licensing council requires of an operator (for example booking records). We recommend you keep your own copy as well.
When a payment is overdue we write to the account owner, and: after 7 days the system is suspended (nobody can sign in, but nothing is deleted); at 30 days and again at 83 days we send a written notice of the date it will be deleted; and at 90 days the company’s system and all the information in it is permanently deleted, unless payment has been arranged. Before deleting we take a sealed backup, kept for a further 90 days only so that a mistaken deletion could be undone, and then destroyed. Before deletion you may ask us for a copy of your data (section 8).
On written request we delete a company’s system and its information within 90 days, with the same sealed backup for a further 90 days, unless the law requires us to keep something.
Sign-up requests that are never verified are deleted automatically after a short time. Technical logs are kept only as long as needed to run and secure the service, and we aim to delete them within 12 months.
Under UK GDPR you have the right to: access the data held about you; have inaccurate data corrected; ask for data to be erased (subject to legal retention duties); restrict or object to certain uses; and receive your data in a portable format.
If we are the controller (section 2), contact us at the address in section 11 and we will reply within one month.
If your data is held in a taxi company’s system (you are a driver, employee or passenger), the taxi company is responsible for your request. Please contact them. If you contact us instead we will pass your request to them and help them to answer it.
Taxi companies can ask us at any time for an export of their data (bookings, drivers, vehicles, customers and settings in standard file formats), delivered by a secure download link and never as an email attachment.
You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
We use appropriate technical and organisational measures to protect personal data, including:
No system is completely secure. If you think your account has been compromised, tell us straight away. If a personal data breach affects data we process for a taxi company, we will tell that company without undue delay so that it can meet its own duties.
We use only the cookies and similar storage needed to keep you signed in and to protect our sign-up and sign-in forms. We do not use advertising cookies and we do not sell or share data with advertisers.
For any privacy question, or to make a request:
We aim to reply to all data requests within one month. You also have the right to complain to the ICO (section 8).