Kelpies Cabs is committed to protecting your privacy. This policy explains what personal data we collect when you book a taxi or private hire journey, why we use it, who we share it with, how long we keep it, and your rights under UK GDPR and the Data Protection Act 2018.

It covers our website, online taxi bookings, airport taxi requests, Day Highlights bookings, customer accounts, corporate accounts, and messages you send us. Read it with our Terms & Conditions and Payment Policy.

1. Who we are

Kelpies Cabs is the data controller for personal data described here. We provide pre-booked licensed private hire and transport services in Falkirk and Central Scotland.

For data protection enquiries, use the email or phone number on our contact page. We do not currently appoint a statutory Data Protection Officer; we still answer access and deletion requests ourselves.

2. Data we collect

When you book a journey we typically collect:

Identity and contact details: name, email address, phone number.
Journey details: pickup and drop-off locations, date and time, passenger count, vehicle type, luggage notes, flight number and terminal if you give them, and any notes you add.
Payment and billing: whether the fare is collected in the car, paid online, taken as a deposit, or invoiced to a company; amounts, payment status, and (for accounts) company name, billing address and invoice history. We do not store full card numbers on our servers when you pay online.
Account data: login email and a hashed password if you register; account type; booking history.
Corporate and school accounts: company or organisation name, authorised bookers, and invoicing contacts.
Support messages: contact forms, corporate enquiries, and complaint correspondence.
Technical data: IP address, device and browser type, and cookie identifiers needed to run the site.
Vehicle location during an active job (GPS), used to run the booking and, where enabled, to show status to operations staff. GPS trails are not kept as a permanent marketing profile.

We do not require special category data to make a standard booking. If you tell us about a disability, wheelchair, medical need or assistance dog so we can send a suitable vehicle, we treat that as health or accessibility information and use it only to provide the journey and to meet our Equality Act 2010 duties.

3. How we collect it

We collect data you type into our website or apps, data you give by phone, email or WhatsApp, data created when we accept and run a booking (driver assignment, timestamps, payment status), and limited data from payment and messaging providers that confirm a payment or a message was sent. We do not buy marketing lists.

4. Why we use it and the lawful bases

UK GDPR requires a lawful basis for each use. For taxi bookings and airport transfers we rely on:

Contract (Article 6(1)(b)): to accept the booking, assign a licensed driver, send confirmations and reminders, collect or invoice the fare, and handle changes or cancellations.
Legal obligation (Article 6(1)(c)): licensing, accounting, tax, and responding to a lawful request from the police or a regulator.
Legitimate interests (Article 6(1)(f)): keeping records of jobs, preventing fraud and abuse, improving how the service runs, and defending legal claims. We do not use this basis where your interests override ours.
Consent (Article 6(1)(a)): non-essential cookies (analytics such as Google Tag Manager) and any optional marketing emails. You can withdraw consent at any time without affecting the booking itself.

Accessibility or health information is used only where needed to provide the service you asked for, to protect a person’s vital interests in an emergency, or with your explicit consent. We do not use it for marketing.

5. How we use it day to day

We use this information to fulfil private hire bookings, assign drivers, send confirmations and reminders (email, SMS or WhatsApp where configured), take or record payment, run corporate invoicing, respond to support enquiries, and keep the service secure. Location data during a job helps us operate the ride; it is not sold.

6. Sharing your data

We share journey details with the assigned driver so they can collect you. We use service providers who process data on our instructions:

Payment processing (currently Stripe) when you pay online. Card details are handled by Stripe, not stored as full card numbers in our database. See Stripe’s privacy policy.
Email, SMS or WhatsApp providers that deliver confirmations and reminders.
Hosting, backup and error-logging providers that keep the website running.
Analytics tools, only after you accept analytics cookies.

We may disclose data if the law requires it, or to the licensing authority or insurers when that is necessary to investigate an incident. We do not sell your personal data.

7. International transfers

Some providers (for example card payments or cloud email) may process data outside the United Kingdom. Where that happens we use a lawful transfer tool, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, or a provider covered by a UK adequacy regulation.

8. Retention

We keep data only as long as we need it for the purpose, including:

Booking, invoice and accounting records: typically up to six years after the end of the tax year, which matches UK record-keeping practice for financial records.
Customer accounts: while the account is open, then for a short period in case of queries, unless you ask us to close it sooner and we have no overriding duty to retain the data.
Vehicle GPS trails: deleted automatically after 90 days.
Login sessions: about 30 days.
Admin audit logs: about 12 months.
Failed technical jobs: about 14 days.

You may ask us to delete data sooner where we have no overriding reason to keep it. We may anonymise booking rows rather than erase the entire operational history, so that licensing and accounting records still make sense.

9. Cookies and analytics

Essential cookies are required for the site to function (session, security, and your cookie choice). Analytics cookies, including Google Tag Manager if configured, load only after you choose “Accept all” or enable analytics in the cookie banner. You can reject non-essential cookies. Changing your mind later is done by clearing the site cookies and using the banner again, or by contacting us.

The banner is how we meet the Privacy and Electronic Communications Regulations (PECR) for non-essential cookies.

10. Marketing

We do not send marketing email or SMS unless you have opted in or another PECR-compliant basis applies (for example a relevant existing-customer message you can opt out of). Booking confirmations and service messages about your ride are not marketing.

11. Your rights

Under UK GDPR you may request:

access to your personal data;
correction of inaccurate data;
erasure, where that is allowed;
restriction of processing;
objection to processing based on legitimate interests;
portability of data you provided, where processing is automated and based on contract or consent.

Use the contact page. We may need to verify it is you. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would rather put it right first.

12. Children

Our online accounts are intended for adults. We do not knowingly create a login for a child under 13. A booking may include children travelling with a responsible adult. If you believe we hold a child’s data that should not be there, contact us.

13. Changes

We may update this policy. The date at the top of the page is the current version. Material changes will be posted here.

Privacy Policy