How Taxi Dispatch protects operator, driver and passenger data under the UK GDPR and the Data Protection Act 2018. A United Kingdom supplier since 2014, with your data held in the United Kingdom and your contract governed by the law of England and Wales.
The short answer for your tender or supplier questionnaire. Taxi Dispatch is a UK company that has processed booking data for licensed UK operators since 2014. We act as your data processor; you remain the data controller. Passenger, driver and account data is stored in the AWS eu-west-2 (London) region and does not leave the United Kingdom by default. The processing terms required by Article 28 of the UK GDPR are already in your Terms of Service and bind us from day one. We will complete your own DPA on your paper, free of charge, on request.
Since the United Kingdom left the European Union, UK organisations are regulated by the UK GDPR — Regulation (EU) 2016/679 as retained in UK law by section 3 of the European Union (Withdrawal) Act 2018 — read together with the Data Protection Act 2018. Direct marketing by phone, SMS and email is additionally governed by the Privacy and Electronic Communications Regulations 2003 (PECR), which matters to any operator sending booking confirmations or promotions to passengers. The UK supervisory authority is the Information Commissioner’s Office (ICO).
Where you carry passengers whose data originates in the European Economic Area, the EU GDPR applies in parallel and we meet that standard too. We apply one protection standard to every customer rather than a lower one to customers outside the UK.
The distinction decides who answers to the ICO, so it is worth being exact about it.
| Data | Role | Responsible for |
|---|---|---|
| Passenger bookings, addresses, phone numbers, journey history | You are controller, we are processor | You decide why the data is held and for how long; we only process it on your instructions to run the service. |
| Driver records, allocation and GPS history | You are controller, we are processor | You set the lawful basis and tell drivers what is tracked; we store it securely and hand it back on request. |
| Account customer contacts and invoicing | You are controller, we are processor | Yours throughout; exported to you in full at any time. |
| Your own subscription, billing and support records | We are controller | We hold these to run our business and to meet HMRC record-keeping obligations. |
In the United Kingdom. Customer data is held in an Amazon Web Services data centre in the AWS eu-west-2 (London) region. Passenger names, pickup and destination addresses, telephone numbers and journey history stay on UK soil, under UK jurisdiction, backed up within the UK. Where any transfer outside the UK becomes necessary, we rely on a lawful Chapter V mechanism — UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — supported by a transfer risk assessment.
This is not a technicality. Council contracts, school transport, NHS and hospital patient transport and most corporate accounts require UK data residency in writing before they will award work. Operators on an overseas-hosted system lose those tenders on the paperwork alone. Further detail on the underlying platform’s certifications is published at the AWS GDPR centre.
Passengers, drivers and account contacts have the following rights under the UK GDPR. They are exercised against you as controller, and we will help you answer within the statutory one-month deadline at no charge.
Anyone may also complain to the ICO at ico.org.uk or on 0303 123 1113.
You control retention. Booking and journey records are kept for as long as you need them, which in practice is driven by the record-keeping conditions attached to your private hire operator’s licence and by the six-year limitation period for contract claims under the Limitation Act 1980. We do not delete your operational data unilaterally; we delete it on your instruction, or after termination as described above.
Licensed operators sit between two duties: your licensing authority or Transport for London requires you to keep particulars of every booking, while the UK GDPR requires you not to keep personal data longer than necessary. These are compatible — the licensing condition supplies the legal obligation that justifies the retention. Our system keeps those records in an exportable form that licensing officers accept, which is covered in Section 23 of our Terms of Service.
Contact us directly and a person in the UK will respond — there is no ticket queue and no offshore call centre. If you need our registration details, a completed supplier security questionnaire or a signed copy of your own DPA for a tender, ask and we will provide them.
Related: Privacy Policy · Terms of Service (governed by the law of England and Wales) · About Taxi Dispatch — UK supplier since 2014
Straight answers, no sales script. Still stuck? Ask us directly — we answer the same working day.
Yes. Taxi Dispatch complies with the UK GDPR and the Data Protection Act 2018, and with the EU GDPR where a customer processes data of individuals in the EEA. We act as data processor for the booking, passenger and driver data you put into the system, you remain the data controller, and the data processing terms in our Terms of Service set out exactly what we may and may not do with it.
In the United Kingdom. Customer data is held in an AWS data centre in the London region, so passenger names, addresses, phone numbers and journey history stay on UK soil under UK jurisdiction. That matters for council contracts, school and NHS transport work and any corporate account whose own policy requires UK data residency in writing before it will award the work.
Yes, and you already have one. The data processing terms in Section 5 of our Terms of Service are a UK GDPR Article 28 processing agreement and bind us from the day you subscribe. If your council contract, corporate client or insurer requires a separate signed DPA on their own paper, send it to us and we will complete and return it at no charge.
You do. Your bookings, customer records, account details and driver history remain your property throughout and after the contract. You can export them at any time, we will produce a full export for you on request at no charge, and we delete your personal data from our systems after termination. We never sell your data, never market to your passengers and never use your customer list.
You take it with you and we remove ours. On termination we provide a full export of your bookings, customers and accounts, then delete the personal data we hold as processor within a reasonable period, save for anything we must retain by law such as billing records. That deletion obligation is written into the Terms of Service, not just promised in a sales call.
We handle personal data as both controller and processor and operate to the standards the Information Commissioner's Office expects of a UK data processor, including data minimisation, breach notification within 72 hours, documented sub-processors and honouring data subject rights. If you need our registration details for a tender or supplier questionnaire, ask and we will supply them.
Without undue delay, and in time for you to meet your own deadline. Under Article 33 of the UK GDPR you as controller have 72 hours to notify the Information Commissioner's Office of a reportable breach, so our obligation is to tell you fast enough that the 72 hours is yours to use rather than ours to consume. That commitment is contractual, not a service promise.
For as long as you decide. You are the controller, so retention is your call, and in practice it is driven by the record-keeping conditions on your operator licence and the six-year limitation period for contract claims. We never delete your operational data unilaterally — only on your instruction, or after termination once we have exported everything to you.
They can ask, and you need a documented answer ready. As controller you decide the lawful basis for tracking — normally legitimate interests for allocation, safety and dispute resolution — and you must tell drivers what is recorded and why. Tracking should cover working time rather than a driver's private life. We store the data securely and export it on request; the lawful basis and the driver privacy notice are yours.
Question we haven't answered? Ask it on WhatsApp. A real person replies — usually within the hour on a working day — and good questions get added to this page.
Ask on WhatsAppGot a question? Ask us on WhatsApp — a real person replies, usually within the hour on a working day.
Ask on WhatsApp