1. Who controls your information
The data controller is [LEGAL COMPANY NAME], trading as Northline Cars, company number [COMPANY NUMBER], registered office [REGISTERED OFFICE ADDRESS]. Contact the privacy lead at privacy@northlinecars.co.uk. ICO registration: [ICO REGISTRATION NUMBER IF APPLICABLE].
2. Information we collect
- Identity and contact details, including name, telephone number and email.
- Journey information, including pickup, destination, time, stops, passenger count, luggage, flight or train details and booking history.
- Driver and vehicle assignment information provided in booking confirmations.
- Payment, refund, invoice and account information. Full card details are handled by the payment processor rather than stored by Northline.
- Communications, complaints, lost-property reports, call recordings where enabled, website enquiries and customer-service notes.
- Accessibility and support information needed to arrange a safe journey.
- For authorised SEND or contract transport, limited passenger, education, safeguarding, mobility or health information necessary to deliver the agreed service.
- Technical information such as IP address, browser, security logs and cookie preferences.
3. Why we use it and our lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Provide quotes, accept bookings, allocate drivers and vehicles, communicate and take payment | Contract or steps requested before entering a contract |
| Keep operator booking, complaint, vehicle, driver and lost-property records | Legal obligation |
| Prevent fraud, protect passengers, investigate service issues and defend legal claims | Legitimate interests and legal obligation |
| Manage business accounts and supplier relationships | Contract and legitimate interests |
| Send optional marketing | Consent or permitted legitimate interests, with an opt-out |
| Respond to emergencies | Vital interests |
| Process special-category SEND, disability or health information | A documented Article 9 condition appropriate to the service, such as explicit consent or substantial public interest/safeguarding where applicable |
4. Where information comes from
We normally receive information from the passenger or booker. It may also come from a business-account holder, parent or carer, school, local authority, authorised transport coordinator, another licensed operator, driver, payment provider or publicly available flight information.
5. Who we share information with
We share only what is reasonably necessary with licensed drivers and vehicles, any lawful subcontracted operator, payment processors, booking and dispatch providers, mapping and communication providers, hosting and IT support, insurers, accountants, professional advisers, commissioning bodies, schools or authorised carers, law-enforcement bodies, courts, regulators and TfL. We do not sell personal data.
6. SEND and sensitive information
Do not place detailed medical, safeguarding or child information in a general website message box. Northline will agree a secure channel and access controls with the commissioning body or authorised representative. Information is limited to what drivers, passenger assistants and operational staff need for the journey.
7. Retention
| Record | Typical retention |
|---|---|
| Unconverted quote or abandoned enquiry | Up to 90 days, unless needed for fraud prevention or a continuing enquiry |
| Private hire booking records and any booking call recording | At least 12 months from acceptance, or longer where another legal need applies |
| Payment, invoice and tax records | Normally 6 years after the relevant financial year |
| Complaints and investigation records | Normally 3 years, longer where a serious incident, safeguarding matter or legal claim requires it |
| Lost-property records | At least 12 months |
| Business account records | Contract term plus up to 6 years |
| SEND/contract passenger information | According to the commissioning contract, legal requirements and documented retention schedule; information no longer needed is securely deleted |
| Marketing preferences | Until withdrawal, plus a minimal suppression record to respect the opt-out |
8. International transfers
If a service provider stores or accesses data outside the UK, we will use an approved transfer mechanism and appropriate safeguards. The current provider list is maintained as services are added or changed.
9. Security
We use access controls, staff confidentiality, secure accounts, role-based access, backups, device protection and supplier checks appropriate to the risk. No online system is completely risk-free. Report suspected misuse or a data incident to privacy@northlinecars.co.uk.
10. Your rights
Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent at any time where consent is used. You may also ask for human review of a significant solely automated decision if one is introduced. We may need to verify identity and some rights are subject to legal exemptions.
11. Complaints about privacy
Contact us first at privacy@northlinecars.co.uk. You also have the right to complain to the Information Commissioner’s Office. Current contact information is available from the ICO website.
12. Cookies and analytics
See the Cookie Notice. Non-essential analytics or advertising technologies must not be activated until an appropriate consent choice has been made.
13. Children
General consumer bookings should be made by an adult. Where a child’s information is processed for SEND or home-to-school transport, it will be handled through the authorised adult or commissioning organisation and explained in a suitable way where appropriate.
14. Changes
We will update this notice when our systems, providers or uses of data change. The effective date at the top shows the current website version.