Introduction

We are Veezu Holdings Limited. Our company number is 09378357 and our registered office is Hodge House, 114–116 St. Mary Street, Cardiff, CF10 1DY. Veezu Holdings Limited is the controller of your personal information and is responsible for your personal information.

All references in this policy to "Veezu", "our", "us", or "we" refer to Veezu Holdings Limited, and its holding companies and subsidiaries, who are all committed to protecting the privacy and security of your personal information. "Veezu Company" means any company which at the relevant time is a subsidiary or holding company of Veezu Holdings Limited, or any subsidiary of any such holding company, and "subsidiary" and "holding company" shall have the meanings given to them by the Companies Act 2006 Section 1159.

This privacy notice sets out how we process your personal information as a passenger using our booking services. This policy is not intended for children, and we do not knowingly collect data relating to children.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the information set out in the Contact section below.

What This Policy Contains

1. Your Right to Object

You have various rights in respect of our use of your personal information as set out in Section 15. Two of the fundamental rights to be aware of are that:

1. You may ask us to stop using your personal information for direct-marketing purposes. If you exercise this right, we will stop using your personal information for this purpose.
2. You may ask us to consider any valid objections which you have to our use of your personal information where we process your personal information on the basis of our, or another person's, legitimate interest.

2. Information About Other Individuals

If you give us information on behalf of a third party, and we are satisfied that you have demonstrated sufficient authority to act on behalf of that third party, you confirm that the third party has appointed you to act on their behalf and has agreed that you can:

• Give consent on their behalf to the processing of their personal information;
• Make them aware of this data protection notice; and
• Give consent to the transfer of their personal information abroad (if applicable).

3. What Personal Information Do We Collect About You?

We process the following categories of personal information about you:

• Personal information, including your name, current residential address, pickup address, destination address, email address or phone number;
• Payment-related information, including bank account details, credit card details, banking address and account name;
• Information you provide regarding your health so that we can provide you with a suitable vehicle;
• Your GPS location;
• Medical information, only where we need to procure a vehicle suitable for your needs (where you have specifically asked us for this) and you have provided health details necessary for us to ensure a suitable vehicle; and
• Details of any enquiries made by you through the website or by phone.

We will monitor and record communications with you (such as telephone conversations and emails) for the purposes of service provision, quality assurance, complaint investigation, training, fraud prevention and compliance. Any information received through such monitoring will be added to the information we already hold about you.

Please note that in compliance with data protection legislation, we will process your personal information without your knowledge or consent where this is required or permitted by law.

4. When Do We Collect Your Personal Information?

When you use our website, web booking portal, mobile device booking application, telephone us, sign up to our newsletters or alerts, or create an account with us when using our services or those of our Driver Partners.

5. Why Do We Collect Your Personal Information?

Under data protection legislation we may only process your personal information if we have a legal basis for doing so. Our legal bases for processing are set out below:

6. Disclosure of Your Information

We will disclose your personal information to:

• Other companies within our group of companies (i.e., the subsidiaries outlined in the Introduction);
• Our business partners and service providers, such as our Driver Partners, and third-party contractors and advisors such as DiSC telephony and iCabbi dispatch providers, to enable them to undertake services for us and/or on our behalf;
• Third-party payment providers such as Judo and AirPay;
• Any prospective buyer or seller (and their representatives) in the event that we sell or buy any business or assets;
• HMRC, other government departments and regulators, in order to comply with any legal obligation;
• Lawyers, insurers or other advisers in respect of any claims, including sharing information in connection with legal or insurance claims to protect the rights and safety of others;
• Selected third parties (using aggregated/anonymous information only), including analytics and search engine providers, to assist us in the improvement and optimisation of our website; and
• If our whole business is sold or integrated with another business, our advisers and any prospective purchasers and their advisers, who will be passed on to the new owners of the business.
• The NHS Test and Trace contact-tracing service.

7. Payments

For information relating to payments, please see the Payment section in our Passenger Terms and Conditions on our website(s).

8. Telling You About Our Services

Communicating with passengers is an essential part of providing a reliable and trustworthy licensed taxi and private hire service. We will therefore contact you by telephone, text, via the app or by email for non-marketing, service-related communications to:

• Update you on the progress of your booking;
• Remind you of any public health guidance applicable to your journey; and
• Ask for feedback on your journey.

We send out marketing communications based on our legitimate interests where we send you information via post, or where we contact you via a corporate email address on behalf of a business. We will only contact consumer customers, sole traders and non-limited liability partnerships by personal email for marketing purposes if you have given your consent, or if you have previously bought goods and services from us and we are contacting you about similar offerings.

You have the right at any time to ask us, or any third party, to stop processing your information for direct marketing purposes — see Section 15 for further information.

9. Cookies and Related Software

Please see our separate Cookies Policy on any of our websites for further information about how we use cookies.

10. Transferring Personal Data Outside of the UK

We may transfer your personal data to countries outside of the UK. Those countries may have data protection rules that are different from the UK. To ensure that any personal information transferred outside of the UK receives an adequate level of protection, appropriate measures are in place to ensure that your personal information is treated in a way that is consistent with and which respects UK data protection law.

11. How Do We Keep Your Personal Information Secure?

We have put in place measures to protect the security of your personal information in accordance with the requirements of the UK GDPR, the DPA 2018 and the ISO 27001 Information Security Standard. Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. Access to your personal information is limited to those employees, agents, contractors and other third parties who have a business need to know, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

12. How Long Do We Keep Your Personal Information For?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation.

To determine the appropriate retention period, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and the applicable legal, regulatory, tax, accounting or other requirements. Specifically:

• We hold your personal information for up to a maximum of 7 years from when it was last used, to comply with applicable legislation and local authority rules; and/or
• Where we are processing solely on the basis of consent, we hold the information until consent is withdrawn.

In some circumstances we will anonymise your personal data for research or statistical purposes, in which case we may use it indefinitely without further notice. If required, we will be entitled to hold personal information for longer periods to comply with our legal or regulatory obligations.

In some circumstances you can ask us to delete your data — see Section 15 for further information.

13. Changes to Your Personal Information

It is important that the personal information we hold about you is accurate and current. Please keep us informed if the personal information you provided when you downloaded our App or opened an account changes during your relationship with us.

14. What Are Our Obligations?

Under data protection legislation, we are a Data Controller and are therefore responsible for, and control, the processing of your personal information. Such information must be protected in accordance with data protection legislation. In accordance with that legislation, your personal information will be:

• Used lawfully, fairly and in a transparent way;
• Collected only for valid purposes that we have clearly explained to you, and not used in any way that is incompatible with those purposes;
• Relevant to the purposes we have told you about and limited only to those purposes;
• Accurate and kept up to date;
• Kept only as long as necessary for the purposes we have told you about; and
• Kept securely.

15. Your Rights in Relation to Your Personal Information

You have a number of rights under data protection laws in relation to your personal data. If you are an individual, you have the right to:

• Ask us to provide you with copies of personal information we hold about you;
• Ask us to provide your personal information to a third-party provider of services (where we use your information on the basis of consent or performance of a contract and where processing is carried out by automated means);
• Ask that we correct any personal information if it is found to be inaccurate or out of date;
• Ask that your personal information is erased where it is no longer necessary for us to keep it;
• Request a restriction to be placed on further processing where there is a dispute in relation to the accuracy or processing of your personal information;
• Object on legitimate grounds to the processing of your personal information, where applicable; and
• Ask us to stop using your personal information for direct marketing purposes.

If you wish to exercise your right to stop direct marketing, you should complete our Withdrawal Consent Form available at www.veezu.co.uk, or follow the unsubscribe instructions in emails you receive from us.

There are some exemptions which may apply — for example, information collected and processed for the prevention, investigation, detection or prosecution of criminal offences.

No Fee Usually Required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What We May Need From You

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request to speed up our response.

Time Limit to Respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

16. Contact

If you have any difficulty in reading or understanding this policy, or if you would like it in another format (for example audio, large print or braille), please contact us. The Veezu DPO and Compliance team will oversee compliance of this privacy notice.

Complaints

You have the right to make a complaint to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). However, before doing so, please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand.

17. Changes to Our Privacy Policy

We may update our privacy policy from time to time. Any changes we make will be posted on this page and, where appropriate, notified to you by post or email. Please check back frequently to see any updates or changes to our privacy policy.