Privacy Policy

BOPXI CARS is a UK private hire operator providing transport services including airport transfers, private hire bookings, and school transport contracts. Data Controller: BOPXI CARS Contact: info@bopxicars.co.uk | +44 1480 584193 We take your privacy seriously and are committed to processing your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We may collect the following personal information: Customers: — Full name, email address, and phone number — Pickup and drop-off addresses (including home address if provided) — Journey date, time, and service type — Payment information (processed via Stripe — we do not store card numbers) — Account login credentials (securely stored and hashed) — Browser push subscription endpoint, public encryption keys, and device/platform status — Booking history and communication records Drivers: — Full name, email address, and phone number — Vehicle details (make, model, registration) — Driving licence number — DBS check status (reference held, not the full certificate) — Duty status and shift records — GPS location data during active bookings School / Council Contacts: — Contact name, email, phone — School name and address — Pupil transport details (name, address, required travel) — Attendance and compliance records We do not knowingly collect personal data from children directly. Pupil data for school transport is provided by the commissioning school or council and is processed only for the purpose of delivering the transport service.

We process your personal data on the following lawful bases: — Contract performance: to book, manage, and deliver transport services — Legal obligation: to comply with licensing, safeguarding, and regulatory requirements — Legitimate interests: to operate our business safely, prevent fraud, improve our services, and communicate with customers and drivers — Consent: for optional communications such as marketing or push notifications (where you have opted in) Specifically, we use your data to: — Process and manage bookings and payments — Assign and notify drivers of journeys — Enable real-time GPS journey tracking — Send booking confirmations, status updates, and payment receipts — Manage school transport routes and attendance — Handle complaints and enquiries — Maintain the security and integrity of our platform

BOPXI CARS collects GPS location data from drivers during active bookings. This data is used to: — Provide live journey tracking to the assigned customer — Monitor driver performance and punctuality — Support safeguarding oversight for school transport contracts — Resolve disputes or complaints about journey performance Location data is only collected when a driver is on an active booking. Location sharing is not continuous outside of active assignments. Location data is shared only with the customer for their specific booking, and with BOPXI CARS administrators. It is retained for a limited operational period and then deleted. It is never sold or shared with third parties for commercial purposes. By using the BOPXI CARS driver app, you consent to location data collection as described above.

Online payments are processed via Stripe, a PCI DSS-compliant payment processor. BOPXI CARS does not store, process, or have access to full card numbers or CVV codes. Stripe may store cookies and payment data on their platform in accordance with their own privacy policy, available at stripe.com/privacy. We retain records of payment amounts, dates, and Stripe transaction references for accounting, refund processing, and dispute resolution purposes.

Our platform uses cookies and similar technologies to operate and improve the service. See our full Cookie Policy at /cookies for details. Essential cookies are required for the platform to function (authentication, session management). You cannot opt out of essential cookies. Analytics and preference cookies may be used to improve the user experience. You can control these via your browser settings.

If you opt in and grant browser or device permission, BOPXI CARS may send notifications including time-sensitive pickup reminders, booking status updates, payment reminders, journey completion updates, and a notification setup test. To provide app-closed alerts, we store a random browser installation identifier, the push-service endpoint issued to that browser, its public encryption keys, delivery status, and limited device/platform information. The lock-screen payload is encrypted and deliberately generic: it does not include a passenger name, telephone number, address, booking reference, or journey details. Detailed information remains inside the signed-in BOPXI CARS app. Depending on your device and browser, encrypted Web Push delivery is routed through Apple, Google, or Mozilla push services. The device operating system controls whether an alert makes a sound, vibrates, or is suppressed by Silent, Focus, or Do Not Disturb settings. You can withdraw consent at any time in BOPXI CARS notification settings or your browser/device settings. When you disable background notifications or sign out, BOPXI CARS attempts to unsubscribe that browser and delete its server-side subscription record. Withdrawing consent will not affect the lawfulness of prior processing.

We do not sell personal data. We may share data with: — Assigned drivers: passenger name, pickup/drop-off, and journey details only — Stripe: for payment processing (see section 5) — Schools/councils: for school transport contract management — Legal authorities: where required by law or court order — IT and platform providers: Base44 (our platform provider) processes data on our behalf as a data processor under appropriate data processing agreements — Push delivery providers: Apple, Google, or Mozilla receive the browser-issued endpoint and an encrypted, generic alert payload when an opted-in device is notified We require all third parties to process your data securely and only for the purposes we specify.

We retain personal data for as long as necessary to: — Fulfil the purpose for which it was collected — Comply with legal, accounting, and regulatory obligations Our standard retention periods: — Customer booking and payment records: 6 years (for HMRC compliance) — Driver employment and licence records: 6 years after contract end — School transport records: 3 years after contract end (or as required by the commissioning body) — GPS location data: 30 days after journey completion — Account data: For as long as the account is active, plus 1 year after closure — Push subscription records: Until notifications are disabled, the device signs out, the subscription is replaced, or the push provider reports it invalid After these periods, data is securely deleted.

You have the following rights regarding your personal data: — Right of access: request a copy of the data we hold about you — Right to rectification: request correction of inaccurate data — Right to erasure: request deletion of your data ("right to be forgotten") where no legal obligation requires retention — Right to restriction: request that we limit how we use your data — Right to data portability: receive your data in a structured, machine-readable format — Right to object: object to processing based on legitimate interests — Rights related to automated decision-making: we do not make solely automated decisions that significantly affect you To exercise any of these rights, contact us at info@bopxicars.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

You may request deletion of your BOPXI CARS account at any time by emailing info@bopxicars.co.uk with the subject line "Account Deletion Request". We will delete your account and personal data within 30 days, except where we are required to retain certain information for legal or regulatory purposes (e.g. financial records). In such cases, we will inform you what data we retain and why. Deleting your account does not affect any outstanding bookings or legal obligations.

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include: — Encrypted data storage and transmission (TLS/HTTPS) — Access controls limiting data to authorised personnel only — Regular security reviews — Secure third-party processors under contractual obligations In the event of a data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay where required by law.

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page. Significant changes will be communicated to registered users by email or in-app notification. Continued use of our services after changes take effect constitutes acceptance of the updated policy.

For any privacy-related queries or to exercise your data rights, contact: BOPXI CARS — Data Controller 📧 info@bopxicars.co.uk 📞 +44 1480 584193 💬 WhatsApp: wa.me/441480584193 You may also contact the ICO at ico.org.uk if you have concerns about how we handle your data.