OneTaxi Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains how OneTaxi AI (“OneTaxi”, “we”, “us” or “our”) collects, uses, stores, shares and protects personal data when you use our services.

OneTaxi provides dispatch and fleet-management software for taxi and private-hire firms. Our services include our website, office web application, driver applications for iPhone and Android, browser-based driver application, and passenger vehicle-tracking pages. Together, these are referred to as the “Service”.

The Service enables firms to manage bookings, allocate jobs to drivers, view vehicle locations, share journey progress with passengers, communicate with drivers, and manage invoices, accounts and driver statements.

This Policy applies to office users, drivers, passengers, customers of taxi and private-hire firms, people who visit our website, and people who contact us about the Service.

Using the Service does not, by itself, mean that you consent to every type of processing described in this Policy. Where consent is required by law, we will obtain it separately. Otherwise, we process personal data on an applicable lawful basis, as explained below.

2. Who Is Responsible for Your Personal Data?

The organisation responsible for personal data depends on the purpose for which it is processed.

2.1 Data controlled by taxi and private-hire firms

The firm using OneTaxi will generally act as the data controller for the personal data it enters into or generates through the Service for its taxi or private-hire operations. This includes customer records, bookings, passenger details, driver records, operational location data, messages, and business records.

The firm determines why that information is needed and how it is used in its business. OneTaxi generally acts as the firm’s data processor, processing that information on the firm’s documented instructions and under the applicable data processing agreement.

If you are a passenger, customer or driver, the relevant firm is normally your first point of contact for questions about this operational data or requests to exercise your data protection rights.

2.2 Data controlled by OneTaxi

OneTaxi acts as a data controller where it determines the purposes and means of processing its own personal data. Depending on the circumstances, this may include:

• Our own website enquiries and demonstration requests.
• Our customer and business contact records.
• Account administration and service-related communications.
• Security monitoring, abuse prevention and our own technical logs.
• Our billing and contractual records.
• Website analytics and service statistics that we use for our own purposes.

The fact that information is stored within OneTaxi does not, by itself, determine whether OneTaxi or a firm is the controller.

• Privacy contact:.

Where applicable, we will also provide the contact details of our Data Protection Officer or appointed representative.

3. Personal Data We Collect

The information we process depends on your relationship with OneTaxi and how the Service is used.

3.1 Office accounts and authentication

When a firm establishes an account or invites someone to join its office, we may process:

• Names and email addresses.
• The firm’s name and relevant operator or licence details.
• Your role within the firm, such as manager, controller or telephonist.
• Account identifiers and authentication records.
• Passwords and PINs, stored using password-hashing techniques rather than as plaintext.
• Session identifiers, sign-in tokens and security-related records.

Sign-in tokens expire and are subject to other security controls.

3.2 Customers, passengers and bookings

When a firm uses OneTaxi to manage its operations, the Service may process:

• Customer and passenger names, telephone numbers, addresses and account details.
• Booking reference numbers, pickup and destination addresses, scheduled times and booking history.
• Fare information, charges, payment-related status and relevant invoice records.
• Driver allocations and the recorded reasons for those allocations.
• Notes entered by the firm, including relevant booking instructions.
• Messages relating to bookings and service delivery.
• The route of a journey, recorded while the driver is on the job, as described in Section 5.

Customers and passengers may not have a OneTaxi account. Their information may nevertheless be processed because a firm uses the Service to arrange or manage their journeys.

The firm is responsible for ensuring that it has an appropriate legal basis for providing this information to OneTaxi and for providing any privacy information it is required to give to its customers and passengers.

3.3 Driver information

The Service may process:

• Driver names, contact details and driver identifiers.
• Vehicle details and the vehicle associated with a driver.
• Driver availability, shift status, break status and assigned operating zone.
• Licence and badge details and their expiry dates.
• DBS certificate numbers and their issue and expiry dates, where the firm records them. The Service does not record the results of DBS checks.
• Job offers, allocations, acceptance records and relevant operational history.
• Messages, help alerts and other communications between a driver and the firm.

The firm is responsible for determining which driver records are necessary for its operations and legal obligations. It must ensure that any criminal-offence information or other specially regulated information is processed only where legally permitted and subject to the required safeguards.

3.4 Driver location data

While a driver is on shift, the driver application sends the phone’s location to the Service, as described in Section 5.

While a driver is on a job, the positions sent are saved with the booking as the route of the journey, and a help alert records the driver’s last known position. These records are distinct from live location updates and are not deleted when a shift ends.

3.5 Messages and help alerts

We process messages sent through the Service between the office and drivers, together with information included in help alerts. An alert includes the driver’s identity, the time of the alert and their last known location.

The firm is responsible for using these features appropriately and ensuring that access to alerts and messages is restricted to authorised personnel.

3.6 Website enquiries and demonstration requests

If you contact us or request a demonstration, we may collect:

• Your name and business name.
• Your email address and, if supplied, telephone number.
• An indication of your fleet size.
• Your preferred demonstration date or time.
• Information you include in your enquiry.
• Relevant correspondence and follow-up records.

We use this information to respond to your request and manage our business relationship with you.

3.7 Technical, usage and audit information

When the Service is accessed, we may process:

• IP addresses, browser type and operating system.
• Authentication events and relevant security logs.
• Error reports, performance information and diagnostic records.
• Counts of bookings, active drivers and feature usage.
• Records of significant actions in an office account, such as changes to settings, rates or account permissions.
• Website analytics, as described in Section 9.

Where operational records contain identifiable information, they remain personal data even if they are used for technical or administrative purposes.

We seek to use aggregate or genuinely anonymised statistics where individual identification is not necessary.

3.8 Billing and payment information

OneTaxi does not currently collect or store payment card details.

We may process contractual billing records, invoices, payment status and related account information.

If we introduce payment processing, we will explain the arrangements before or when the feature is introduced. A third-party payment provider may process payment information under its own privacy arrangements.

3.9 Information we do not collect

OneTaxi’s driver applications do not access contact lists, photographs, the camera or the microphone. We do not use advertising networks to track users across unrelated websites, and we do not sell personal data.

These statements apply to OneTaxi’s own features. They do not cover independent processing by the operating system, app store, maps application or another service that a user chooses to use.

4. How and Why We Use Personal Data

We process personal data only for purposes that are relevant to the Service, our business operations or another lawful purpose.

4.1 Providing dispatch and fleet-management services

Depending on the firm and the features it uses, processing may be necessary to:

• Receive and manage bookings.
• Identify available drivers and rank or recommend drivers for jobs.
• Offer jobs and communicate allocations to drivers.
• Display vehicle locations to authorised office users.
• Provide passengers with journey and vehicle-tracking information.
• Record relevant booking events and operational information.
• Generate invoices, driver statements and business reports.
• Authenticate users and enforce role-based access controls.
• Maintain the records needed to operate the firm’s business.

4.2 Allocating jobs to drivers

Depending on the firm’s settings, the Service lists available drivers for the office to choose from, suggests a driver for the office to confirm, or offers jobs to drivers automatically.

The factors used include driver availability, how long a driver has been waiting, their place in a zone queue, distance from the pickup and whether the vehicle suits the booking. Drivers the firm has excluded from a customer are not offered that customer’s jobs. Where a firm uses its fairness settings, a driver who has received fewer offers than their fair share may be offered work first.

The reason a job was offered to a driver is shown to the office and to the driver. When someone in the office chooses a different driver, that choice is recorded. A driver can decline an offer, and an offer that is not answered in time lapses.

Where a firm has jobs offered automatically, its office can still review, reassign and intervene, and a driver can ask the office to explain the figures behind their allocations. Where allocation involves solely automated decision-making that produces legal or similarly significant effects on an individual, the applicable legal restrictions and safeguards apply.

4.3 Maintaining and improving the Service

We may process technical and operational information to:

• Monitor availability and performance.
• Diagnose errors and investigate faults.
• Maintain compatibility and reliability.
• Protect the Service from abuse and unauthorised access.
• Understand overall usage and improve functionality.

Where practicable, we use aggregated or anonymised statistics for product analysis. We do not use identifiable booking, customer or driver data for independent product analysis unless that processing has an appropriate lawful basis and is otherwise permitted by our agreements and applicable law.

4.4 Security, legal obligations and dispute resolution

We may process relevant information to protect accounts and systems, investigate suspected fraud or misuse, maintain audit records, respond to lawful requests, comply with applicable legal obligations, and establish, exercise or defend legal claims.

Access to this information is restricted according to its purpose and the applicable authorisation arrangements.

4.5 Communications

We use contact details to send service-related messages, including:

• Account invitations and setup instructions.
• Password-reset and authentication messages.
• Driver job offers and office messages.
• Service notices and information about material service disruptions.
• Invoices and relevant billing communications.
• Replies to enquiries and demonstration requests.

We do not send promotional marketing messages through the Service. If we introduce direct marketing, we will comply with the applicable marketing and electronic communications rules, including any consent requirements.

5. Driver Location and Mobile Applications

Driver location is important for dispatch and passenger tracking. We limit location processing to what is necessary for those purposes.

5.1 When location is collected

When a driver starts a shift, the driver application begins sending the phone’s location to the Service. It continues while the driver is on shift, including during a break, and stops when the shift ends or the driver signs out.

Location is sent at least every 30 seconds, sooner when the vehicle has moved, and more often while a help alert is open. Authorised users at the firm can see the vehicle’s position, and the dispatch system uses it to identify suitable drivers for a booking.

Location is not collected while a driver is off shift, and positions are not stored on the phone to be sent later. Update frequency may vary with device settings, network connectivity and battery-saving settings.

5.2 Background location

• iPhone: the app asks for permission to use location while the app is in use. During a shift it continues to receive location when the phone is locked or another app, such as a navigation app, is open, and iOS shows its location indicator while it does.
• Android: during a shift the app runs with a visible notification, which lets it continue to receive location when the phone is locked or another app is open. The app does not request background-location permission.
• Browser: location is collected while the driver application is open and the driver is on shift.

5.3 When the shift ends

When the shift ends, the app stops sending location. We do not keep a history of where a driver has been outside a job. A record of the driver’s availability and zone is kept for 90 days, as described in Section 7.

Ending a shift does not delete journey routes or help-alert records that have already been saved.

5.4 Location saved with bookings and help alerts

• Journey routes: while a driver is on a job, from accepting it until the ride ends, the positions the app sends are saved with that booking. Authorised office users can view a booking’s route. Routes are kept for 90 days and then deleted.
• Help alerts: when a driver raises a help alert, the alert records the driver’s last known position so that the office can send help.

A saved position can identify where a driver was at a particular time and is personal data. The firm determines how these records are used, subject to applicable law, and access is limited to its authorised users.

5.5 Passenger tracking

When a firm shares a tracking link with a passenger, the passenger can see the vehicle’s position, the driver’s name and the vehicle details from when the driver accepts the job until the ride ends. After the ride, the page no longer shows the vehicle’s position.

5.6 The driver applications

The OneTaxi driver applications for iPhone, Android and the browser process:

• Location, as described in this section, subject to the device’s permissions.
• The driver’s sign-in ID, sent with each request so the Service can link it to the right firm and driver record.
• A push-notification token and the phone’s model, where notifications are enabled, so that job offers and messages can reach the phone. Apple, Google or the browser’s push service deliver these notifications.
• Messages the driver sends to the office, and the content of any message the driver reports.

Signing out removes the push-notification registration. It does not delete operational records already kept by the firm.

Disabling notifications may prevent the driver from receiving job offers or messages through push notifications. Disabling location affects the dispatch and tracking features that depend on it.

The applications do not access a driver’s contacts, photographs, camera or microphone, show no advertising and contain no third-party analytics.

6. AI, Automation and Data Use

The Service includes automated dispatch, ranking and recommendation, described in Section 4.2. These run on OneTaxi’s own systems and are separate from third-party artificial intelligence services.

OneTaxi does not currently send firms’ booking, customer or driver data to third-party AI providers, and does not use that data to train AI models.

Before we introduce a feature that sends personal data to an external AI provider, we will assess what information is needed, the provider’s role, its retention and training terms and the safeguards required by law, and we will update this Policy.

Where automated decision-making or profiling is subject to additional transparency or safeguard requirements under applicable law, those requirements will be addressed.

7. Data Retention and Deletion

We retain personal data only for as long as necessary for the relevant purpose, subject to applicable legal obligations, contractual arrangements and legitimate recordkeeping requirements.

7.1 Deletion and anonymisation

Where a firm requests deletion of operational data, OneTaxi will act in accordance with the firm’s documented instructions and the applicable service agreement.

Where appropriate, a customer record may be deleted or de-identified while retaining a booking record needed for legitimate accounting, legal or operational purposes. This may involve removing names, contact details and notes from past bookings.

Removing a name alone does not necessarily anonymise a record if the person can still be identified from an address, telephone number, location, booking reference or other information.

7.2 Backups and legal retention

Deleted information may remain in backup copies for a short period, normally up to seven days, until those copies are replaced. Backups are used only to restore the Service.

We may retain information for longer where required by law or necessary to establish, exercise or defend legal claims. Any retained information remains subject to appropriate access controls and is not kept indefinitely without justification.

7.3 Closing an account

When a firm closes its account, we disable access and follow the applicable contractual process for exporting, returning or deleting the firm’s data.

A firm’s closure does not automatically override statutory recordkeeping obligations or the rights of other individuals. Where OneTaxi must retain certain information for its own legal purposes, that information is retained only for the relevant purpose and period.

8. Sharing Personal Data

We do not sell personal data or share it with advertising networks for behavioural advertising.

Depending on how the Service is used, personal data may be shared with the following categories of recipients:

• Hosting and infrastructure providers: to host, store, secure and deliver the Service.
• Email providers: to send account invitations, password-reset messages, invoices and service communications.
• Maps and location providers: to provide maps and address search.
• Push-notification providers: Apple, Google and browser push services, to deliver job offers and messages to drivers’ devices.
• Flight information providers: to look up flight details where a booking includes a flight number.
• Technical support and security providers: where necessary to maintain, diagnose or secure the Service.
• Payment providers: if payment-processing functionality is introduced.
• Professional advisers and authorities: where disclosure is necessary for legal compliance, legal claims or other lawful purposes.

Providers that process personal data on behalf of OneTaxi or a firm are subject to contractual obligations and safeguards, and their permissions are limited to the processing they are authorised to perform.

Some providers may act as independent controllers for particular activities under their own privacy arrangements. Information about our main providers is available on request.

We may also disclose personal data where required by law or where necessary to protect rights, safety, the Service or the interests of affected individuals, subject to applicable legal requirements.

9. Cookies and Similar Technologies

OneTaxi’s website and applications do not set cookies. The applications use your browser’s local storage to keep you signed in and to remember your settings, such as the light or dark theme. The driver application also uses it to keep the current job and any job updates waiting to be sent.

Our website analytics, which we run ourselves, measures page visits and where visitors came from. For a sample of visits it also records how visitors interact with a page, such as clicks, scrolling and pointer movement, as heatmaps and session recordings that help us improve the site. It does not use cookies or store information on your device.

We do not use advertising cookies or cross-site advertising trackers.

Where a technology requires consent under applicable law, we will obtain consent before using it.

10. Lawful Bases for Processing

Where the UK GDPR or EU GDPR applies, OneTaxi must have an appropriate lawful basis for each processing purpose. The relevant basis depends on the processing activity and the role OneTaxi performs.

10.1 Contractual necessity

We may rely on contractual necessity where processing is objectively necessary to enter into or perform a contract with the relevant individual.

This basis does not automatically apply to every passenger, driver or customer whose information a firm supplies. A firm may instead rely on its own lawful basis for operational processing.

10.2 Legitimate interests

We may rely on legitimate interests where appropriate, for purposes such as maintaining security, preventing abuse, managing business enquiries, understanding how our website is used and protecting our legal rights, provided those interests are not overridden by the individual’s rights and interests.

10.3 Legal obligations

We may process information where necessary to comply with a legal obligation that applies to us. A firm’s legal obligations may separately support its own processing activities.

10.4 Consent

Where consent is the appropriate lawful basis or is required under applicable electronic communications or other privacy laws, we will request it separately and explain how it can be withdrawn.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. It also does not prevent processing that can lawfully continue on another applicable basis.

10.5 Other applicable bases

Where necessary and legally appropriate, other lawful bases may apply to particular processing activities. These will be assessed and explained where relevant rather than assuming that one basis applies to all personal data.

11. Your Data Protection Rights

Depending on your location, the applicable law and the circumstances of the processing, you may have the right to:

• Access: request a copy of your personal data.
• Rectification: request correction of inaccurate or incomplete information.
• Erasure: request deletion where the legal conditions are met.
• Restriction: request that certain processing be restricted.
• Objection: object to processing based on legitimate interests or to other processing where a right to object applies.
• Data portability: receive certain personal data in a structured, commonly used, machine-readable format, where the legal conditions are met.
• Withdraw consent: withdraw consent where processing is based on consent.
• Complain: lodge a complaint with the relevant supervisory authority.

These rights are not absolute in every circumstance. For example, some information may need to be retained to comply with law, protect the rights of others or establish, exercise or defend legal claims.

11.1 How to exercise your rights

If your request relates to bookings, driver records, passenger information or other operational data managed by a taxi or private-hire firm, contact that firm first. Drivers can also ask their firm to delete their account.

OneTaxi will assist the firm with relevant requests in accordance with our contractual and legal obligations. If OneTaxi acts as an independent controller for the information concerned, or you cannot reach the firm, contact us at .

We may need to verify your identity or request further information to understand your request. We will respond within the period required by applicable law.

You may also complain to the Information Commissioner’s Office in the United Kingdom at ico.org.uk or, where applicable, your local European data protection authority.

12. UK and European Data Protection Provisions

12.1 Territorial scope

The UK GDPR and Data Protection Act 2018 apply where their territorial and substantive requirements are met. The EU GDPR may apply where its territorial requirements are met.

The relevant rights and obligations depend on the law applicable to the processing in question.

12.2 Controller and processor responsibilities

Where a firm is the controller and OneTaxi is its processor, the firm determines the purposes and essential instructions for operational processing. OneTaxi processes the data in accordance with those instructions and the applicable data processing agreement, except where law requires otherwise.

Our processor obligations include appropriate confidentiality and security measures, restrictions on unauthorised use, appropriate controls over subprocessors, assistance with applicable rights requests and security incidents, and end-of-contract data return or deletion, subject to legal requirements.

OneTaxi remains responsible for complying with the data protection obligations that apply to processing for which it is itself the controller.

12.3 International data transfers

Personal data may be transferred to or accessed from countries outside the United Kingdom or the European Economic Area where this is necessary for the Service or its supporting providers.

Where a restricted international transfer occurs, we will rely on an applicable legal transfer mechanism, such as an adequacy decision or approved contractual safeguards, and implement any additional measures required by applicable law.

Further information about relevant transfer mechanisms and safeguards is available on request, subject to applicable legal restrictions.

12.4 Complaints and supervisory authorities

UK individuals may complain to the Information Commissioner’s Office. Individuals in the EEA may complain to the supervisory authority competent for their circumstances.

We encourage individuals to contact us or the relevant firm first where appropriate, but doing so does not remove their right to complain to a supervisory authority.

13. Children’s Personal Data

OneTaxi is a business-to-business service designed for taxi and private-hire operations. Office and driver accounts are intended for authorised business users.

Passengers may include children, including children travelling on school runs or other prearranged journeys. Their booking information may be processed by the relevant firm to arrange and manage those journeys.

The firm is responsible for establishing an appropriate lawful basis, providing required privacy information and complying with any additional requirements that apply to children’s data.

OneTaxi does not intentionally collect children’s personal data for its own unrelated purposes. If we identify personal data that has been collected inappropriately, we will assess the circumstances and take appropriate steps, including deletion where lawful and appropriate.

14. Data Security

We use technical and organisational measures appropriate to the risks associated with the personal data we process. Depending on the system and its configuration, these measures may include:

• Access controls and permissions based on user roles.
• Secure password storage and authentication tokens that expire.
• Encryption in transit.
• Separation of firms’ data and controls designed to prevent unauthorised cross-firm access.
• Rate limits and other protections against abusive requests.
• Audit logging and security monitoring.
• Restricted access to production systems and operational records.
• Backup and recovery arrangements.
• Security testing, maintenance and vulnerability remediation.

The precise measures in place depend on the component and the type of data concerned. We do not disclose sensitive technical details that could compromise system security.

No system can be guaranteed completely secure. If a personal data breach occurs, we will assess and respond to it in accordance with applicable legal and contractual requirements, including any required notifications to affected firms, individuals or supervisory authorities.

15. Changes to This Policy

We may update this Policy to reflect changes in the Service, our processing activities, applicable law or our security arrangements.

We will publish the updated Policy with a revised date. Where a change is material, we will provide appropriate notice to affected firms or users, for example by email or through the Service, and give advance notice where appropriate.

Where a change requires consent or another specific legal step, we will obtain it or take that step before commencing the relevant processing.

The publication of an updated Policy does not, by itself, make previously unlawful processing lawful or replace any consent required by law.

16. Contact Us

For questions about this Privacy Policy, OneTaxi’s processing of personal data, or requests relating to data for which OneTaxi acts as controller, contact:

• Email:

If your enquiry concerns booking, passenger or driver data controlled by a taxi or private-hire firm, please contact that firm first. OneTaxi will assist the firm where required by our agreement and applicable law.