Data Protection & GDPR Statement

1. Controller details and accountability

Executive Chauffeurs UK is the data controller for the personal data it processes in running the chauffeur service. We are registered in the United Kingdom and operate across England, Scotland, Wales and Northern Ireland.

Where registration with the Information Commissioner's Office is required for our processing, we maintain that registration, pay the data protection fee and keep the entry current. Within the business, that responsibility is held at board level by the director responsible for data protection.

Enquiries about data protection, including a request to exercise a right, reach that role through the WhatsApp client service desk on +44 7775 554848 and the contact page at executive-chauffeurs.uk/contact. The desk is instructed to pass anything concerning personal data straight through rather than answering it itself, and to record the date it was received so that the statutory clock runs from the right point.

We have assessed whether a statutory Data Protection Officer is required and have recorded that assessment. Where the requirement does not apply, responsibility remains with the director responsible for data protection rather than being left unallocated.

Corporate clients carrying out supplier due diligence can ask for a written summary of the categories of data we hold, the retention periods we apply and the security measures described below, together with the standard processing terms we use with partner operators. Requests of that kind are answered within five working days.

2. Principles we work to

• —Lawfulness, fairness and transparency: every processing activity has an identified lawful basis, recorded before processing begins.
• —Purpose limitation: data collected to carry out a journey is not repurposed for something unrelated without a new basis.
• —Data minimisation: chauffeurs receive the detail needed to complete the journey and nothing more.
• —Accuracy: booking records are checked at confirmation and corrected promptly when an error is reported.
• —Storage limitation: retention periods are defined by category and applied rather than left to habit.
• —Integrity and confidentiality: access is restricted, devices are secured, and transfers use encrypted channels.
• —Accountability: decisions, assessments and incidents are documented so that compliance can be demonstrated.

3. Records of processing

We maintain a record of processing activities covering each category of data we hold, the purpose, the lawful basis, the recipients, the retention period and the security measures applied. It is reviewed at least annually and whenever a new system or supplier is introduced.

Where a proposed activity is likely to result in a high risk to individuals, we carry out a Data Protection Impact Assessment before it starts. Vehicle telematics, in-car recording and any expansion of location tracking are treated as triggering that requirement.

New suppliers are assessed before onboarding, covering where data will be held, what security is in place, who else will have access and how the relationship would be ended cleanly.

4. Security measures

Access to booking records is limited to the staff who need it, and each user has an individual account with multi-factor authentication where the system supports it. Shared logins are not used for systems holding passenger data.

Devices used for operational work are encrypted, screen-locked and capable of being wiped remotely. Passenger detail is not stored on personal devices beyond the period of the journey, and printed manifests are destroyed securely once the work is complete.

Data in transit is protected using current transport encryption, and the website is served over HTTPS. Backups are encrypted, held separately from live systems and tested so that a restore is known to work rather than assumed to.

Staff and chauffeurs receive data protection briefing at induction and a refresher at least annually, covering confidentiality, phishing, device security and the rule that journey details are never discussed outside the operational team.

5. Processors and partner operators

Where a third party processes personal data on our behalf, including cloud storage, messaging, accounting and payment services, a written contract is in place meeting the requirements of Article 28 of the UK GDPR. It covers the subject matter, duration, purpose, categories of data, security obligations and deletion at the end of the relationship.

Licensed partner operators used to cover journeys receive only the minimum detail needed for the work and are bound by equivalent confidentiality and security terms. They may not use the data for their own marketing or retain it beyond the period needed for the journey and their own licensing records.

Sub-processors may be used only with our prior authorisation, and we require notice of any proposed change so that we can object where necessary.

6. International transfers

Our preference is to keep personal data in the United Kingdom or the European Economic Area. Where a supplier stores or accesses data elsewhere, the transfer is assessed before it starts.

Transfers rely on UK adequacy regulations where they exist, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, supported by a transfer risk assessment and any additional technical safeguards it identifies.

7. Personal data breaches

Anyone who becomes aware of a suspected breach must report it immediately to the director responsible for data protection, directly or through the client service desk, and without waiting to establish the full facts. Early reporting is treated as good practice, not as an admission of fault.

Breaches are assessed for risk to individuals and, where that risk is more than minimal, reported to the Information Commissioner's Office within seventy-two hours of our becoming aware. Where the risk to individuals is high, we also notify the people affected directly and in plain language.

Every incident, including those not reportable, is logged with the facts, the assessment, the decision and the remedial action, and the log is reviewed by the responsible director.

8. Individual rights

To exercise any right under the UK GDPR, contact the WhatsApp client service desk on +44 7775 554848 and the contact page at executive-chauffeurs.uk/contact. We respond within one calendar month, extendable by two further months for complex or numerous requests, and we will tell you if an extension applies.

We verify identity proportionately before releasing personal data, and we do not charge a fee unless a request is manifestly unfounded or excessive. Where we refuse a request in whole or in part, we explain why and tell you how to challenge it.

You can complain to the Information Commissioner's Office at any time. Raising a complaint with us first is helpful but is not a condition of going to the regulator.