The new Passenger app utilises a number of Anti-Fraud measures, including, but not limited to Biometrics (in the case of Apple and Google Pay) and 3dSecure.

These processes use Strong Customer Authentication – an initiative being rolled out by the Financial Conduct Authority – all banks need to sign up to use Strong Customer Authentication by September 2021, although most (including Stripe, who we use to process card transactions through the app) have already completed the work required.

Where most online payments, protected by Strong Customer Authentication are paid at the point of sale (consider amazon purchases for example), taxi journeys are not paid for in advance. Because of this, we need to initiate a pre-authorisation so that the requirements of SCA can be fulfilled. The pre-authorisation action forces the bank to consider the use of 3dSecure to verify the transaction.

Without this step, 3dSecure would not be used, which could lead to an increase in card fraud. Second to this, the pre-authorisation amount taken ensures that customers have the funds available in advance of the journey. In the same way that a Hotel or Car Rental company will ‘hold’ a certain amount on your card when you use their services, we do the same via the Passenger App. The actual amount of the pre-authorisation is the Estimated Fare + 20%.

The pre-authorisation amount is more than the estimated journey amount because the fare quoted is just that – an estimate. The fare in-vehicle may exceed the estimated amount, or the passenger may choose to go via a different point, or change their destination altogether.

By taking an additional amount ensures that in most cases, the actual fare will fall within the pre-authorised amount. Where this happens, any amount over the actual fare will be released at the end of the journey. Please note that banks can take up to 5 working days to release a ‘pre-authorisation’ hold on funds.

In the case where a fare is in excess of the pre-authorised amount, the full fare needs to be requested from the bank – we cannot use the pre-authorised amount and then take an additional amount – this would lead to multiple transactions which banks will invariably decline. In this case, the passenger must ensure they have sufficient funds to cover both the pre-authorisation amount AND the fare. Confusion can be caused if the customer does not have the funds available for both of these, hence the reason for taking the additional 20% at the time of booking.

The occurrences of bookings more than 20% higher than the estimated fare are rarer, so this should cause minimal authorisation issues.

When a pre-authorisation is taken, any unused element will be released either (1) at the end of the journey, or (2) if a booking is cancelled by the office or passenger (or is marked as a No Pickup by the driver). It is important to note that banks will take up to 5 working days to release the pre-authorisation hold. The length of time is at the discretion of the bank and is not something that we can influence.

Waiting time is charged at 25p per minute and is chargeable only when vehicle is stationary during journey. This is calculated automatically and added to the fare.

We are continually monitoring our service levels and doing all we can to improve our collection times.

We, Penny Cars (“we” “our” or “us”) with our registered office address at Bo’Ness Road, Chapelhall, Airdrie, Ml6 8RR are fully committed to respecting your privacy and to protecting any information you provide to us. We treat both privacy and security as a priority and make every effort to ensure that all the information provided by you is protected. This Data Protection Notice (the “Notice”) exists to respect and protect the privacy of all users of the services provided by us (the “Services”) and is intended to inform you about the way that we treat your personal data.

Scope of Notice

This Notice applies in relation to the provision of the Services and in particular to your use of, or engagement with, any or all of the following (as applicable):

the Penny Cars software application (the “App”);

the Penny Cars website (the “Website”); and

any other communications (whether over telephone, email, SMS message or otherwise) between you and Penny Cars in connection with the provision of the Services.

This Notice sets out the basis on which any personal data we collect from you or that you provide to us, in connection with your use of the Services (“Personal Data”), will be processed by us or our third-party service providers. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of the EU General Data Protection Regulation (the “GDPR”), the controller of your Personal Data is as follows:

to the extent that your personal data is collected by Penny Cars and in connection exclusively with the provision of the Services, Penny Cars shall be the controller of your Personal Data; and

to the extent certain categories of your personal data are shared with Coolnagour Limited t/a iCabbi (“iCabbi”) for purposes outside the scope of the provision of the Services, iCabbi shall be the controller of your personal data (where iCabbi is an independent controller-in-common with Penny Cars). iCabbi is a third-party service provider with whom we engage in connection with the provision of the Services and who from time to time may use your Personal Data for the purposes set out in Section 4 of this Notice.

For the avoidance of doubt, where your Personal Data is processed in connection with the provision of the Services, Penny Cars is the controller and iCabbi is a processor. Where Penny Cars and iCabbi process your personal data otherwise than in connection with the provision of the services, Penny Cars and iCabbi are independent controllers-in-common of your Personal Data.

Your Personal Data Collected and Processed

IMPORTANT: Please note that the below list of Personal Data, while intended to be as complete and accurate as reasonably possible, is not exhaustive and may be updated from time to time in accordance with Section 12 of this Notice.

We may collect and process the following Personal Data about you (as applicable):

Data Collected

Data Source(s)

Information you provide

[You provide us with information when you engage with us to use the Services, create an account with us (either through our App, Website or by contacting us through other means), download or install the App, and when you report a problem with the Services, App or Website or when you correspond with us generally in connection with your use of the Services.

The information you provide to us may include but is not limited to your name, address, e-mail address, address, phone number, age, date of birth, username, password and other registration information, financial and credit card information, [photograph] and gender.

We may collect demographic information about you, including through user surveys.]

App,

Website,

Other Communications

Device Information

[Technical information including but not limited to the type of device you use, a unique device identifier (for example, network information, your operating system, time zone setting and device locale)]

App,

Website

Log Information

[Details of your use of the Services including, but not limited to weblogs and/or other communication data and the resources that you access]

App,

Website

Location Information

[Depending on how you choose to use the Services (that is, whether through use of our App, Website or by contacting us through other means), we may collect details of your location data to determine your current location.]

App,

Website

Information we receive from other sources

[We work with third parties (including, for example, service providers) and may receive certain information from them about you that they choose to disclose with us. This information may include your name, email, address and location.]

Other Communications

Transaction Information

[We may collect transaction details related to your use of the Services, including the type of services you requested, your order details, delivery information, date and time the service was provided, amount charged, distance travelled, and payment method. We may also record details as to whether or not a taxi journey is cancelled by you.]

App,

Website,

Other

Communications

Usage Information

[We collect information about how you interact with the Services. This includes information such as access dates and times, App features or pages viewed, App crashes and other system activity, type of browser, and third-party sites or service you were using before interacting with the Services.]

App,

Website,

Other

Communications

Penny Cars Legal Bases and Purposes

We, Penny Cars, in our capacity as controller, use the information held about you on the following lawful bases and for the following purposes:

Legal Basis

Necessary for the Performance of a Contract

Purposes

It is necessary to process your Personal Data to enter into and perform our contract with you in relation to your use of the Services. We will process your Personal Data for the following purposes:

[To create and maintain your account and profile, and, to facilitate your use of the Services.

To help you efficiently access your information after you sign into your App or Website account.

In the case of phone calls to

Penny Cars, to facilitate the Services by communicating to drivers your name, number, location and destination.

To enable and facilitate transportation from your location to your destination.

To process or facilitate payments for the Services.

To track the progress of your journey.

To remember information so you will not have to re-enter it repeatedly when you use the Services.

To facilitate the provision of App or Website support, pop-up notifications and other services.

To improve the features and functionality of the App or Website to enhance your experience.

If you do not wish to provide us with your personal data for these purposes, we will not be able to enter into or perform our contract with you and you will not be able to use the Services.

Legal Basis

To Comply With a Legal Obligation

Purposes

We may process your Personal Data as necessary in order for us:

To comply with applicable Irish and European Union laws.

To comply with requests from regulators, government entities and official inquiries.

Legal Basis

Legitimate Interests

Purposes

It is in Penny Cars legitimate interests to collect and process the Personal Data for the following purposes:

To prevent against the corruption and/or loss of your Personal Data, to ensure the security of our systems and to carry our regular testing to ensure the smooth maintenance of our systems.

You have the right to object at any time to the processing of your personal data carried out on this basis.

When we process your personal data based on our legitimate interests, we make sure to consider and balance any potential impact on you and your data protection rights. We will not process your personal data for activities where our interests are overridden by the impact on you.

iCabbi Legal Bases and Purposes

iCabbi, in its capacity as controller (where iCabbi is an independent controller-in-common with Penny Cars), uses the information held about you on the following lawful bases and for the following purposes:

Legal Basis

Legitimate Interests

Purposes

It is in iCabbi’s legitimate interests to collect and process the personal data for the following purposes:

To facilitate the Services being provided to you through utilisation of iCabbi software.

To protect the rights, property or safety of you, or others (this includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction).

“Every booking using “the App” has a cost of 50p technology fee, which covers this cost of our investment in technology and services to ensure we continue to deliver excellent services”

To monitor metrics such as total number of visitors, traffic and demographic patterns.

To prevent, detect and combat fraud in connection with the use of the Services. For example, iCabbi uses user profile, location, device and usage information, to identify and prevent circumstances when users attempt to defraud other users.

To carry out analysis and research on usage trends & traffic. This includes, for example, predicting demand and trends, to improve the user experience, and to enhance the safety and security of the Services.

You have the right to object at any time to the processing of your personal data carried out on this basis.

When iCabbi processes your personal data based on legitimate interests, it makes sure to consider and balance any potential impact on you and your data protection rights. iCabbi will not process your personal data for activities where its interests are overridden by the impact on you.

Legal Basis

To Comply with a Legal Obligation

Purposes

iCabbi may process your Personal Data as necessary in order for it:

To comply with applicable Irish and European Union laws.

To comply with requests from regulators, government entities and official inquiries.

Disclosure of Your Information to Third Parties

Disclosure to Third Parties by Penny Cars

We, Penny Cars, may disclose some or all of the data we collect from you in connection with your use of the Services to the following third parties:

Recipient

Service Providers: Service providers who may use this information to assist with the provision and improvement of the Services. In particular, we will share your personal data with iCabbi who provides software support services to us in order to facilitate the provision of the Services to you.

[Advertisers: We may provide advertisers with anonymous (not individual) aggregate information about our users. We may also use such aggregate information to help advertisers reach the kind of audience they want to target. We do not disclose information about identifiable individuals to our advertisers.]

[Penny Cars Group: We may disclose your personal information to other members of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries.]

Law Enforcement Agencies: We may disclose your information if we are under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request.

[Buyers and Sellers of Business Assets: If Penny Cars or substantially all of its assets are acquired by a third party, personal data held by it about its customers will be one of the transferred assets.]

Disclosure to Third Parties by iCabbi

Where iCabbi acts as a controller of your Personal Data (where iCabbi is an independent controller-in-common with Penny Cars), iCabbi may disclose some or all of the Personal Data it holds about you to the following third parties:

Recipient

Law Enforcement Agencies: iCabbi may disclose your information if it is under a duty to disclose or share your personal data in order to comply with any legal or regulatory obligation or request.

Buyers and Sellers of Business Assets: If iCabbi or substantially all of its assets are acquired by a third party, personal data held by it about its customers will be one of the transferred assets.

iCabbi Group: iCabbi may disclose your personal information to other members of its group, which means its subsidiaries, its ultimate holding company and its subsidiaries.

Links to Third Party Websites

The App or Website may contain links to and from the websites of our partner networks, advertisers and service providers. If you follow a link to any of these websites, please note that these websites and any services that may be accessible through them have their own data protection notices and that we do not accept any responsibility or liability for these notices or for any Personal Data that may be collected through these websites or services, such as contact and location data. Please check these notices before you submit any personal data to these websites or use any such third party services.]

iCabbi Use of Statistical Information

iCabbi may log certain information concerning your use of the App or Website in relation to activities connected with the use the Services. This information is logged for the purpose of providing the Services. The information gathered is then aggregated and anonymised.

From the anonymised information collected, statistics may be compiled in the form of percentages and/or figures relating to users’ interaction with the Services. As a service, certain anonymised statistical information may be supplied to third parties in order to help them understand the likes, dislikes, trends, habits and behaviour of Service users.

Storing and Transfers of Your Personal Data

The Personal Data collected from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed by staff or contractors operating outside the EEA who work for us or for one of our suppliers.

Your Personal Data is only transferred outside the EEA where the EU Commission has decided that the third country in question ensures an adequate level of protection in line with EU data protection standards OR there are appropriate safeguards in place to protect your personal data.

All information you provide to us is stored on our secure servers or the servers of our service providers, contractors or suppliers. Where we have given you (or where you have chosen) a password that enables you to access the App or Website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

How Long We Keep Your Personal Data For

Penny Cars will keep your Personal Data for as long as you use the App or Website and for a period of 7 years after you delete your account.]

iCabbi will keep your Personal Data for as long as you use the App or Website and after you delete your account for a reasonable period not exceeding 7 years.

Please note that in certain circumstances, we may hold your Personal Data for a longer period, for example, if we are processing an ongoing claim or believe in good faith that the law or a relevant regulator may reasonably in our view expect or require us to preserve your data.

Your Rights & How to Exercise Them

You have a number of rights in relation to your Personal Data which are set out in this Section 10. In particular these rights include the right to object to processing of your personal data where that processing is carried out for our legitimate interests. Note that in certain circumstances, these rights might not be absolute.

Right

Further Information

Right to be Informed

You have the right to know whether your personal data is being processed by us, how we use your personal data and your rights in relation to your personal data.

Right of Access

You have the right to request a copy of the personal data held by us about you.

We will only charge you for making such an access request where we feel your request is unjustified or excessive.

You may also access your personal data by logging into your account on the App or Website and viewing your profile.

Right to Rectification

You have the right to request that we amend any inaccurate personal data that we have about you.

Right to Erasure

You have the right to ask us to erase your personal data where:

it is no longer necessary to perform the contract

you withdraw your consent and there is no other legal basis permitting us to process your personal data

you object to the processing and we have no overriding legitimate grounds

your personal data have been unlawfully processed; or

it must be erased to comply with a legal obligation.

Please note that some of your personal data may be required in order for the App to function properly.

Right to Restriction of Processing

You have the right to ask us to restrict processing your personal data in the following situations:

where you contest the accuracy of your personal data

where the processing is unlawful and you do not want us to delete your personal data

where we no longer need your personal data for the purposes of processing but you require the data in relation to a legal claim

where you have objected to us processing your personal data pending the verification as to whether or not our legitimate interests override your interests or in connection with legal proceedings.

When you exercise this right we may only store your personal data.

We may not further process the data unless you consent or the processing is necessary in relation to a legal claim or to protect the rights of another person or legal person or for reasons of important public interest.

Please note that it be may necessary for us to process some of your personal data in order to provide the App or Website and in certain instances where you ask us not to process your personal data you may not be able to use the App or Website.

We will inform you before the processing restriction is lifted.

Right to Data Portability

You may request us to provide you with your personal data which you have given us in a structured, commonly used and machine-readable format and you may request us to transmit your personal data directly to another data controller where this is technically feasible.

This right only arises where:

we process your personal data on the legal bases of your consent or where it is necessary to perform our contract with you; and

the processing is carried out by automated means.

Right to Object

You have a right to object at any time to the processing of your personal data where we process your personal data on the legal basis of pursuing our legitimate interests.

Right to Object to Automated Decision Making, including Profiling

You have a right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

We may not be able to comply with this request where the processing is necessary to enter or perform our contract with you or where you explicitly consent to this. However, you are entitled to have a person from our team to review the decision so that you can query it and set out your point of view to us.

You can exercise any of these rights by submitting a request in writing to [email protected]. If you wish to submit a request to iCabbi, please submit a request in writing to [email protected]

You also have the right to lodge a complaint with the Data Protection Commission with regards to the processing of your personal data by us. For further information see www.dataprotection.ie .

[Age Restriction

Individuals under the age of 18 are not eligible to use the Services and must not attempt to register and/or submit any personal information to us. We do not knowingly collect personal information from any person who is under the age of 18 or allow them to register. If it comes to our attention that we have collected personal data from a person under the age of 18, we will delete this information as soon as reasonably possible. If you have reason to believe that this has occurred, please contact us at [email protected].

Changes to the Data Protection Notice

[Any material changes we may make to the Notice in the future will be notified to you by e-mail or pop-up notification when you next start the App or visit the Website.] The new Notice may be displayed on-screen and you may be required to read and accept them to continue your use of the App or the Website.

Questions Regarding This Notice

Questions, comments and requests regarding this Notice are welcomed and should be addressed to [email protected].

If you have a comment, request or question regarding iCabbi’s processing of your personal data, please contact [email protected]

remedies

If a Resolution is not provided within the relevant Service Level response time, the Customer may escalate the Support Request to the parties’ respective relationship managers and then to their respective senior management.

Communications

In addition to the mechanisms for giving notice specified in clause 23.3 of the Conditions, the parties may communicate in respect of any matter referred to in this by e-mail (unless specified otherwise).