Legal
Privacy Policy
Last updated: 7 September 2026 · Applies to the PingCab rider app, the PingCab Pro driver app, the PingCab firm portal (firm.ping-cab.com) and this website.
1. Who we are
PingCab is a technology platform connecting Riders with independent taxi businesses using licensed hackney carriages and Drivers in North Wales. It is operated by Ashwrk Ltd (company number 17258873), 14–16 Stanley Street, Holyhead, Anglesey LL65 1HG, United Kingdom ("we", "us"), which is the controller for the personal data for which PingCab determines the purposes and means of processing. Data protection contact: privacy@ping-cab.com.
Taxi Firms on PingCab are independent businesses. When a Firm receives and uses Rider data to perform a booking, manage safety or complaints, or meet its own legal and licensing duties, it acts as a separate controller for those purposes. For certain Firm-only Portal functions, PingCab may instead process data on the Firm's behalf as described in the Terms. This policy explains PingCab's own processing as controller.
2. What we collect and why
Riders (PingCab app)
| Data | Why | Legal basis (UK GDPR Art. 6) |
|---|---|---|
| Name, phone number, email address | Your account; so the firm and driver fulfilling your ride know who they're picking up and can contact you | Contract |
| Device location while using the app | Setting your pickup point and showing nearby availability. This is optional — you can type an address instead. | Consent (device permission; you can withdraw it in your device settings) |
| Pickup and drop-off addresses, routes, ride times and states | Arranging and running your ride; your ride history and receipts | Contract |
| Payment data: Stripe customer and payment-method references or tokens, amounts, refunds, chargebacks and payment outcomes | Charging the Fare and connection fee, handling refunds or payment disputes, and keeping necessary transaction records. Full card numbers are held by Stripe or your wallet provider, not by us. | Contract; legal obligation (financial records) |
| Camera (optional — card scan) | Only if you choose to scan a card when adding a payment method: Stripe's SDK reads the card using your device camera. We do not receive or store the camera image. | Consent (your optional use of the device camera) |
| In-app chat messages with your driver | Ride coordination; safety and dispute records | Contract; legitimate interests (safety) |
| Ratings you give and receive | Marketplace quality and safety | Legitimate interests |
| Device push token | Ride status notifications | Contract |
| Support requests, complaints, safety reports, emergency actions and trusted-contact details | Providing support; investigating complaints and safety incidents; enabling ride-sharing or an emergency alert to a trusted contact you nominate; preventing misuse; and establishing or defending legal claims | Contract; legitimate interests (support, safety, fraud prevention and legal claims); vital interests where necessary in a genuine emergency |
Drivers (PingCab Pro app)
| Data | Why | Legal basis |
|---|---|---|
| Name, phone number, email | Your account, shown to passengers and your firm | Contract |
| Driving licence and taxi driver's licence (badge) images, expiry dates | Verification and approval by your Firm and, where applicable, PingCab eligibility checks before you can receive booking offers | Contract; legitimate interests (platform safety and licensing assurance); where data is processed solely on behalf of a Firm, that Firm determines its own lawful basis |
| Vehicle assignment | Matching offers to vehicle class; shown to passengers | Contract; legitimate interests (service operation) |
| Live location while online — including in the background | Your Firm's live fleet map and dispatch; sending eligible booking offers; and, during a ride, live tracking for your Rider. We keep the current position used for these features and do not intentionally build a continuous movement history while you are offline. | Contract; legitimate interests (dispatch and safety) |
| Job history and earnings summaries | Your earnings screens; your firm's records | Contract; legitimate interests; legal obligation where applicable to the Firm |
| Chat messages, ratings, push token | As for riders | Contract / legitimate interests |
Firm owners and managers (Portal)
| Data | Why | Legal basis |
|---|---|---|
| Your name, email and phone; the Firm's trading and legal names, Companies House and VAT numbers, depot address, licensing authority and relevant vehicle, Driver or operator-licence details where applicable | Registering and administering the Firm account; eligibility and licensing checks; invoices; support; and identifying the business responsible for bookings | Contract (where you are the contracting business owner or sole trader); legitimate interests (account administration, verification and fraud prevention); legal obligation where applicable |
| Vehicle, Driver, insurance and other licensing or compliance documents you upload | Providing the compliance vault and supporting the Firm's licensing and platform-eligibility checks | Contract; legitimate interests (platform eligibility and safety); where processed solely for a Firm, the Firm determines its lawful basis |
| Stripe account and billing references, subscription status | Fare payouts and subscription billing | Contract; legitimate interests (billing administration); legal obligation where applicable |
We do not ask for special-category data as a standard account requirement. However, accessibility requests, support or safety messages may reveal health or disability information, and complaints or reports may contain other sensitive information or allegations of criminal conduct. We process such information only where necessary and where an additional condition under the UK GDPR and Data Protection Act 2018 applies, for example explicit consent for an optional accessibility request, vital interests in an emergency, or the establishment, exercise or defence of legal claims; criminal-offence data is processed only where authorised by law. We do not use solely automated decision-making that produces legal or similarly significant effects. Booking broadcasts use objective eligibility criteria such as online status, approval, vehicle class and active platform access; they are not used to profile individuals for such decisions.
3. Where data comes from
Most information comes from you directly. Location comes from your device when you enable the relevant permission. Payment outcomes come from Stripe or your wallet provider. If you use Sign in with Apple or Google, we receive the authentication details those services provide to us. Driver approval decisions come from the Driver's Firm. If you are a trusted contact, your contact details are provided by the Rider who nominated you.
4. Who we share data with
- The firm and driver fulfilling a ride — a rider's name, pickup and drop-off, and a contact route (in-app chat, and phone number where used for the booking). Drivers' names, vehicle and plate are shared with the rider. This is the core of the service.
- Your firm (drivers) — your documents, status, live position while online, and job history.
- Trusted contacts and people with whom you share a ride — if a Rider chooses the Share or Emergency feature, we may send the nominated person a live-trip link, alert and limited journey information needed for that feature. We do not use trusted-contact details for marketing.
- Service providers and technology partners that run parts of the service. Depending on the activity, they act as processors under our instructions or as independent controllers for their own regulated, security or account-management purposes:
- Supabase — database, authentication and file storage (our primary service data is configured to be hosted in AWS eu-west-1 (Dublin, Ireland), in the EEA)
- Stripe — payments, payouts and subscription billing (Stripe also acts as an independent controller for its regulated payment activities)
- Google Maps Platform — address search and routing
- Apple and Google — optional sign-in and authentication services (each acts as an independent controller for its own sign-in service)
- Twilio — SMS verification codes at sign-in
- Expo — push notification delivery
- Vercel — hosting for this website and the firm portal
- Resend — transactional email delivery, including Firm onboarding and approval emails
- Sentry — crash and error diagnostics from the apps, so that a fault can be found and fixed (reports are sent to Sentry’s EU region and stored in Germany). Reports carry diagnostic information such as the error, the app version and the device model. They are stripped of names, contact details, addresses, locations and payment details before they leave your device
- Authorities — we may share data where the law requires or permits it: with licensing authorities investigating a firm or driver, with the police in connection with crime or safety, or to establish or defend legal claims.
- A buyer or successor of the business, under confidentiality, if Ashwrk Ltd is ever sold or restructured — your rights under this policy would continue.
- We never sell personal data and never share it for advertising.
5. International transfers
Our primary database and files are configured to be stored in Ireland (EEA), using Supabase on AWS eu-west-1 (Dublin). Transfers of personal data from the UK to Ireland are covered by the UK's adequacy regulations for the EEA. Some service providers, including Stripe, Google, Apple, Twilio, Expo, Vercel, Resend and Sentry, may process limited personal data in the United States or other countries. Where a restricted transfer from the UK occurs, we use an appropriate UK transfer mechanism, such as UK adequacy regulations (including the UK–US Data Bridge where applicable), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with any transfer-risk assessment required by law.
6. Location data, in plain words
- Riders: device location is used when you enable it to set your pickup point and support ride features. You can refuse or withdraw the device permission and still book by typing addresses, although some location-based features may then be unavailable.
- Drivers: while you set yourself online, PingCab Pro sends your position — including when the app is in the background or your screen is locked — so your Firm's live fleet map works and eligible booking offers can reach you. During a ride, your position is also streamed to the Rider. Going offline stops the live feed. We retain only the current or recent position needed to operate these features and do not intentionally build an offline movement history. Your Firm may have separate data-protection and employment-law obligations concerning its use of live fleet location.
- Location permissions can be changed at any time in your device settings.
7. Cookies & analytics
This website uses Google Analytics 4 (provided by Google Ireland Ltd) to understand how visitors use the site and to improve it. Google Analytics is only loaded if you choose Accept on the cookie banner. If you choose Reject or make no choice, the analytics code is not loaded at all: nothing is sent to Google and no analytics cookies are set. IP addresses are anonymised. You can change your choice at any time using the Cookie choices link in the footer; if you withdraw consent, analytics stops and the analytics cookies are deleted. Google’s own privacy notice is at policies.google.com/privacy. The website uses no advertising trackers. The Firm Portal and apps use device storage, identifiers and similar technologies that are strictly necessary for authentication, security, session management and push notifications. Under the Privacy and Electronic Communications Regulations, we will ask for consent before using non-essential cookies or similar storage where consent is required.
Sponsored content: local businesses can pay for clearly labelled sponsored placements in the rider app (for example, sponsored map pins in the Explore section). These are shown to everyone in the area — we do not use your personal data to choose or target them. For signed-in Riders, we record views against your account solely to limit how often you see a placement and to measure its performance. Sponsors receive aggregate counts only, and no personal data is shared with them. We rely on our legitimate interests in managing sponsored placements and measuring their performance for this processing.
8. How long we keep data
| Data | Retention |
|---|---|
| Account details | While your account is active; on deletion we close the profile and delete or anonymise account data unless limited information must be retained for a legal obligation, dispute, fraud-prevention or other lawful purpose |
| Ride and payment records | Up to 6 years after the transaction where necessary for tax or accounting obligations, contractual claims, payment disputes, fraud prevention or applicable licensing requirements; data not needed for those purposes is deleted or anonymised sooner where practicable |
| Chat messages | 12 months, unless a longer period is needed for an unresolved complaint, safety investigation, legal claim or legal obligation |
| Driver live position | Current position only — continuously overwritten while online; goes stale within minutes of going offline |
| Driver compliance documents | While the Driver is active with a Firm, plus 12 months, unless a longer period is reasonably required for a licensing matter, dispute or legal claim |
| Firm compliance documents | While the Firm is registered, plus 12 months, unless a longer period is reasonably required for a licensing matter, dispute or legal claim |
| Support and complaint records | 2 years from resolution, or longer where reasonably necessary for a continuing legal claim, regulatory enquiry or safeguarding matter |
| Push tokens | Until sign-out, deletion, or the token is invalidated by your device |
Trusted-contact details are kept until the Rider removes them or deletes the account, unless a short additional period is needed for a safety incident or legal claim. Live-trip sharing links are intended to expire or stop updating after the relevant journey or shortly afterwards.
Sponsored-placement view records are kept only for as long as needed to limit display frequency and measure the relevant placement or campaign, after which they are deleted or anonymised, unless a longer period is required for a legal claim or legal obligation.
9. Security
We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls and private storage for compliance documents. Access to platform data is restricted according to user role. Full card numbers are handled by Stripe or the relevant wallet provider rather than stored in PingCab's systems. No internet service can guarantee absolute security. If a personal-data breach occurs, we will assess it promptly, notify the ICO within the period required by law where the breach is likely to result in a risk to individuals, and notify affected individuals where the law requires us to do so.
10. Your rights
Under the UK GDPR you may have rights to access your personal data, correct inaccurate data, erase data, receive or transfer certain data, restrict processing, object to processing based on legitimate interests, and withdraw consent where consent is the lawful basis. These rights are not absolute and legal exemptions or retention duties may apply. You can delete your account in the app (Profile → Delete account); how to delete your account explains the steps, what is deleted and what is kept. Deleting your account does not require us to erase information that we must or are lawfully entitled to retain. For a rights request, email privacy@ping-cab.com. We may need to verify your identity and will normally respond within one month; for complex or multiple requests the law may allow an extension. You can also complain to the Information Commissioner's Office (ICO), including through ico.org.uk or on 0303 123 1113, although we would welcome the opportunity to address your concern first.
You can also use privacy@ping-cab.com to make a complaint about how we have handled your personal data. We will acknowledge a data protection complaint within 30 days, investigate it without undue delay, keep you informed where appropriate, and let you know the outcome.
11. Children
PingCab Rider accounts are intended for people aged 18 or over and we do not knowingly create Rider accounts for anyone under 18. A child may travel as a passenger where permitted by law and the relevant Firm's policies, but the booking must be made by an eligible account holder. If you believe a person under 18 has created an account, contact us so that we can investigate and take appropriate action.
12. Changes to this policy
We'll post changes here with an updated date, and for significant changes we'll notify you in the app or portal before they take effect.
13. Contact
Ashwrk Ltd, 14–16 Stanley Street, Holyhead, Anglesey LL65 1HG · privacy@ping-cab.com
See also: Terms and Conditions · Taxi firm provisions