020 3488 7664Book a car
BookAirport transfersBusinessHelp & supportLog inDrive with usDriver appContact 020 3488 7664Book a car

Privacy policy

Last updated October 2026

This policy explains what personal information Cab8 collects when you book a journey, call or message us, use this website, or work with us, and what we do with it. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

In short

  • We use your details to take your booking, send a licensed driver and get you where you are going.
  • The law requires us to keep records of every booking for at least 12 months.
  • Calls to our office are recorded.
  • We never sell your information, and we do not use it for advertising.
  • Card payments are handled by SumUp or Stripe. We never see or store your full card number.

Who we are

Commercial Cars UK LTD, trading as Cab8, is the controller of your personal information. We are a private hire operator licensed by Transport for London (TfL).

  • Company number: 09707773 (registered in England and Wales)
  • Registered office: 281a Barking Road, London E13 8EQ
  • Email: info@commercialcar.co.uk
  • Phone: 020 3488 7664

For any question about your data, email info@commercialcar.co.uk with "Data protection" in the subject line, or write to us at our registered office.

What we collect

When you book or travel with us:

  • your name, mobile number and email address
  • pickup and drop-off addresses, any stops, the date and time, the number of passengers and suitcases
  • flight or train numbers, notes for the driver and any child seats you need
  • the price, how you paid, and the booking's history (who confirmed it, which driver and car took it, and when)

When you call or message us:

  • the number you call from, and the time and length of the call
  • a recording of the call
  • if our automated assistant answers your call or chat: a recording, a written transcript and a summary of the conversation
  • WhatsApp messages you send us, with your WhatsApp number and profile name, and anything you share, such as a location pin

When you use this website:

  • your mobile number, and the one-time code we text you to sign in
  • the essential cookies that keep you signed in (see our Cookie policy)
  • your location, only if you press Use my location to fill in your pickup address. Your browser asks your permission first, and we use it only to find the address.
  • technical details such as your IP address and browser type, kept in our server logs to protect the website from misuse

When you pay by card, the payment provider tells us the amount, the card type, the last four digits of the card and a payment reference. We never receive your full card number or security code.

During your journey, our driver's app shares the driver's position with us, so we and you can see where the car is.

Other information:

  • if you tell us about a disability or health need, such as needing a wheelchair-accessible car, so that we can send the right car
  • complaints, lost property reports and incident reports, including what passengers, drivers or witnesses tell us
  • for business accounts: the names and contact details of the account's users and passengers, cost centres, purchase order numbers and invoices
  • if you apply to drive with us: your name, phone number, town and what you tell us about yourself

Sometimes we get your details from someone else: a person who books a journey for you, your employer if you travel on a business account, or one of our drivers.

Why we use it, and our lawful basis

The law requires us to have a lawful basis for each use of your information. Ours are:

  • To take, confirm, dispatch and carry out your booking, to send you updates and to take payment. Basis: performing our contract with you (Article 6(1)(b) UK GDPR). When someone else books for you, or you travel on a business account, our basis is our legitimate interest in providing the journey that was booked.
  • To keep the records TfL requires of a licensed operator, including booking records, complaints and lost property. Basis: legal obligation (Article 6(1)(c)), under the Private Hire Vehicles (London) Act 1998 and the regulations made under it.
  • To keep accounts and meet our tax duties. Basis: legal obligation.
  • To record calls and keep chat transcripts, so we have an accurate record of what was agreed, can settle questions and complaints, train our staff and improve our service. Basis: our legitimate interests.
  • To answer calls and messages with an automated assistant, so you get a quick answer at any hour. Basis: our legitimate interests. The assistant takes requests and answers questions; our office checks and confirms every booking, so no decision with a legal or similarly significant effect on you is made by automated means alone.
  • To keep passengers and drivers safe, prevent fraud and misuse, and protect our systems. Basis: our legitimate interests.
  • To answer your questions and handle complaints. Basis: our legitimate interests, and our legal obligations as a licensed operator.
  • To use information about a disability or health need to send the right car and the right help. Basis: your explicit consent (Article 9(2)(a)), which you give by telling us and can withdraw at any time.
  • To deal with legal claims and to help the police, TfL or other authorities when the law allows or requires it. Basis: legal obligation or our legitimate interests. Any information about criminal offences is handled under the conditions in Schedule 1 of the Data Protection Act 2018.
  • To consider your application to drive with us. Basis: taking steps, at your request, before entering into a contract.

Where we rely on legitimate interests, we have balanced our interests against your rights. You can ask us for details of that balance, and you can object (see Your rights).

We only send you marketing if you have agreed to it, and every marketing message tells you how to stop them. Booking confirmations and journey updates are not marketing.

Who we share it with

  • Our drivers: the details they need for your journey, such as your name, phone number, pickup, destination and notes.
  • Your company, if you travel on its business account: the journeys made on that account.
  • Service providers who work for us and may only use your information on our instructions. We have a contract with each of them.
  • TfL, the police, courts, insurers, HMRC and our professional advisers, when the law requires it or when it is needed to deal with an incident, claim or complaint.
  • A buyer of our business, if our business is ever sold, under the same protections as this policy.

Our service providers:

  • Google: address search, maps and journey routes (Google Maps Platform), and notifications in our apps (Firebase)
  • Mapbox, Ideal Postcodes and postcodes.io: address and postcode lookups, where we use them
  • ElevenLabs: our automated phone and chat assistant, including speech recognition, voice, recordings and transcripts. ElevenLabs uses its own approved sub-processors, including providers of the language models behind the assistant.
  • Meta (WhatsApp Business Platform): WhatsApp messages. WhatsApp's own terms and privacy policy also apply to your use of WhatsApp.
  • Twilio and Vonage: phone calls, call recordings and text messages
  • SumUp and Stripe: card payments. They also use payment data for their own legal duties, such as preventing fraud and money laundering, as independent controllers.
  • Resend: emails, such as booking confirmations
  • Contabo GmbH (Germany): the servers our booking system runs on, in the European Union

Maps on this website are drawn from OpenStreetMap. Your browser loads the map images from the OpenStreetMap Foundation's servers, which receive your IP address in the normal way.

Transfers outside the UK

Some of our service providers, including Google, Meta, ElevenLabs, Twilio, Stripe and Resend, are based in the United States or use servers outside the UK. When your information leaves the UK, it is protected by one of these:

  • UK adequacy regulations, for example for the European Economic Area, or for US companies certified under the UK Extension to the EU-US Data Privacy Framework
  • the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, approved by the Information Commissioner

You can ask us for more information about these safeguards.

How long we keep it

We keep information only as long as we need it:

  • Booking records: at least 12 months from the journey, as our operator licence requires. Where a booking forms part of our accounts (payments and invoices), we keep that record for 6 years for tax purposes.
  • Call recordings, and automated assistant recordings and transcripts: only as long as we need them to deal with the booking and any question about it, then deleted, unless we need them longer for a complaint, incident or claim.
  • WhatsApp messages: for as long as we keep the booking they relate to.
  • Complaints and lost property records: at least 12 months, as our operator licence requires.
  • Your customer account (name, number, email and saved details): until you ask us to close it, or when it has not been used for a booking for a long time and we no longer need it. Booking records are then kept as set out above.
  • Sign-in codes: a few minutes. Sign-in cookies: up to 30 days.
  • Server logs: for a short time, to keep the system secure and fix faults.
  • Driver applications that do not go ahead: deleted once we have decided, unless you ask us to keep them for a future vacancy.

After that we delete the information or make it anonymous.

Your rights

You have the right to:

  • get a copy of the personal information we hold about you
  • have wrong or incomplete information corrected
  • have your information deleted, where we no longer need it. We cannot delete booking records that the law requires us to keep, but we can tell you what we keep and why.
  • restrict how we use your information while a question about it is looked into
  • object to our use of your information where we rely on legitimate interests, and to stop marketing at any time
  • receive information you gave us in a format you can take elsewhere
  • withdraw your consent, where we rely on it
  • not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you

To use any of these rights, email info@commercialcar.co.uk or write to our registered office. It is free. We may ask you to prove who you are, and we reply within one month. If your request is complicated, we may take up to two more months and will tell you why.

Complaints about how we use your data

If you are unhappy with how we have used your information, please tell us first, so we can put it right. We acknowledge your complaint within 30 days.

You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Cookies

This website uses only the essential cookies that keep you signed in. We do not use analytics, advertising or tracking cookies. Our Cookie policy has the details.

Children

Our services are not aimed at children, and bookings must be made by an adult. We may hold a child's name or age when an adult books a journey for them, for example to provide the right child seat.

Keeping your information safe

Our website and apps use encryption to protect information sent to and from them. Access to personal information is limited to the staff and drivers who need it, and sign-in cookies cannot be read by scripts on the page. If a breach is likely to put your rights at high risk, we will tell you and the ICO as the law requires.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows when it last changed. If we make an important change, we will tell you on this website or when you next book.