Privacy and Data Protection Notice

Privacy and Data Protection Notice

Effective date: 21 July 2026
Last reviewed: 21 July 2026

This notice contains items marked [TO BE COMPLETED]. Those details must be completed and checked against our actual practices before this notice is treated as final.

1. Who we are

Cabs for Veterans organises and supports free transport for military veterans attending remembrance events. For the personal information described in this notice, the data controller is:

[TO BE COMPLETED: full legal name of controller]
[TO BE COMPLETED: postal address]
Email: [TO BE COMPLETED: privacy email address]
Telephone: [TO BE COMPLETED: telephone number]
ICO registration number, if applicable: [TO BE COMPLETED]

This notice explains how we use personal information under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the Data (Use and Access) Act 2025.

2. Who this notice applies to

This notice applies to:

veterans and other passengers requesting or receiving transport;
drivers, helpers, marshals, hub contacts and event or management volunteers;
people who create or use an account on our website;
mailing-list subscribers, donors and supporters;
people who contact us or make a data protection request or complaint; and
visitors to c4v.uk.

3. Personal information we collect

Depending on how you interact with us, we may collect:

identity and contact details, including your name, address, postcode, email address and telephone number;
journey and event details, including pickup locations and times, assigned drivers, passengers, hubs and directions of travel;
driver and vehicle details, including vehicle type, available seats, registration status and availability;
volunteer roles, duties, notes, badge details and event participation;
accessibility, mobility, wheelchair or other support requirements that you choose to provide;
account details, roles, authentication records and communication preferences;
messages, enquiries, complaints and records of our correspondence with you;
mailing-list choices and records of consent or withdrawal;
technical and usage data, such as IP address, browser information, pages visited, timestamps, security logs and session identifiers; and
any other information you choose to provide in notes or free-text fields.

Please do not include unnecessary sensitive information in free-text fields.

4. Where we obtain information

We obtain personal information:

directly from you through registration forms, emails, telephone calls and conversations;
from somebody acting for you, where they are authorised to do so;
from participating charities, event organisers, transport providers, hubs and volunteers where necessary to coordinate the service;
from authorised members of our team who create or update operational records; and
automatically when you use our website, through server logs, cookies and similar technologies.

If we receive your information from another source, we will provide privacy information within the times required by law unless an exemption applies.

5. Why we use information and our lawful bases

We use personal information for the following purposes:

To receive and manage transport requests and provide journeys. Our lawful bases are taking steps at your request and performing our agreement with you, and our legitimate interests in delivering and administering the service.
To recruit, coordinate and communicate with drivers, helpers, marshals and other volunteers. Our lawful bases are taking steps at your request, performing our agreement with you, and our legitimate interests in operating safe and effective events.
To plan events, allocate vehicles and passengers, manage hubs, and respond to changes or emergencies. Our lawful bases are performance of our agreement, legitimate interests in delivering the service, and protection of vital interests where there is a genuine emergency.
To administer accounts and keep the website and our records secure. Our lawful bases are legitimate interests in administration, fraud prevention, service security and protecting our users, and compliance with legal obligations.
To answer enquiries, rights requests and data protection complaints. Our lawful bases are compliance with legal obligations and legitimate interests in responding and keeping appropriate records.
To send optional newsletters and promotional communications. We rely on consent where PECR or data protection law requires it. You can withdraw consent at any time.
To understand and improve our website and service. We rely on legitimate interests for essential operational analysis. Where analytics use non-essential cookies or similar storage, we require consent under PECR.
To establish, exercise or defend legal claims and comply with lawful requests. We rely on legal obligation and our legitimate interests.

Where we rely on legitimate interests, we consider whether the processing is necessary, proportionate and compatible with your rights. You may ask us for information about that assessment.

6. Special category information

Accessibility, mobility, wheelchair and health-related support information may be special category data. We only request information needed to provide a safe and suitable service, restrict access to it, and avoid using it for unrelated purposes.

Our Article 6 lawful basis is described above. Our separate UK GDPR Article 9 condition is [TO BE COMPLETED: confirm the applicable condition, for example explicit consent]. [TO BE COMPLETED: confirm whether a Data Protection Act 2018 Schedule 1 condition and an Appropriate Policy Document are required].

7. If you do not provide information

You may choose not to provide personal information. However, if we cannot obtain the contact, journey, safety or accessibility information reasonably needed to arrange transport or a volunteer role, we may be unable to provide that service. Optional marketing information is not required to receive transport.

8. Who we share information with

We share only what is reasonably necessary with relevant recipients, which may include:

assigned drivers, helpers, marshals, hub contacts and authorised event coordinators;
participating charities, event organisers and transport providers;
website hosting, database, email, communications, document, mapping and other IT service providers;
professional advisers, insurers, auditors and legal representatives;
emergency services or safeguarding contacts where necessary; and
courts, regulators, law-enforcement bodies and public authorities where required or permitted by law.

Current material processors and partners: [TO BE COMPLETED: identify material processors and partners, including hosting and email providers]. We do not sell personal information.

9. International transfers

Some technology providers, including Google, may process information outside the United Kingdom. [TO BE COMPLETED: identify each restricted transfer and the applicable UK adequacy regulations, UK International Data Transfer Agreement, UK Addendum, or other safeguard]. You may contact us for more information about the safeguards used.

10. How long we keep information

We retain personal information only for as long as necessary for the purpose for which it was collected, including operational, safety, legal, accounting and reporting requirements. We consider the amount, nature and sensitivity of the information, risks from unauthorised use, and applicable limitation periods.

transport, event and participant records: [TO BE COMPLETED];
driver, helper, marshal and volunteer records: [TO BE COMPLETED];
account, authentication and security logs: [TO BE COMPLETED];
contact enquiries and data protection complaints: [TO BE COMPLETED];
mailing-list records and evidence of consent or opt-out: [TO BE COMPLETED]; and
analytics and website logs: [TO BE COMPLETED].

[TO BE COMPLETED: approve and implement a documented retention and deletion schedule].

11. Security

We use proportionate technical and organisational measures intended to protect personal information. These include access controls, role-based permissions, authentication, logging, backups, maintenance and limiting information to people who need it. No internet service is completely secure, but we regularly review risks and improve safeguards where appropriate.

12. Your data protection rights

Depending on the circumstances and our lawful basis, you may have the right to:

be informed about how we use your information;
request access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to erase information;
ask us to restrict processing;
receive information you provided in a portable format;
withdraw consent at any time, without affecting earlier lawful processing; and
complain about how we handle your information.

Your right to object: You have the right to object to processing based on legitimate interests. You have an absolute right to object to direct marketing at any time.

We do not currently use personal information to make solely automated decisions that produce legal or similarly significant effects. [TO BE COMPLETED: confirm this statement].

To exercise a right, contact us using the details in section 1 or use our contact form. We may ask for information needed to verify your identity and locate the relevant records. We normally respond within one month. Where clarification is reasonably required for a subject access request, the statutory period may be paused while we await it.

13. Data protection complaints

You may make a data protection complaint using the contact details in section 1 or our contact form. Please mark it “Data protection complaint” and explain your concern and the outcome you seek.

In accordance with the Data (Use and Access) Act 2025, we will acknowledge a data protection complaint within 30 days of receiving it. We will take appropriate steps to investigate, keep you informed, and communicate the outcome without undue delay.

You may also complain to the Information Commissioner’s Office (ICO):
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint

14. Cookies and analytics

Our site uses essential technologies for authentication, security, user preferences and session operation. It also uses a first-party session identifier for website logging and Google Analytics (measurement ID G-8H52NJ14BJ) to understand use of the site. Google Analytics and externally hosted Google Fonts may cause technical data, including IP address and browser information, to be sent to Google.

Non-essential cookies or similar technologies require consent under PECR unless an exemption applies. [TO BE COMPLETED: confirm the cookies in use, their names, providers, purposes and lifetimes; implement or confirm a compliant consent mechanism that prevents non-essential analytics before consent; and provide controls to withdraw consent].

15. Changes to this notice

We review this notice regularly and update it when our processing or the law changes. Material changes will be brought to people’s attention where appropriate. The current version and review date will always appear on this page.

This notice is intended to provide clear privacy information. It is not a substitute for completing the organisation’s data mapping, lawful-basis assessment, retention schedule, processor review and any required data protection impact assessment or Appropriate Policy Document.