Privacy Policy
Last updated: 1 March 2026
1. Introduction
Moova Mobilise Limited (trading as "TaxiDesk"), registered in Ireland (company number 793113), whose registered address is Block H, Eastpoint Business Park, Alfie Byrne Road, Dublin 3, Ireland ("we", "us", or "our"), is committed to protecting your privacy.
This Privacy Policy explains how we collect, use, store, and protect personal data when you use our website (taxidesk.co.uk), our SaaS platform, booking kiosks, embeddable booking widgets, and related services (collectively, the "Platform").
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data Controller
TaxiDesk's role depends on the type of data and the context:
- Data controller for: Operator account data, website visitor data, platform analytics, billing and payment data, and fraud prevention activities.
- Data processor for: Customer (passenger) booking data processed on behalf of Operators through their Kiosks and Widgets. In this context, the Operator is the data controller and our relationship is governed by our Data Processing Agreement.
3. Information We Collect
3.1 Operator Account Data (we are controller)
- Name, email address, and password.
- Company name, company registration number, and chosen subdomain.
- Branding assets (logo, colour preferences).
- Dispatch system API credentials (encrypted at rest).
- Stripe Connect account identifiers.
- Kiosk and widget configuration data.
3.2 Customer Booking Data (Operator is controller; we are processor)
- Pickup and drop-off locations.
- Vehicle type selection and quoted fare.
- Booking reference and status.
- Customer name and phone number (where provided for SMS notifications).
- Payment reference (Stripe payment intent ID — we do not store full card details).
3.3 Website Visitor Data (we are controller)
- IP address, browser type, operating system, and device information.
- Pages visited, time spent, and referral source.
- Cookie data (see our Cookie Policy).
3.4 Contact Form Data (we are controller)
- Name, email address, and message content submitted via our contact form.
4. Lawful Bases for Processing
We process personal data under the following lawful bases:
| Purpose | Lawful Basis |
|---|---|
| Providing the Platform to Operators | Contract performance (Art. 6(1)(b)) |
| Processing Customer bookings on behalf of Operators | Contract performance (Art. 6(1)(b)) |
| Billing and payment processing | Contract performance (Art. 6(1)(b)) |
| Fraud prevention and platform security | Legitimate interests (Art. 6(1)(f)) |
| Website analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Responding to contact form enquiries | Legitimate interests (Art. 6(1)(f)) |
| Tax records and financial compliance | Legal obligation (Art. 6(1)(c)) |
| Marketing communications (if applicable) | Consent (Art. 6(1)(a)) |
5. Who We Share Data With
We do not sell your personal data. We share personal data only with the following categories of recipients, and only to the extent necessary:
| Recipient | Purpose | Data Shared |
|---|---|---|
| Stripe (payment processor) | Processing card payments via Stripe Connect | Payment amounts, Stripe account IDs |
| Dispatch providers (e.g., iCabbi) | Generating quotes and dispatching bookings | Pickup/drop-off locations, vehicle type, passenger name |
| DigitalOcean (hosting) | Infrastructure and data storage | All Platform data (encrypted in transit and at rest) |
| Google (analytics) | Website usage analytics | Anonymised usage data, IP address |
| Professional advisers | Legal, accounting, and insurance advice | As required for the specific purpose |
| Law enforcement | Compliance with legal obligations | As required by law or court order |
6. International Data Transfers
Your data is primarily stored on servers located in the United Kingdom and the European Economic Area. Where data is transferred outside the UK/EEA (for example, to Stripe's or Google's servers in the United States), we ensure appropriate safeguards are in place, including:
- UK International Data Transfer Agreements (IDTAs).
- EU Standard Contractual Clauses (SCCs).
- Adequacy decisions by the UK Secretary of State where applicable.
7. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected:
| Data Type | Retention Period |
|---|---|
| Operator account data | Duration of account + 12 months after closure |
| Customer booking data | 6 years from the date of the booking (tax and legal compliance) |
| Billing and payment records | 6 years from the date of the transaction (HMRC requirements) |
| Website analytics data | 26 months (Google Analytics default) |
| Contact form submissions | 12 months from submission |
After the retention period expires, personal data is securely deleted or anonymised.
8. Data Security
We implement appropriate technical and organisational measures to protect personal data, including:
- Encryption in transit (TLS/HTTPS) and at rest for sensitive data.
- Access controls and role-based permissions.
- Regular security reviews and updates.
- Secure password hashing (bcrypt).
- Content Security Policy (CSP) headers on all pages.
- Rate limiting on APIs and authentication endpoints.
Payment card data is handled entirely by Stripe and is never stored on our servers. Stripe is PCI DSS Level 1 certified.
9. Your Rights Under UK GDPR
You have the following rights in relation to your personal data:
- Right of access — request a copy of your personal data.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure — request deletion of your personal data (subject to legal retention requirements).
- Right to restrict processing — request that we limit how we use your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights, please contact us at privacy@taxidesk.co.uk. We will respond within one month.
Customers (passengers): If you booked a taxi through a Kiosk or Widget, the Operator is the data controller for your booking data. Please contact the Operator directly to exercise your data rights. If you are unsure who to contact, email us and we will direct you to the appropriate Operator.
10. Right to Complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
We would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first at privacy@taxidesk.co.uk.
11. Children
The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly.
12. Cookies
We use cookies and similar technologies on our website. For full details about the cookies we use, why we use them, and how to manage your preferences, please see our Cookie Policy.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Platform and update the "Last updated" date above.
14. Contact Us
For any questions about this Privacy Policy or to exercise your data rights:
Data Protection Contact: privacy@taxidesk.co.uk
Moova Mobilise Limited
Block H, Eastpoint Business Park, Alfie Byrne Road, Dublin 3, Ireland