Flitwick Executive Cars Ltd, trading as Flitwick Executive Cars (FEC), is a taxi and private-hire operator serving Flitwick, Ampthill and surrounding areas, with journeys to airports and destinations across the UK. Flitwick Executive Cars Ltd is the data controller responsible for the personal information described in this policy.

Company number: 14711005 Office and correspondence address: Unit 19, Apex Business Centre, Boscombe Road, Dunstable, Bedfordshire, LU5 4SB. Flitwick service location: Flitwick Train Station, Station Road, Flitwick.

Website: https://www.fecar.co.uk Privacy enquiries: admin@fecar.co.uk Telephone: 01525 606060 Please mark privacy emails “Privacy request” so we can direct them to the responsible person.

This policy also covers information supplied by someone arranging a journey on your behalf. We handle personal information in accordance with applicable UK data protection law, including the UK GDPR and the Data Protection Act 2018, as amended, and relevant electronic marketing and cookie rules.

Customers and passengers: names, contact details, pickup and destination addresses, journey dates and times, flight details, passenger and luggage numbers, booking references, instructions, correspondence, feedback and complaint records. Where needed, we record child seat requirements and limited accessibility or assistance information. Please avoid providing medical diagnoses or other sensitive details unless necessary. For school or assisted transport, this may include an authorised parent or carer contact, emergency contact details, collection instructions and the minimum safeguarding information needed to carry out the journey safely.

Payments: we process fare amounts, invoice details, payment status and transaction references needed to administer your booking. Where you pay through an external payment provider, that provider handles the payment information entered into its checkout under its own privacy notice.

Website visitors: IP address, device and browser information, pages visited, timestamps, security logs and cookie choices. Optional analytics and advertising information is collected only where enabled and on the applicable legal basis described below.

Driver applicants: contact details, identity and right to work evidence, passport or identification documents, DVLA licence, private hire driver badge and issuing authority, expiry dates, references, relevant vehicle and insurance documents, application correspondence and verification results. This can include Enhanced DBS information and Update Service status where the role and law permit those checks.

We obtain information directly from you through bookings, forms, uploads, calls, emails and other communications; from the person or organisation arranging your journey; and, where relevant, from drivers, transport partners and payment providers. For driver checks, we may receive information from referees, licensing authorities and authorised identity, DVLA or DBS checking services. We only seek information that is relevant to the purpose. Where a school, council, employer, care provider or travel arranger books transport, we may receive the passenger details and authorised instructions needed for that service.

If you book for another passenger, give them this policy and only share information you are authorised to provide. Our services may carry children, but booking arrangements and communications should normally be made by a parent, guardian or other authorised adult. We collect only the child-related information needed for the journey. If necessary passenger, contact or journey details are not provided, we may be unable to give an accurate quote, accept the booking or provide the requested transport. Optional marketing information is not required to book.

Quotes and bookings: we use contact and journey details to prepare quotes, arrange journeys, manage changes, process payment and provide support. Our basis is taking steps at your request before a contract and performing our contract with you. For passengers who are not the contracting customer, we rely on our legitimate interests in delivering the booked service safely and efficiently.

Service administration and security: we use relevant records to investigate complaints, locate lost property, prevent fraud, secure our systems and establish or defend claims. Our basis is legitimate interests in reliable operations, protecting people and property and resolving disputes, balanced against your rights. A legal obligation may apply to particular disclosures or records. Where necessary, relevant safeguarding information may be used to protect children or adults at risk, on an appropriate lawful basis and, for sensitive information, an additional applicable legal condition.

Licensing and accounts: we use relevant booking, driver and financial information to comply with the legal requirements that apply to our private-hire operator licence, accounting, tax and lawful requests from public authorities. The lawful basis is compliance with the relevant legal obligation.

Driver applications: we assess suitability, communicate with applicants, verify relevant documents and prepare an engagement. We use pre-contract steps where applicable, legal obligations for checks actually required by law, and legitimate interests in selecting appropriately qualified drivers and preventing fraud. We do not rely on consent as a substitute for a mandatory check.

Marketing: we use consent for promotional emails or texts unless a specific lawful exception applies. Any use of an existing-customer exception must meet its conditions and provide an opt-out when details are collected and in every message. Booking confirmations and essential journey updates are service messages.

Accessibility information that reveals health is special category data. We normally seek explicit consent to use the minimum information required to arrange assistance, unless another lawful condition applies. You may withdraw that consent; we will explain any impact on arranging the requested assistance.

DBS certificates, offence details and relevant driving conviction information receive additional legal protection. We only carry out checks where the role is eligible and we have the necessary legal authority, lawful basis and condition for processing criminal offence data under Article 10 of the UK GDPR and the Data Protection Act 2018. Access is restricted to authorised staff. Where required, we maintain an appropriate policy document. DBS Update Service checks require the necessary permission and eligibility. Applying to drive with us does not authorise unrelated checks.

We share only information necessary for the purpose. Assigned drivers and relevant transport partners receive the details needed to carry out your journey, such as your name, contact number, locations, flight and essential assistance instructions. Other recipients can include booking and dispatch suppliers, website and hosting providers, payment services, email and IT providers, professional advisers and insurers. For school, council-funded or corporate transport, we may share relevant service records with the commissioning organisation or authorised parent or carer where necessary and lawful.

Licensing authorities, regulators, HMRC, police or other public bodies may receive information where we are legally required or otherwise lawfully permitted to disclose it. Driver verification providers and referees receive the information needed for authorised checks. We do not publish identity documents, driver applications or DBS records.

Suppliers acting on our instructions must be subject to appropriate data protection arrangements. Some recipients, including payment providers, public authorities and independently operating transport partners, may act as separate data controllers and publish their own privacy notices. You can contact us for details of the providers relevant to your booking.

Essential cookies and similar technologies support functions such as booking sessions, security and remembering privacy choices. Where we use optional analytics, advertising pixels or similar technologies requiring consent, they remain off until you choose to allow them. Rejecting optional cookies must not prevent ordinary access to the website. You can change or withdraw choices through the website cookie settings.

If enabled, advertising tools such as Meta or TikTok technologies may receive device identifiers and limited website events to measure campaigns or build advertising audiences. Any customer identifier sharing, including hashed identifiers, remains personal data processing and must be described accurately. We do not send passport documents, DBS information or accessibility information to advertising platforms.

Some suppliers may store information outside the UK or allow overseas access. Where a restricted international transfer occurs, we use an applicable UK adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, with any required assessment and supplementary measures. Contact us for information about the safeguards relevant to your data.

We use proportionate technical and organisational measures to protect personal information, including appropriate access controls, secure transfer methods and staff confidentiality arrangements. Contact us for an approved secure method before sending identity documents, DBS information or other sensitive records. No system is completely risk-free; we assess and respond to security incidents and make notifications where the law requires them.

We retain information only for as long as needed for the purpose, subject to applicable legal requirements. We consider operator licensing conditions, accounting obligations, the nature of a complaint or claim, document sensitivity and whether a shorter record will meet the need. We securely delete or anonymise information when it is no longer required.

Booking and dispatch records: we retain records for the period required by the licensing authority responsible for the relevant operator licence. Where a complaint, insurance matter or legal claim requires further retention, we keep only the information necessary until that matter is resolved and any applicable claim period has expired. Financial records are retained for the applicable statutory accounting and tax periods; this does not mean every passenger detail is retained for the same period.

Driver applications and verification documents: we retain unsuccessful applications only for the time reasonably needed to complete recruitment, answer queries and deal with any related complaint or claim. Successful applicant records are retained during the engagement and afterwards only to meet applicable licensing and legal obligations or resolve outstanding matters. Identity document copies are deleted when no longer necessary. Detailed DBS information is kept separately for the shortest justified period under the applicable DBS requirements; a limited record of the check and decision may be retained for longer where justified.

Security logs, enquiries and complaints: retained according to their operational purpose, incident or dispute status and applicable claim periods. Marketing records: retained until withdrawal or the end of the justified marketing period; a minimal suppression record may be kept to honour your opt-out. Cookie durations are set out in the cookie notice. A legal hold may require specific information to be retained longer.

Depending on the circumstances and lawful basis, you can ask for access to your personal information, correction, erasure, restriction or data portability. You may withdraw consent at any time without affecting the lawfulness of earlier processing. These rights have legal limits; for example, we may need to retain some records to meet a legal obligation.

Your right to object: you can object to processing based on our legitimate interests on grounds relating to your situation. You have an absolute right to object to direct marketing, including related profiling. Use an unsubscribe option or contact us using the details in section 1.

We normally respond to rights requests within one month, subject to applicable rules on identification, clarification and extensions. We may ask for proportionate information to verify identity. Requests are normally free; a fee or refusal is possible only where the law permits it. If we cannot act on your request, we will explain why and how you can complain.

Contact us first if you have a privacy concern. We will acknowledge a data protection complaint within 30 days, provide appropriate progress updates and give an outcome without undue delay. You can also complain to the Information Commissioner’s Office at any time: https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. Postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

This policy takes effect on 26 October 2026. We will review it by 26 October 2027, or sooner if our services, legal obligations or data practices change. Any revised policy will display its last updated date. Where required, we will tell you about a material change before a new use of your information begins.