Privacy Policy

Last updated: 26 October 2026  ·  This policy is reviewed regularly. We recommend you have your own legal adviser review it before relying on it.

1. Who We Are (Data Controller)

VDrive Private Hire (company number 17177362, registered in England & Wales) ("we", "our", "us") is the data controller for the personal information described in this Privacy Policy. Our registered office is Paymal House, Stepney Way, London, United Kingdom, E1 3HR. Our trading address is 78 Mill Street, Mill Lane, Kidderminster, DY11 6XJ. You can contact us at admin@vdrive.uk or by phone on 0330 229 7803.

We are registered with the UK Information Commissioner's Office (ICO) as a data controller. [ICO registration number not yet added. Admin: set key ico_number in Admin > Settings] Our Data Protection Lead can be contacted at the email address above with the subject line "Data Protection".

This Privacy Policy explains how we collect, use, store and share your personal information when you use our website, apply to hire a vehicle, are an active hirer, or are a partner company. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

2. Categories of Personal Data We Collect

2.1 Identity and contact

• Full name, date of birth, gender (where required by an insurer);
• Home address and previous address(es);
• Email address, phone number(s);
• Photo identification (passport, BRP, share-code);
• Right-to-work documentation.

2.2 Licence and regulatory

• UK driving licence number, expiry, endorsements and DVLA check code;
• PCO/PHV badge details, issuing authority and expiry;
• National Insurance number where required for licence checks or insurance enrolment, and for a tax obligation where applicable;
• Driving-licence front/back and PHV licence images, declared motoring claims, convictions and points needed for the relevant checks or insurance;
• Vehicle plate, V5 details and council compliance information (Partners).

2.3 Financial

• Card payment references and verification results from Stripe; we do not store full card numbers;
• Deposit repayment account holder name, sort code and account number supplied at check-in, stored by VDrive in encrypted fields for authorised staff arranging repayment, not held only by Stripe;
• Hire history, deposit balance, late-fee history, PCN administration history;
• Partner remittance bank details and payment records.
• Selected 7/14/28-day payment preference, payment-day change quotations and completion records, rent/insurance breakdowns, credit allocations and hire payment statements;
• Referral codes, referrer/referred account links, qualification evidence, reward terms and credit use; saved vehicle-offer terms and discounted rent periods;
• Partner fee agreements, effective dates, eligible collected-rent evidence, deductions, credits, invoices and payout records.

2.4 Vehicle and operational

• Check-out and check-in inspection photos and videos;
• Damage reports and incident reports;
• Mileage at hand-over and return;
• When enabled for active hires, fresh dashboard camera photos at 28-day checkpoints, extracted odometer values/units, confidence and validation results, corrections, reasons and audit events;
• Insurance enrolment vehicle make/model/value and requested pickup/start date, private enrolment messages, evidence versions and authenticated reply-match results.
• Telematics data, where a vehicle is fitted with a tracker (location and journey data, usually for security/recovery only);
• PCN, congestion-charge, ULEZ and similar notice records.

2.5 Device and usage

• IP address, browser type, device type, operating system;
• Pages visited, dates and times, referrer;
• Cookies and similar local-storage keys (see our Cookie Policy).

2.6 Special-category data

Health information, such as a medical condition affecting fitness to drive, needs additional protection. Only provide what is necessary for the relevant insurance or licensing purpose. Sharing with an insurer or authority requires an appropriate lawful basis and additional condition, not merely acceptance of this notice.

Health information additionally requires an applicable UK GDPR Article 9 condition. Motoring conviction/offence information has separate protection under Article 10 and the Data Protection Act 2018; an Article 6 basis alone is not sufficient. These categories are limited to the information needed for the relevant insurance or licensing purpose, with restricted access. Contact our Data Protection Lead for the condition and safeguards applying to your case; agreeing to general website terms is not blanket consent to these uses.

3. Sources of Personal Data

We collect personal data from the following sources:

• Directly from you, when you apply, sign up, complete checkouts, or contact us;
• From the DVLA, where you give us a check code to verify your driving licence;
• From local councils, TfL and parking-enforcement bodies, when a PCN is issued against a vehicle you have hired;
• From Partner companies, where they have referred a vehicle to us for management;
• From fraud-prevention databases and identity-verification providers we use to validate applications;
• From our own platform and devices (logs, cookies, vehicle telematics where fitted).

4. How We Use Your Personal Data & Lawful Basis

We use your personal data only where we have a lawful basis under UK GDPR. The main purposes and bases are:

4A. Telematics and Vehicle Location Data

What data we collect

All vehicles in the VDrive Private Hire fleet are fitted with a GPS telematics device. While a vehicle is on hire to you, that device records and transmits:

• Location data: latitude, longitude and heading, updated in near real-time;
• Speed: the vehicle's speed at the point of each location fix;
• Journey history: start/end points, route taken, distance and duration for each journey;
• Engine / ignition status: whether the engine is running or the ignition is on or off;
• Remote relay status: whether the engine relay is in the enabled or disabled state (used for immobilisation in an emergency or following sustained non-payment; see Terms section 15F);
• Device health signals: GPS fix quality, battery voltage and connectivity status.

Lawful basis

We rely on two overlapping lawful bases under UK GDPR Article 6:

• Performance of contract (Article 6(1)(b)): tracking is a condition of the hire. Without the ability to locate, recover and, in extremis, immobilise the vehicle we could not provide the hire service or protect our asset. The processing is necessary to perform the Hire Agreement.
• Legitimate interests (Article 6(1)(f)): we have a legitimate interest in protecting our vehicles from theft, recovering vehicles abandoned or not returned, enforcing hire terms, supporting insurance claims and complying with court orders. We have balanced these interests against your right to privacy; the processing is proportionate and limited to the operational period of the hire plus the post-hire period described below.

Where applicable law requires consent for the use of the immobilisation relay (e.g. Scotland), we obtain that consent separately at the point of signing the Hire Agreement.

Who we share telematics data with

Telematics data is shared only where strictly necessary:

• Insurance brokers and underwriters: to investigate accidents, validate claims, and defend third-party claims against the fleet policy;
• Police and law-enforcement bodies: where we receive a lawful production order, court order, or other legally binding request;
• Vehicle recovery agents: the minimum location data needed to locate and recover the vehicle;
• Our telematics platform provider (GPSLive): as a data processor acting on our instructions under a written agreement; they do not use your data for their own purposes;
• Solicitors and legal advisers: where telematics evidence is relevant to a dispute, debt-recovery action, or insurance claim in which you are involved.

We do not share telematics data with Uber, Bolt or any ride-hailing platform, with third-party marketers, or with any party not listed above.

Retention period

Live tracking and provider-held history are subject to the available GPSLive account history and retention configuration. Copies retained for an incident, recovery, insurance claim or dispute are kept while necessary for that matter and applicable legal obligations. Contact our Data Protection Lead for the period applicable to a particular record. We do not promise that all provider-held history is stored locally, automatically thinned after 12 months or automatically deleted three years after hire.

Your rights in relation to telematics data

Your UK GDPR data-subject rights (set out in full in section 10 below) apply to your telematics data in the same way as to all other personal data we hold about you. In particular:

• Right of access: you may ask us for a copy of the journey history recorded during your hire period;
• Right to object: you may object to processing based on legitimate interests. Note, however, that we may be unable to continue the hire if tracking is disabled, as it is a condition of the Hire Agreement and our fleet insurance;
• Right to erasure: you may ask us to delete telematics data once the retention period has expired or where you believe we no longer have a legitimate purpose. We will consider each request and explain any reason we need to retain specific records (e.g. an open claim).

To make any request relating to your telematics data, contact our Data Protection Lead at admin@vdrive.uk with the subject line "Telematics Data Request". We will respond within one calendar month.

5. Sharing Your Personal Data

We share personal data with the following categories of recipient, only to the extent necessary:

• Payment processors: we use Stripe for supported online payments, including first-week reservations, advance rent, extra-day payment changes and separately requested charges. Relevant identity/contact details, amounts and hire/payment references are shared to process and verify transactions. Card details are handled by Stripe. A deposit bank repayment is arranged separately by authorised staff; a pending refund record does not initiate a transfer;
• DVLA: for licence-status checks;
• TfL and local councils: for PCNs, vehicle plates, and licensing compliance;
• Insurance brokers and underwriters: for fleet cover, claims and recoveries;
• The configured insurance enrolment contact and provider: the necessary driver documents, NI number where required, declarations, vehicle details/value and proposed start date are sent by email to arrange requested cover. Reply evidence and sender/authentication checks are processed to match a confirmation to the correct hire before documents are released. The provider identity is shown in the relevant insurance documents;
• AI image-reading services: dashboard and document images may be sent through the application's configured OpenAI integration, including its hosting/proxy service, for extraction of text or odometer information. Avoid including passengers, unrelated documents or unnecessary personal details in dashboard photos. AI output is checked against validation rules and may require office review;
• Recovery agents and debt-collection partners: to recover vehicles and unpaid balances;
• Accountants, auditors and legal advisors: under professional confidentiality;
• HMRC and other regulators: where the law requires;
• Fraud-prevention databases: to validate applications and prevent abuse;
• IT, hosting, email, SMS and cloud-service providers: under written data-processing agreements;
• Email delivery and receiving services: Brevo and the configured inbound service process necessary messages, attachments and delivery/reply metadata for insurance enrolment and account communications;
• Partner companies: limited to the operational data needed to manage their vehicle (driver name, hire dates, payment status, PCN history for their vehicle).

Referral participants can see programme progress and their own rewards; this does not give them access to the other person's licence documents, banking details or full payment history. Access to insurance, deposit and mileage evidence is limited to authorised operational roles and relevant hire-document permissions.

We do not sell your personal data to any third party, and we do not share it for unrelated marketing purposes.

6. International Transfers

Payment, hosting, email and AI services may process information outside the UK. Any restricted transfer requires an applicable adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum, and any required assessment. Ask our Data Protection Lead for the recipients, processing locations and safeguards applicable to your information. This notice does not assert that every service stores data exclusively in the UK/EEA.

7. How Long We Keep Your Data

We only keep personal data for as long as we need it. The retention periods are summarised in the table at section 4. In broad terms:

• Account data: for the duration of your relationship with us, plus up to 6 years for limitation purposes;
• Financial records: 7 years from the end of the financial year (HMRC requirement);
• Discount-code abuse prevention: we use account references and protected, keyed network identifiers to prevent repeated guessing of offer and referral codes. Attempt windows expire after 15 minutes. Security events are normally kept for 30 days and then removed in scheduled batches. These records do not store submitted codes or raw IP addresses;
• PCN and legal records: up to 7 years;
• Inspection photos and videos: 24 months from the date of the inspection (longer if there is an active dispute, deposit deduction or insurance claim), after which the check-out and matching check-in are automatically deleted together by a scheduled retention sweep;
• Marketing preferences: until you withdraw consent.
• Cookie-banner consent records: 24 months from the date the choice was recorded, after which they are automatically deleted by a scheduled retention sweep.

Retention figures describe our policy, not a guarantee that every data category has an automated deletion job. The stated inspection-media and cookie-audit sweeps are distinct from mileage audit records, insurance enrolment evidence and deposit repayment records. At the end of the applicable need/period, data must be reviewed for deletion or anonymisation, subject to relevant legal holds. Contact us to request review or information about a particular record.

8. Automated Decision-Making and AI

AI assists with reading documents and dashboard odometers. A clear mileage reading can pass automated validation and update the vehicle record without individual human approval; unclear, inconsistent or implausible results can require another photo or office review. When enabled, an overdue active-hire camera check can restrict dashboard access until resolved. Separately, payment verification and authenticated matched insurance replies can automatically update schedules or release documents. These are not a promise of insurance cover or a judgement that AI output is always correct. Contact the office to challenge a reading, resolve camera/access difficulties or request human review; rights relating to significant automated decisions apply where the legal conditions are met.

9. Marketing & Cookies

We only send marketing communications to you with your consent and you can opt out at any time via the unsubscribe link in any email or by emailing us. For information on cookies and similar technologies, please see our Cookie Policy.

10. Your Rights

Under UK GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you;
• Rectification: ask us to correct inaccurate or incomplete data;
• Erasure: ask us to delete your data in certain circumstances ("right to be forgotten");
• Restriction: ask us to limit how we process your data;
• Portability: receive your data in a structured, machine-readable format;
• Object: object to processing based on legitimate interests, including direct marketing;
• Withdraw consent: where we rely on consent, withdraw it at any time (this does not affect lawful processing already carried out).

To exercise any of these rights, please email admin@vdrive.uk. We will respond within one calendar month. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we have handled your data.

11. Children

Our services are not directed at children under 18. We do not knowingly collect personal data of children. If you believe we hold a child's data, please contact us immediately and we will delete it.

12. Security

We take appropriate technical and organisational measures to protect your personal data, including:

• TLS encryption for all data in transit;
• Encrypted backups and access-controlled hosting;
• Role-based access controls so staff only see what they need to;
• Two-factor authentication on administrator accounts;
• Regular review of permissions, devices and supplier security;
• Staff data-protection training.

If we ever suffer a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, in line with UK GDPR, and will notify affected individuals where required.

13. Changes to This Policy

We may update this notice to explain our processing. For material changes to purposes or data categories, our stated policy is to give at least 30 days' notice by email and on this page before the change takes effect, alongside any additional legal requirements. Publishing explanatory text does not itself authorise a new use, replace a required lawful basis, or make continued use consent to processing. Where consent is required it is obtained separately.

14. Contact Us

For any questions about this Privacy Policy or to exercise your rights, contact:
VDrive Private Hire, Data Protection Lead (Company No. 17177362)
Trading address: 78 Mill Street, Mill Lane, Kidderminster, DY11 6XJ
Registered office: Paymal House, Stepney Way, London, United Kingdom, E1 3HR
Email: admin@vdrive.uk
Phone: 0330 229 7803