What personal data we process, why, and what rights you have.
This Privacy Policy explains in detail how HolidayCab processes Personal Data in connection with the operation of its digital booking platform for ground transport services, including airport transfers and other mobility services (the “Platform”). It applies to all persons who access or use the Platform, including Travellers, Passengers, website visitors, account holders, corporate or distribution partners, and any other persons whose Personal Data may be processed in connection with the services offered through the Platform.
HolidayCab takes the protection of Personal Data seriously. We process Personal Data lawfully, fairly and transparently, and in accordance with applicable data protection laws, including the EU General Data Protection Regulation (Regulation (EU) 2016/679 – “GDPR”), the UK GDPR, applicable national implementing laws, and, where relevant, state privacy laws in the United States (such as the California Consumer Privacy Act as amended by the California Privacy Rights Act – “CCPA/CPRA”).
This Privacy Policy is intentionally written in a comprehensive, explanatory style. It is designed to help you understand what data we process, why we process it, how long we retain it, with whom we share it, what safeguards we apply, and what rights you have.
1. Who We Are and Scope of This Privacy Policy
HolidayCab operates a global digital platform that enables Travellers to book Transport Services provided by independent Drivers or Driver Companies. HolidayCab is not a carrier. We do not own or operate vehicles and we do not employ Drivers providing the Transport Service. Instead, we act as a technology intermediary that supports the creation, management, and administration of bookings between Travellers (and Passengers) and independent Drivers/Driver Companies.
For the purposes of applicable data protection laws, HolidayCab is a data controller for Personal Data processed in connection with operating the Platform, creating and managing bookings, providing customer support, facilitating payments, preventing fraud and abuse, conducting analytics, ensuring Platform security, and complying with legal obligations. In certain contexts, other parties may also act as controllers, including Drivers/Driver Companies, partner hotels, agencies, affiliates, payment providers, or social media platforms. Where a third party acts as an independent controller, their privacy policy applies to their processing in addition to this Privacy Policy.
This Privacy Policy applies to processing performed in connection with, or via, the following touchpoints:
Where you are booking on behalf of others, you are responsible for ensuring that those individuals have been informed about the processing described in this Privacy Policy, and that you have the legal basis to provide their Personal Data to us.
2. Definitions
For clarity and consistency, the following terms are used in this Privacy Policy:
“HolidayCab”, “we”, “us”, “our” refers to the HolidayCab operating entity responsible for the Platform as described in Section 3. “Platform” means the HolidayCab website(s), mobile applications, booking widgets, APIs and related digital services. “User” means any person who accesses or uses the Platform, including visitors, account holders and Travellers. “Traveller” means the person who makes a booking through the Platform. “Passenger” means any person who uses the Transport Service, including where a booking is made on their behalf. “Driver” means an independent driver or driver company providing the Transport Service booked via the Platform. “Transport Service” means the ground transportation service performed by a Driver/Driver Company. “Personal Data” means any information relating to an identified or identifiable natural person. “Processing” means any operation performed on Personal Data, such as collection, storage, use, disclosure, or deletion. “Controller”, “Processor”, “Joint Controller” have the meanings given in applicable data protection law (including the GDPR).
3. Data Controller and Contact Details
The data controller responsible for processing under this Privacy Policy is:
HolidayCab UG (haftungsbeschränkt), Ausblick 1, 33100 Paderborn, Germany with company registration number HRB 16405.
Contact for privacy matters: Email: privacy@holidaycab.com
HolidayCab may appoint a Data Protection Officer (“DPO”) where required by law or where it chooses to do so. If a DPO is appointed, the relevant contact details will be published on the Platform.
You may contact us at any time with questions, concerns, or requests regarding processing of your Personal Data.
If you have the right to lodge a complaint with a supervisory authority (for example in the EEA or UK), you may contact the supervisory authority in your habitual residence, place of work, or the place of the alleged infringement.
4. Relationship with Other Documents
This Privacy Policy forms part of HolidayCab’s legal framework and should be read together with:
Where required by law, we will obtain your explicit consent for certain Processing activities (for example, non-essential cookies, SDK-based marketing attribution, or newsletters where consent is required).
If you do not agree with this Privacy Policy, you should refrain from using the Platform and may request deletion of your account (where applicable), subject to legal retention obligations.
5. Amendments to This Privacy Policy
HolidayCab may update this Privacy Policy to reflect changes in legal requirements, technological developments, business practices, or the services offered through the Platform. The “Last updated” date at the top of this document indicates when the Privacy Policy was most recently revised.
Where changes are material, we will provide appropriate notice as required by law, for example by posting a prominent notice on the Platform, sending an email notification, or requesting renewed consent.
Continued use of the Platform after an updated Privacy Policy becomes effective constitutes acceptance of the revised terms, to the extent permitted by law.
6. General Principles of Processing
HolidayCab processes Personal Data in accordance with the following principles:
Lawfulness, fairness and transparency: Personal Data is processed lawfully, fairly and transparently. Purpose limitation: Personal Data is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Data minimisation: We process only the Personal Data that is necessary for the relevant purpose. Accuracy: We take reasonable steps to ensure Personal Data is accurate and kept up to date. Storage limitation: Personal Data is retained only for as long as necessary for the purposes for which it is processed. Integrity and confidentiality: Appropriate technical and organisational measures are implemented to protect Personal Data.
7. Children and Age Restrictions
The Platform and Services are intended for use by individuals who are at least eighteen (18) years of age. HolidayCab does not knowingly collect Personal Data from children below the age of 16 (or a higher age threshold where required by applicable law).
If you believe that a child has provided Personal Data to HolidayCab without appropriate consent, please contact us so that we can take appropriate action.
8. Categories of Personal Data We Process and How We Collect It
HolidayCab processes different categories of Personal Data depending on how you interact with the Platform and the services you use. We may collect data directly from you, automatically from your device, or from third parties (for example, partners, Drivers, or payment providers).
8.1 Data you provide directly to us
8.2 Data we collect automatically
Technical, device and log data When you access the Platform, we may collect technical information such as IP address, device identifiers, device model, operating system, browser type and version, app version, language settings, time zone, crash logs, and diagnostic information. We process this data to operate the Platform, ensure security, detect and prevent fraud, troubleshoot issues, and improve performance.
Usage and interaction data We may collect information about how you interact with the Platform, including pages viewed, features used, time spent, clicks, referral URLs, navigation patterns, and in-app events. Where required, this is subject to your cookie or tracking preferences.
Approximate location data In certain contexts, we may infer approximate location from IP address for purposes such as setting language/currency defaults, fraud prevention, or compliance. We do not require precise geolocation for core booking services unless you explicitly enable location permissions in a mobile app feature that uses it.
8.3 Data we receive from third parties
Partner bookings and integrations If you book through a hotel, travel agency, airline, airport, vacation rental platform, affiliate partner or other integrated third-party platform, we may receive booking-related data from that partner (for example, name, contact details, pick-up/drop-off, booking reference, and other information needed to fulfil the Transport Service). In such cases, the partner may also be an independent controller with respect to data collected directly by them.
Drivers and Driver Companies Drivers may provide information about completed Transfers, issues during service delivery, incident reports, or operational confirmations (for example, “picked up”, “no show”, or other service status information). This helps us manage bookings, support customers, and handle disputes.
Payment service providers Depending on payment method, we may receive transaction confirmations, limited card details (for example, last four digits), payment status, and chargeback information. HolidayCab does not store full card details.
Fraud and security service providers We may receive risk indicators, device reputation signals, or fraud scores to prevent misuse, protect payments, and secure the Platform.
Social login providers If you log in using a third-party account (if enabled), we may receive identifiers such as your name, email address and authentication token from the relevant provider.
9. Purposes of Processing and Legal Bases
HolidayCab processes Personal Data for specific purposes and relies on one or more lawful bases under applicable law. If you are in the EEA or UK, legal bases typically include: performance of a contract (Art. 6(1)(b) GDPR), compliance with a legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)), and consent (Art. 6(1)(a)). Where consent is required, we request it through appropriate mechanisms and you can withdraw it as described in Section 15.
9.1 Providing and managing bookings and the Platform (contract necessity)
We process Personal Data to create, administer and complete bookings, including to connect Travellers with Drivers, transmit booking details to the Driver/Driver Company, send booking confirmations and updates, manage cancellations, refunds, modifications, and provide operational notifications. This processing is generally necessary to perform the contract with you, or to take steps at your request prior to entering into a contract.
9.2 Account creation, authentication and user management (contract necessity and legitimate interest)
If you create an account, we process login credentials, account settings and related details to administer your account, authenticate access, maintain session security, and provide features such as booking history. This is performed to provide the requested service and to protect the Platform against unauthorized access and misuse.
9.3 Communications and customer support (contract necessity, legal obligation, legitimate interest)
We process Personal Data to respond to enquiries, provide customer support, manage complaints, handle refund requests, communicate about bookings, and document interactions. This may be necessary to perform our contract and is also based on our legitimate interest in providing effective support and ensuring quality. Where call recordings require consent, we rely on consent and provide notice at the time of recording.
9.4 Payments, invoicing and financial administration (contract necessity and legal obligation)
We process Personal Data to facilitate payments, issue invoices or receipts where applicable, reconcile transactions, manage refunds and chargebacks, and comply with accounting and tax obligations. Payment processing is usually necessary for contract performance and legal compliance.
9.5 Safety, fraud prevention, abuse detection and Platform integrity (legitimate interest and legal obligation)
We process technical, booking, device and payment-related data to detect and prevent fraud, chargeback abuse, unauthorized access, suspicious activity, and other misuse. This protects Travellers, Drivers and HolidayCab and supports safe Platform operation. In some cases, processing may be required to comply with legal obligations relating to security and crime prevention.
9.6 Service improvement, analytics and performance (legitimate interest and consent where required)
We process aggregated or pseudonymised usage and performance data to understand how the Platform is used, troubleshoot issues, improve booking flow, enhance usability, develop new features, and optimize service quality. Where the use of analytics cookies/SDKs requires consent, we rely on your consent choices.
9.7 Marketing communications and promotions (legitimate interest and/or consent)
We may process contact data and interaction data to send marketing communications, promote HolidayCab services, run offers, and measure campaign effectiveness. Depending on jurisdiction and context, we rely on consent or legitimate interest (for example, where permitted to market similar services to existing customers). You can opt out at any time as described in Section 13 and Section 15.
9.8 Legal compliance and enforcement (legal obligation and legitimate interest)
We may process Personal Data to comply with applicable laws, respond to lawful requests by authorities, enforce our Terms, establish or defend legal claims, and maintain records necessary for regulatory compliance.
10. Sharing of Personal Data and Recipients
HolidayCab does not “sell” Personal Data in the sense of transferring Personal Data for money. We may share Personal Data with recipients for the purposes described in this Privacy Policy, subject to appropriate safeguards.
10.1 Drivers and Driver Companies
To fulfil your booking, we share booking details with the Driver/Driver Company responsible for the Transport Service. This typically includes information necessary to pick you up, identify passengers, communicate about the Transfer, and execute the service, such as pick-up location, drop-off location, time, passenger name(s), and contact number (where needed). Drivers/Driver Companies may process such data as independent controllers for the purpose of providing the Transport Service and complying with their legal obligations.
10.2 Service providers (processors)
HolidayCab may engage third-party service providers to process Personal Data on our behalf as processors, for example:
Processors are bound by contractual obligations to process Personal Data only on our documented instructions, maintain confidentiality, implement appropriate security measures, and assist with compliance obligations.
10.3 Partners and distribution channels
If you book through a partner (for example, hotel, travel agency, affiliate, airline, airport, vacation rental platform), we may share booking status and operational confirmation information with that partner to support customer service, reporting, commission calculation or reconciliation. Such sharing is limited to what is necessary and governed by contractual and data protection safeguards. Partners may act as independent controllers for the data they collect directly.
10.4 Professional advisers and corporate transactions
We may disclose Personal Data to professional advisers (such as lawyers, auditors, accountants, banks, insurers) where necessary for business operations and legal compliance. In the event of a merger, acquisition, reorganization, sale of assets or similar transaction, Personal Data may be transferred as part of that transaction subject to confidentiality and legal protections.
10.5 Authorities and legal requests
We may disclose Personal Data to competent authorities (such as police, courts, tax authorities, regulators) where required by law, where necessary to protect rights, prevent fraud, or enforce our agreements, and where permitted by applicable law.
11. International Transfers
HolidayCab operates globally. Where Personal Data is transferred to recipients in countries outside the European Economic Area or the United Kingdom (where applicable), we implement appropriate safeguards as required by law, which may include:
You may request further information about the safeguards applicable to a specific transfer by contacting us at privacy@holidaycab.com. As part of the core operation of the Platform, HolidayCab shares certain booking and passenger-related Personal Data with the independent Driver or Driver Company assigned to perform the booked Transport Service. Because HolidayCab operates globally, such Drivers and Driver Companies may be located in countries outside the European Economic Area or the United Kingdom. In these cases, the transfer of Personal Data is necessary for the performance of the Transport Service contract between the Traveller and the independent Driver or Driver Company, and for HolidayCab’s legitimate role as an intermediary facilitating that contract.
12. Cookies, Tracking Technologies and Similar Tools
This section explains how HolidayCab uses cookies, SDKs, pixels, tags and similar technologies on its websites, mobile applications and booking tools, what these technologies do, and how you can control them.
12.1 What these technologies are
Cookies are small text files stored on your device when you visit a website. Similar technologies include pixels (small images or code snippets), tags, scripts, local storage, tracking URLs, and Software Development Kits (SDKs) in mobile apps. These technologies can help a Platform recognize your device, remember preferences, secure sessions, understand usage, and measure marketing performance.
Technologies may be first-party (set by HolidayCab) or third-party (set by providers acting on our behalf or, in limited cases, partners acting as independent controllers).
12.2 Why we use cookies and tracking technologies
HolidayCab uses these technologies to support the following objectives:
12.3 Categories of cookies and technologies
Strictly necessary technologies These are essential for the operation of the Platform and cannot be disabled through our consent banner because the Platform would not function properly without them. They support features like secure access, session management, fraud prevention, booking workflows and load balancing.
Functional technologies These remember your settings and choices, such as preferred language, region, or saved preferences. They improve usability but are not always strictly required for core functionality.
Analytics and performance technologies These collect information about how users interact with the Platform, including navigation patterns, feature usage, time spent, and technical errors. Where required by law, these are used only with your consent.
Marketing and advertising technologies These are used to measure advertising effectiveness, attribute bookings to campaigns, limit ad frequency, and (where permitted) show relevant ads on third-party platforms. These are used only where permitted by law and subject to your consent where required.
12.4 Website cookies
On the HolidayCab website, cookies may be placed by HolidayCab or by approved third-party providers. Cookies may be session cookies (deleted when you close your browser) or persistent cookies (stored for a defined period). Data processed via cookies may include browser type, device information, IP address (sometimes shortened or pseudonymised), referral URL, timestamps, interaction events, and usage statistics.
12.5 Mobile apps, SDKs and app store disclosures
HolidayCab mobile applications may use SDKs and similar tools that collect information such as device model, operating system version, app version, language settings, device identifiers (including advertising identifiers where enabled), crash logs, and in-app events. These SDKs may support analytics, security, anti-fraud protections, customer support functions, push notifications, and marketing attribution (where permitted and subject to your consent where required).
You can manage certain app permissions through your device settings, such as advertising identifiers, tracking permissions (where applicable), and push notifications. Disabling certain permissions may affect specific app features but will not necessarily prevent core booking functionality.
HolidayCab aims to ensure that disclosures required by Apple App Store and Google Play policies are covered by this Privacy Policy. If the Platform uses features that require additional just-in-time prompts (for example, tracking permissions), the app will display those prompts when required.
12.6 Consent management and how to control tracking
Where required by law, HolidayCab obtains your consent before placing or activating non-essential cookies or tracking technologies. You can manage your preferences at any time through:
If you block all cookies, parts of the Platform may not function properly (for example, login persistence or preference storage). Withdrawing consent does not affect the lawfulness of processing conducted before the withdrawal.
12.7 Email tracking
Emails sent by HolidayCab may include tracking technologies (such as pixels) to determine whether an email was delivered, opened or clicked. This helps us improve communication quality and relevance and measure performance of service notifications and marketing messages. You can opt out of marketing emails using the unsubscribe link in each marketing email. Transactional messages (such as booking confirmations) are not subject to marketing opt-out because they are necessary to provide the service.
12.8 Do Not Track signals
Some browsers offer “Do Not Track” signals. There is no universally accepted standard for responding to such signals. HolidayCab primarily relies on consent tools and preference settings described above to manage tracking choices.
13. Marketing, Profiling and Personalized Advertising
HolidayCab may process Personal Data for marketing and customer engagement, always in accordance with applicable law and your rights.
13.1 Marketing communications
HolidayCab may send communications via email, SMS, push notifications or similar channels for one or more of the following reasons:
Where consent is required for marketing, we will request it. Where marketing is permitted on legitimate interest grounds (for example, marketing similar services to existing customers where allowed), we will provide an easy opt-out mechanism.
You can opt out of marketing at any time by using the unsubscribe link in a marketing email, adjusting notification settings (where available), or contacting us. Opting out does not stop service messages that are necessary to fulfil your booking.
13.2 Personalization and profiling
HolidayCab may analyze certain data about your interactions with the Platform (such as booking history, preferred routes, device settings and interaction with messages) to personalize content, improve user experience, and show relevant recommendations. This does not typically produce legal or similarly significant effects. Where profiling is used for marketing and requires consent under applicable law, we rely on your consent choices.
You may object to processing based on legitimate interest, including profiling for marketing, as described in Section 15.
13.3 Advertising and remarketing
HolidayCab may use advertising technologies to promote services across third-party platforms. Where required, these technologies are activated only after your consent via cookie/consent tools. You can withdraw consent and manage preferences as described in Section 12.
14. Payments, Fraud Prevention and Automated Decision-Making
14.1 Payments
Payments are processed using secure third-party payment service providers. HolidayCab does not store full payment card details. Depending on payment method, we may process your name, billing address, email, payment amount, transaction identifiers, partial card information (such as last four digits) and payment status confirmations.
Payment processing is carried out to perform the contract with you and to comply with legal and accounting obligations. Payment providers may act as independent controllers for their processing and you should review their privacy policies where relevant.
14.2 Fraud prevention and security monitoring
HolidayCab has a legitimate interest in protecting the Platform, Travellers, Drivers and partners against fraud, unauthorized transactions, chargebacks, and misuse. We may process booking data, payment signals, device identifiers, IP address, and behavioral indicators to detect suspicious activity. Fraud prevention may involve specialized providers that process data under contractual safeguards.
14.3 Chargebacks and disputes
If a chargeback or payment dispute occurs, we may share relevant booking and transaction information with payment providers, banks, and risk/chargeback service providers to investigate and resolve the dispute, protect our legal rights, and prevent future abuse.
14.4 Automated decision-making
In limited circumstances, HolidayCab may use automated processes (including fraud scoring) to identify high-risk transactions or activity. This may result in actions such as additional verification requests, temporary restrictions, or rejection of a transaction. Where Article 22 GDPR applies, you have the right to request human intervention, express your view, and contest the decision by contacting us.
15. Your Rights and How to Exercise Them
This section explains rights that may apply depending on your location and the laws that govern processing.
15.1 EEA and UK rights (GDPR / UK GDPR)
15.2 United States rights (including California)
Where applicable under U.S. state privacy laws, you may have rights such as:
We may need to verify your identity before fulfilling a request. Where allowed, an authorized agent may submit requests on your behalf.
15.3 How to submit a request
To exercise rights, contact us at privacy@holidaycab.com and describe your request clearly. We may request additional information to verify identity and prevent unauthorized access. We respond within the timeframes required by applicable law. Requests are generally free of charge unless manifestly unfounded, excessive, or repetitive.
16. Data Retention, Storage Periods and Deletion
We retain Personal Data associated with your user account for as long as your account remains active. If you do not delete your account, we may consider it inactive after a prolonged period without meaningful interaction. In such cases, account data may be restricted, anonymised or deleted, typically after approximately two (2) years from your last activity, unless retention is required for legal, security, fraud-prevention or contractual reasons.
If you request deletion of your account, we will delete or anonymise account-related Personal Data without undue delay, except where continued retention is required to comply with legal obligations or to establish, exercise or defend legal claims.
We process Personal Data for the time necessary to create, manage and administer a booking request, quotation or Transfer order, including any time required to handle modifications, cancellations, refunds, complaints, claims or disputes.
Where you book a Transfer, we retain Personal Data relating to that Transfer for as long as required to complete the service and comply with applicable legal obligations, including tax, accounting and statutory limitation requirements.
In practice, this means that booking, transaction and invoicing records may be retained for several years (typically between five (5) and ten (10) years) depending on the jurisdiction and applicable law.
After this period, identifiable Personal Data is deleted or anonymised. We may retain aggregated or anonymised Transfer data indefinitely for statistical, analytical and business intelligence purposes.
If you contact HolidayCab’s Customer Support, we create records of your enquiry and our response. These records are retained for as long as they remain relevant to our relationship with you, including for quality assurance, dispute handling and legal documentation.
Temporary records may be retained only briefly until more permanent records are created and will then be deleted. Call recordings, where used lawfully and with appropriate notice, are retained only for the disclosed period and are then deleted or anonymised.
We process technical, usage and interaction data for as long as necessary to perform specific analytical actions, such as usability testing, performance monitoring or quality surveys.
Where possible, such data is anonymised or aggregated at an early stage. Once anonymised, it no longer constitutes Personal Data and may be retained for longer periods for service improvement and analytics.
We retain Personal Data used for marketing purposes until:
Where permitted by law, marketing data may otherwise be retained for a maximum period of approximately five (5) years.
Certain elements of your marketing profile (such as engagement history or interaction records) are automatically deleted after a defined period, typically around three (3) years, depending on the purpose for which the data was collected.
If there has been no meaningful interaction with you for a prolonged period (generally around three (3) years), we may stop sending promotional communications and delete related interaction history. This may occur, for example, if you never open marketing emails, never log in, never make a booking, or never contact Customer Support, as we assume that continued communication is no longer desired.
Business analytics data is typically collected automatically when you interact with HolidayCab’s websites, applications or booking tools. Such data is anonymised or aggregated shortly after collection and is then used for statistical analysis, reporting and service improvement.
Anonymised and aggregated data does not identify you and may be retained indefinitely, as it no longer constitutes Personal Data under applicable law.
Personal Data may remain in encrypted backup systems for a limited period as part of HolidayCab’s standard disaster recovery and business continuity procedures. Backup data is not actively processed and is overwritten or deleted according to predefined schedules. Where deletion is not immediately feasible, access is restricted until deletion occurs.
17. Data Security, Confidentiality and Integrity
HolidayCab implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risk, in accordance with applicable law (including Article 32 GDPR). These measures are intended to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
Security measures may include encryption in transit (such as HTTPS/TLS), encryption or hashing of sensitive data where appropriate, role-based access controls, logging and monitoring, backup and resilience measures, segregation of environments, and regular security updates and patches.
Organisational safeguards include internal policies, confidentiality obligations for staff and contractors, training, access limitation on a need-to-know basis, and vendor due diligence for processors and partners.
Users are responsible for maintaining the confidentiality of their account credentials. If you suspect unauthorized access to your account, you should inform HolidayCab without delay. HolidayCab does not store full payment card details. Payment processing is handled by certified payment providers that comply with applicable security standards (such as PCI DSS). HolidayCab maintains procedures to detect, investigate and respond to security incidents. Where a Personal Data breach is likely to result in a risk to individuals, HolidayCab will notify competent supervisory authorities and affected individuals as required by law. No method of transmission over the internet or electronic storage is completely secure. While HolidayCab uses commercially reasonable protections, absolute security cannot be guaranteed. 18. Final Provisions, Governing Law, and Contact HolidayCab may amend this Privacy Policy as described in Section 5. This Privacy Policy should be read together with HolidayCab’s Terms and Conditions and related policies. If any provision is held invalid or unenforceable, the remaining provisions remain in effect. This Privacy Policy is governed by the law specified in HolidayCab’s Terms and Conditions, without prejudice to mandatory data protection laws applicable in your place of residence. If you have any questions or wish to exercise your rights, contact: privacy@holidaycab.com.
Imported from source document · published 2 October 2026
