Privacy Policy

When you book, we collect your name, email address, phone number, billing address, date of birth, driving licence number and licence image, and the details of your reservation. For chauffeured trips we also collect pickup and drop-off addresses and any passenger names you give us.

When you simply browse, we collect the pages you view, the approximate city your network address maps to, your device and browser type, and how you arrived at the site.

Partner applicants provide business information as well: entity details, tax identification numbers, insurance certificates, registrations and the documents attached to an application.

To take and fulfil reservations, verify that a driver is eligible, dispatch chauffeurs, bill correctly, respond to damage or insurance claims, meet our licensing obligations, prevent fraud, and improve the service.

We do not sell personal information, and we do not share it with data brokers or advertising networks for their own use.

Card numbers are entered directly into our payment processor and are never stored on our own servers. We retain only the card brand, the last four digits, the expiry month and a processor token used to charge an authorised amount.

Our processors are PCI-DSS Level 1 certified. Refunds and security-hold releases run back through the same token, which is why a refund returns to the original card and cannot be redirected.

Our vehicles carry telematics units that record position, speed, harsh braking, mileage and fuel or charge level. This data exists for recovery of a stolen vehicle, roadside assistance, accurate mileage billing and accident reconstruction.

We do not monitor live position for any other purpose, we do not share route history with third parties except an insurer or law enforcement acting on a valid request, and we do not use it to profile you. Trip location data is deleted ninety days after a reservation closes unless it is attached to an open claim.

The mobile application asks for your device location only while you are locating a vehicle or tracking an inbound chauffeur. You can refuse that permission and still use every other part of the service.

We use strictly necessary cookies to keep you signed in and to hold your booking in progress. These cannot be switched off without breaking the service.

We use a small set of analytics cookies to count visits and see which pages fail people. They are set only after you accept them, and they carry no advertising identifier.

Blocking cookies in your browser will not stop you browsing the site, but it will sign you out between pages and clear an unfinished booking.

Reservation and billing records are kept for seven years to satisfy tax and insurance requirements. Driving licence images are deleted twelve months after your last reservation. Telematics trip data is deleted after ninety days. Marketing contact records are deleted two years after your last interaction.

Where a record is attached to an open claim, dispute or legal hold, we keep it until that matter closes and then apply the schedule above.

Chauffeurs and detailers receive only what they need to work your reservation: your first name, contact number, the addresses involved and any access note you leave.

Host partners whose vehicle you rent receive the reservation dates, the mileage driven and any damage report. They do not receive your contact details, your payment data or your route history.

Insurers, claims adjusters and, where a valid subpoena or court order requires it, law enforcement, receive what the specific matter requires and nothing beyond it. Our payment processor, email provider, telematics vendor and cloud host process data on our instructions under written agreements.

We send reservation confirmations, chauffeur updates and safety notices to everyone with a live booking. Those are service messages and cannot be turned off while a reservation is active.

Anything promotional is opt-in, and every promotional email carries a one-click unsubscribe that takes effect immediately. Text messages stop when you reply STOP.

Data is encrypted in transit with TLS and at rest with AES-256. Access inside the company is role-based, logged and reviewed quarterly. Staff accounts require two-factor authentication.

If a breach affects your personal information we will tell you and the relevant regulator within seventy-two hours of confirming it, describe what was taken, and say what we are doing about it.

The service is for adults. We do not knowingly collect information from anyone under sixteen, and children travel only as passengers of a booking adult. If you believe a child has given us information, write to us and we will delete it.

California residents may request the categories and specific pieces of personal information we hold, ask us to delete it, correct it, or limit the use of sensitive information, and may not be treated differently for asking. We do not sell or share personal information as those terms are defined in the CCPA and CPRA.

Residents of the European Economic Area and the United Kingdom may access, correct, erase, restrict or port their data, and may object to processing carried out on the basis of our legitimate interests. Where we rely on consent, you may withdraw it at any time.

To exercise any of these rights, email [email protected] with the words "privacy request" in the subject line. We verify identity through the email address on your reservation and respond within thirty days.

Our privacy contact is the Legal Department, Vava Van Holdings LLC, 2001 Ross Avenue, Suite 700, Dallas, TX 75201, [email protected].

If you are not satisfied with our answer, you may complain to your state attorney general, the California Privacy Protection Agency, the UK Information Commissioner or your national data protection authority, depending on where you live.