Driver Privacy Notice

Who we are

Zippe Transport Ltd ("Zippe") provides passenger transport services and engages Drivers to deliver those services. We are the data controller for Driver personal data.

Zippe uses the Zippe App, licensed from Zippe App Ltd, to support trip allocation, navigation, safety monitoring and payments. Zippe App Ltd acts as a technology service provider processing data on our behalf under contractual safeguards.

Contact: dataprotection@zippe.co.uk

You may complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.

What the Zippe Drivers Privacy Notice covers

This notice explains how Zippe collects, uses, stores and shares personal data when you register as a Driver, complete onboarding and compliance checks, carry out trips, receive payment, or interact with Zippe in connection with transport services.

Driver responsibility

You are responsible for ensuring that the information you provide, including licensing, insurance and compliance documentation, is accurate and kept up to date.

Personal data Zippe collects

• Identity and contact: name, date of birth, address, national insurance number, contact details, photograph, ID documents.
• Compliance and eligibility: driving licence, right to work, DBS/vetting outcomes, insurance, training and safeguarding records.
• App and usage: login activity, device identifiers, IP address, usage logs.
• Location and trip: real-time and historical location while in driver mode, routes, timestamps, journey identifiers.
• Financial: bank details, earnings calculations, self-billing records, remittances and accounting records.
• Communications: in-app messages, emails, calls, complaints and incident reports.

How Zippe uses your data and lawful bases

• Onboarding and access to work – Contract / steps prior to contract.
• Trip allocation and service delivery – Contract.
• Payments and records – Contract and legal obligation.
• Legal, regulatory and tax compliance (including HMRC platform reporting where required) – Legal obligation.
• Safety, safeguarding and fraud prevention – Legitimate interests and legal obligation.
• Service improvement and analytics – Legitimate interests.

DBS and criminal offence data

Where required, Zippe processes DBS and related vetting information for eligibility and safeguarding, subject to enhanced protections, restricted access and limited retention.

Location data

While logged into driver mode, Zippe collects precise location data to allocate trips, provide navigation and ETAs, and support safety and dispute resolution. Tracking ends when you exit driver mode, except where limited retention is required for incidents or legal obligations.

Automated decision-making

Automated systems are used for trip matching and to identify potential fraud or safety risks. These may trigger checks or temporary restrictions. Decisions with significant impact are subject to human oversight.

Sharing

Zippe may share data with Zippe App Ltd (technology provider), passengers (limited trip-related information), payment and compliance providers, and regulators or authorities where legally required. This may include information relating to DBS checks or safeguarding information. This is on the basis of legal obligations and legitimate interests.

We do not sell Driver data.

How long do we keep your personal data?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

International transfers of personal data

Zippe uses a number of external companies (data processors), and their products and services to process personal data, some of which may be workforce or user personal data. This may include transferring your personal data outside of the United Kingdom. Where this takes place Zippe Transport Ltd will:

• Use companies that keep data within the European Economic Area or other jurisdiction which is considered by the UK government and Information Commission to provide a standard of data protection that is not materially lower than the UK (previously called 'adequate'); or
• Put in place contractual protections which provide additional safeguards for the processed data, in line with UK law or statutory guidelines issued by the Information Commission from time to time.

Personal data may be processed in the following jurisdictions:

• Australia
• The European Union
• The United States of America.

Data Security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We have put in place procedures to deal with any suspected data security breach and will notify you and the Information Commissioners Office of a suspected or confirmed breach where we are legally required to do so.

Where we engage third parties to process personal data on our behalf, they do so on the basis of written instructions contained within a contract, are under a duty of confidentiality and are obliged to implement appropriate technical and organisational measures to ensure the security of personal data.

Your rights in relation to this process

As an individual you have certain rights regarding our processing of your personal data.

Under certain circumstances, by law you have:

• The right to make a complaint about how we are processing your personal data.
• The right to request access to your personal data (commonly known as a "data subject access request").
• The right to request correction of the personal data that we hold about you.
• The right to request erasure of your personal data. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• The right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party).
• The right to request the restriction of processing of your personal data.
• The right to request the transfer of your personal data to another party.
• The right to withdraw consent of processing.

To exercise your rights or to make a complaint, please contact the Data Protection Manager using the contact details at the top of this privacy notice.

We may request specific information from you to help us confirm your identity, pursuant to a request to exercise your rights, and where deemed appropriate to ensure that your personal data is not disclosed incorrectly.

It is important that the personal data we hold about you is accurate and up to date. Please keep us informed if your personal information changes.

You also have the right, at any time, to lodge a complaint with the Information Commissioner's Office:

• Online at: Make a complaint about how an organisation has used your personal information | ICO
• Telephone: 0303 123 1113
• Or write to: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF