Privacy Policy

This Privacy Policy explains how Bright Travel Solutions Ltd, trading as BTSCARS (“we”, “us”, “our”), collects, uses, stores, shares and protects personal data when you visit our website, create an account, request a quotation, make or manage a booking, contact us, or otherwise use our services.

Nothing in this policy limits your rights under UK data protection law (including UK GDPR and the Data Protection Act 2018).

1. Who we are

Controller: Bright Travel Solutions Ltd, trading as BTSCARS.

| | | |---|---| | Company number | 16414467 | | Registered office | 18 Marlesford Court, 8 Marlesford Court, Rectory Lane, Wallington, United Kingdom, SM6 8DY | | Contact | privacy@btscars.com (data protection / privacy) · booking@btscars.com (bookings) |

We provide pre-arranged UK private hire and airport transfers. We are the data controller for personal data collected through this website and related booking and support channels. Journeys are fulfilled using licensed private hire drivers and vehicles under applicable UK licensing regimes.

Companies House: company 16414467.

2. Scope

This policy applies to personal data processed through our website, customer accounts, quotations, bookings, payments, amendments, cancellations, and service communications (email, SMS, WhatsApp, or similar).

It also applies where you book for another passenger and provide their details. If you provide someone else’s information, you must be authorised to do so and they should understand it will be used to arrange the journey.

3. What we collect

Depending on how you use our services, we may process:

• Identity & contact: name, email, phone number, account identifiers.
• Authentication: email/password credentials (stored hashed), phone OTP challenges, Google Sign-In tokens/identifiers when you choose Google, session cookies.
• Booking & journey: pickup/drop-off addresses and coordinates, waypoints, scheduled times, passenger and luggage counts, vehicle class, flight numbers or other travel references you provide, booking reference and status history, special requirements or notes you add.
• Passenger details: where the booker is not the traveller, passenger name and contact details needed for pickup.
• Payment metadata: payment method type (card via Stripe, PayPal, or cash), amount, currency, status, provider transaction/refund identifiers. We do not store full card numbers — card data is handled by Stripe or PayPal.
• Profile: optional avatar image and profile preferences.
• Communications: emails, SMS/WhatsApp content we send or receive about your booking, and support messages.
• Technical & security: IP address, device/browser information, approximate location derived from IP where relevant to security, bot-protection tokens (Cloudflare Turnstile), cookie and similar-technology data (see our Cookie Policy).
• Maps usage: address search and map interactions via Google Maps / Places when you use location features.
• Activity logs: security and account events (for example sign-in, profile changes) and operational audit records needed to run the service safely.

4. How we use your data (purposes & legal bases)

| Purpose | Examples | Typical legal basis | |---|---|---| | Provide the service | Quotes, accounts, OTP, bookings, dispatch, trip updates | Contract / steps prior to contract | | Payments & refunds | Stripe/PayPal checkout, cash recording, refunds | Contract / legal obligation / legitimate interests | | Fraud, abuse & security | Turnstile, rate limits, chargeback defence, account security | Legitimate interests / legal obligation | | Support | Email / WhatsApp / phone enquiries | Contract / legitimate interests | | Legal & accounting | Tax, regulatory, dispute records | Legal obligation / legitimate interests | | Improve the site | Optional analytics only after you opt in via the cookie banner | Consent (where required) / legitimate interests for strictly necessary tech |

We do not sell your personal data.

5. Service messages vs marketing

You agree to receive service communications about quotations, bookings, payments, driver assignment, amendments, cancellations, and refunds (email and, where configured, WhatsApp/SMS).

Marketing messages require separate consent where the law requires it, and you can withdraw that consent at any time.

6. Who we share data with (processors & recipients)

We only share what is necessary with:

| Category | Examples (may change) | Role | |---|---|---| | Licensed drivers / operators | Assigned driver fulfilling your booking | Recipients as needed to perform the journey | | Payments | Stripe; PayPal | Processors / independent controllers for payment | | Communications | Twilio (Email API / SendGrid path, SMS, WhatsApp) | Processors | | Maps & sign-in | Google Maps / Places; Google Identity | Processors | | Bot protection | Cloudflare Turnstile | Processor | | Hosting & database | Our application host and managed Postgres (e.g. Neon) | Processors | | Advisers / authorities | Accountants, insurers, police, regulators, courts | Where required by law or to protect rights |

Drivers may contact you using the details on the booking where reasonably needed to complete pickup.

International transfers (for example US-based processors such as parts of Stripe, PayPal, Google, Twilio or Cloudflare) rely on appropriate safeguards required by UK law (such as UK IDTA / standard contractual clauses or an adequacy decision), where applicable.

7. Chargebacks and payment disputes

If a payment is disputed, reversed or charged back, we may process and disclose booking, payment, journey and communication records reasonably necessary to investigate and respond — including to payment providers, card networks and banks.

8. How long we keep data

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. Indicative periods:

• Bookings, invoices and payment records: around 6 years (tax and accounting).
• Support messages: typically up to 24 months.
• Account data: while the account is active, then as needed for legal retention or dispute defence.
• OTP challenges: short-lived, then deleted or expired automatically.
• Cookies / local storage preferences: see the Cookie Policy.

We may retain data longer where reasonably necessary for an existing or anticipated claim, fraud investigation or regulatory matter.

9. Your rights (UK GDPR)

You may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability. Where we rely on consent, you can withdraw it at any time (this does not affect processing already carried out).

To exercise your rights, email privacy@btscars.com with enough detail for us to verify your identity and respond.

You can also complain to the UK Information Commissioner’s Office (ICO): ico.org.uk. We encourage you to contact us first so we can try to resolve your concern.

10. Cookies and similar technologies

We use strictly necessary cookies (for example session authentication) and may use optional analytics only after you choose them in our cookie banner. Details and controls: Cookie Policy. Footer Cookie settings lets you change non-essential preferences later.

11. Security

We use appropriate technical and organisational measures (including encrypted transport, hashed passwords, access controls and audit logging). No method of transmission or storage is completely secure; you use the internet at your own risk once you send information to us.

12. Children

Our online booking service is intended for adults (18+). We do not knowingly create accounts for children. Child seats or child passengers may be booked by a responsible adult who remains responsible for the child’s data and safety.

13. Changes

We may update this policy from time to time. The version on this page is current. Material changes are reflected by updating the published date (document version). Where required by law we will provide additional notice or seek consent.