POL041/SK/12082025/v15 – Public

Page

PASSENGER PRIVACY POLICY

INTRODUCTION

We are Veezu Holdings Limited. If you need it, our company number is 09378357 and our registered office is

Hodge House, 114-116 St. Mary Street, Cardiff, CF10 1DY. Veezu Holdings Limited is the controller of your

personal information and is responsible for your personal information. All references in this policy to "Veezu",

"our", "us", or "we" refer to Veezu Holdings Limited, and its holding companies and subsidiaries defined below,

who are all committed to protecting the privacy and security of your personal information

“Veezu Company” means any company which at the relevant time is a subsidiary or holding company of

Veezu Holdings Limited of Hodge House, 114-116 St. Mary Street, Cardiff, CF10 1DY or any subsidiary of any

such holding company, and “subsidiary” and “holding company” shall have the meanings given to them

by the Companies Act 2006 Section 1159.

This privacy notice sets out how we process your personal information as a passenger using our booking

services. This policy is not intended for children, and we do not knowingly collect data relating to children.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to

this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your

legal rights), please contact t us using the information set out in the contact details section.

It is important that you read this privacy notice so that you are aware of how and why we are using your

personal information.

WHAT THIS POLICY CONTAINS

1. YOUR RIGHT TO OBJECT

2. INFORMATION ABOUT OTHER INDIVIDUALS

3. WHAT PERSONAL INFORMATION DO WE COLLECT ABOUT YOU?

4. WHEN DO WE COLLECT YOUR PERSONAL INFORMATION?

5. WHY DO WE COLLECT YOUR PERSONAL INFORMATION?

6. DISCLOSURE OF YOUR INFORMATION

7. PAYMENTS

8. TELLING YOU ABOUT OUR SERVICES

9. COOKIES AND RELATED SOFTWARE

10. TRANSFERRING PERSONAL DATA OUTSIDE OF THE UK

11. HOW DO WE KEEP YOUR PERSONAL INFORMATION SECURE?

12. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION FOR?

13. CHANGES TO YOUR PERSONAL INFORMATION

14. WHAT ARE OUR OBLIGATIONS?

15. YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION

16. CONTACT

17. CHANGES TO OUR PRIVACY POLICY

POL041/SK/12082025/v15 – Public

Page

YOUR RIGHT TO OBJECT

You have various rights in respect of our use of your personal information as set out in Section 15. Two of the

fundamental rights to be aware of are that:

1. you may ask us to stop using your personal information for direct-marketing purposes. If you exercise

this right, we will stop using your personal information for this purpose.

2. you may ask us to consider any valid objections which you have to our use of your personal information

where we process your personal information on the basis of our, or another person’s legitimate interest.

INFORMATION ABOUT OTHER INDIVIDUALS

If you give us information on behalf of a third party, and we are satisfied that you have demonstrated that

you have sufficient authority to act on behalf of that third party, you confirm that the third party has appointed

you to act on his/her/their behalf and has agreed that you can: give consent on his/her/their behalf to the

processing of his/her/their Personal Information; that you will make them aware of this data protection notice;

and give consent to the transfer of his/her/their Personal Information abroad (if applicable).

WHAT PERSONAL INFORMATION DO WE COLLECT ABOUT YOU?

We process the following categories of personal information about you:

 personal information, including your name, current residential address, pickup address, destination

address, email address or your phone number;

 any payment related information that you provide, including bank account details, credit card

details, banking address and account name;

 information that you provide to us regarding your health so that we can provide you with a suitable

vehicle;

 your GPS location;

 medical information which you provide to us, only where we need to procure the provision by a

Driver Partner of a vehicle suitable for your needs (where you have specifically asked us for this) and

you have provided details about your health which are necessary for us to ensure a suitable vehicle;

and

 details of any enquiries made by you through the website or by phone. We will monitor and record

communications with you (such as telephone conversations and emails) for the purposes of provision

of services, quality assurance, complaint investigation, training, fraud prevention and compliance

purposes. Any information that we receive through such monitoring and communication will be

added to the information we already hold about you and will also be used for the purposes listed

above.

Please note that in compliance with data protection legislation, we will process your personal information

without your knowledge or consent where this is required or permitted by law.

WHEN DO WE COLLECT YOUR PERSONAL INFORMATION?

When you use our website, web booking portal, mobile device booking application, telephone us, sign up to

our newsletters or alerts, or create an account with us when using our services or those of our Driver Partners.

WHY DO WE COLLECT YOUR PERSONAL INFORMATION?

Under data protection legislation we may only process your personal information if we have a legal basis (i.e.,

a legally permitted reason) for doing so. For the purposes of this Policy, our legal basis for processing your

Information is set out below:

a) The processing of the information listed below is necessary for the performance of the contract

between us, enabling us to;

 provide or procure the provision of services to you and the administration related to those services

such as arranging billing, taking payments (for more information please see below), chasing

payments, issuing email receipts, sending you alert notifications about the service you have ordered

and received via SMS, push notification or telephone (see further information below under “Telling

you about our services”; investigate and address any comments, queries or complaints made by

POL041/SK/12082025/v15 – Public

Page

you regarding the website and/or our services, acting as intermediary between you and our Driver

Partners and any similar or related comments, queries;

 ensure that content from the website is presented in the most effective manner for you and for your

device;

 monitor the frequency and length of time you use our services and those of our Driver Partners to

ensure the smooth running of the services we provide to you, in accordance with 'Your Rights as set

out in this Policy'; and

 allow you to participate in interactive features of the website and electronic booking applications,

including inputting information and providing feedback.

b) You have provided your consent to the processing, enabling us to:

 process your personal information for marketing purposes where we are required to obtain your

consent by law (which you may withdraw at any time after giving it, as described in the Telling You

About Our Services' section below and

 process your sensitive personal information where we need to procure the provision by a Driver

Partner of a vehicle suitable for your needs (where you have specifically asked us for this) and you

have provided details about your health which are necessary for us to ensure a suitable vehicle.

c) The processing is necessary for Veezu’s legitimate interests so that we can:

 contact you for marketing purposes (and you are given the option to opt-out at any time) pursuant

to our legitimate interest to promote and develop our business. Please see the ' Telling You About

Our Services' section below for further information;

 research into usage and behaviour pursuant to our legitimate interest in improving and changing

our services, including personalisation to your needs, such as listing previously used

addresses/destinations, operating, administering, maintaining, providing, analysing and improving

the website and the services available to you through the website or by phone; and

 notify you about changes to the website pursuant to our legitimate interest in communicating

changes which may impact our users' use of our services.

d) The processing is necessary to protect vital interests, for example:

 in the rare instance where we process personal information to save someone’s life.

e) The processing is necessary to comply with a legal obligation Veezu is under, for example:

 any request or order from law enforcement agencies and/or HMRC in connection with any

investigation to help prevent unlawful activity.

DISCLOSURE OF YOUR INFORMATION

We will disclose your personal information to:

 other companies within our group of companies (i.e., the subsidiaries outlined in the 'Introduction'

section);

 our business partners, service providers who are providing services under a separate contract with

you, such as our Driver Partners, or our third-party contractors and advisors such as DiSC telephony

and iCabbi dispatch providers (and any business partners, service providers or third-party contractors

of any other companies within our group of companies) to enable them to undertake services for us

and/or on our behalf;

 our third-party payment providers such as Judo and AirPay (please see the 'Payment' section in our

Passenger Terms and Conditions shown on our website(s) for more information);

 any prospective buyer or seller (and their representatives) in the event that we sell or buy any business

or assets;

 HMRC, other government departments and regulators, in order to comply with any legal obligation;

 other lawyers, insurers or other advisers in respect of any claims brought by passengers / driver

partners / general public. This includes sharing information in connection with legal or insurance

claims to protect the rights and safety of others;

 (in the case of aggregated/anonymous information i.e., information from which you cannot be

personally identified, or insights based on such anonymous information), selected third parties,

POL041/SK/12082025/v15 – Public

Page

including (without limitation) analytics and search engine providers to assist us in the improvement

and optimisation of the website. In such circumstances we do not disclose any information which

can identify you personally; and

 (if our whole business is sold or integrated with another business) our advisers and any prospective

purchasers and their advisers and will be passed on to the new owners of the business.

 the NHS Test and Trace contact-tracing service.

TELLING YOU ABOUT OUR SERVICES

Communicating with passengers is an essential part of providing a reliable and trustworthy licensed taxi/

private hire service. We will therefore contact you by telephone, text, via the app or by email in relation to

non-marketing, service-related communications to:

 update you on the progress of your booking;

 remind you of any public health guidance applicable to your journey; and

 ask for feedback on your journey.

We send out marketing communications based on our legitimate interests of running a licensed taxi/ private

hire booking service and keeping people informed about the services we and our Driver Partners and other

service providers offer where:

 we send you information via post; or,

 if you are dealing with us on behalf of a business and we contact you via your corporate email

address;

We will only contact consumer customers, sole traders and non-limited liability partnerships by personal email

for marketing purposes if:

 you have given your consent; or

 you have previously bought goods and services from us and we are contacting you to let you know

about similar goods and services that we offer.

You have the right at any time to ask us, or any third party, to stop processing your information for direct

marketing purposes, please see 'Your Rights in Relation to Your Personal Information' below.

COOKIES AND RELATED SOFTWARE

Please see our separate Cookies Policy on any of our websites for further information about how we use

cookies.

TRANSFERRING PERSONAL DATA OUTSIDE OF THE UK

We may transfer your Personal Data to countries outside of the UK and these countries may have data

protection rules that are different from the UK. To ensure that any of your personal information that is

transferred outside of the UK receives an adequate level of protection, appropriate measures are in place to

ensure that your personal information is treated by those third parties in a way that is consistent with and

which respects UK law on data protection.

HOW DO WE KEEP YOUR PERSONAL INFORMATION SECURE?

We have put in place measures to protect the security of your personal information both in accordance with

the requirements of the UK GDPR, the DPA 2018 and the ISO 27001 Information Security Standard. Third parties

will only process your personal information on our instructions and where they have agreed to treat the

information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being

accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access

to your personal information to those employees, agents, contractors and other third parties who have a

POL041/SK/12082025/v15 – Public

Page

business need to know. They will only process your personal information on our instructions, and they are

subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and

any applicable regulator of a suspected breach where we are legally required to do so.

HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION FOR?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected

it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe

there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and

sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal

data, the purposes for which we process your personal data and whether we can achieve those purposes

through other means, and the applicable legal, regulatory, tax, accounting or other requirements

 we hold your personal information for up to a maximum of 7 years from when it was last used to

comply with legislation and local authority rules that we are subject to; and/or

 where we are processing on the basis of consent only, we hold the Information until consent is

withdrawn.

 In some circumstances we will anonymise your personal data (so that it can no longer be associated

with you) for research or statistical purposes, in which case we may use this information indefinitely

without further notice to you

If required, we will be entitled to hold personal information for longer periods to comply with our legal or

regulatory obligations.

In some circumstances you can ask us to delete your data: see the paragraph “YOUR RIGHTS IN RELATION TO

YOUR PERSONAL INFORMATION “for further information.

CHANGES TO YOUR PERSONAL INFORMATION

It is important that the personal information we hold about you is accurate and current. Please keep us

informed if the personal information you have given to us either when you downloaded our App or when you

opened an account, changes during your relationship with us.

WHAT ARE OUR OBLIGATIONS?

Under data protection legislation, we are a Data Controller and therefore we are responsible for, and control

the processing of, your personal information. Such information must be protected in accordance with data

protection legislation.

In accordance with data protection legislation your personal information will be;

 used lawfully, fairly and in a transparent way;

 collected only for valid purposes that we have clearly explained to you and not used in any way

that is incompatible with those purposes;

 relevant to the purposes we have told you about and limited only to those purposes;

 accurate and kept up to date;

 kept only as long as necessary for the purposes we have told you about; and

 kept securely.

YOUR RIGHTS IN RELATION TO YOUR PERSONAL INFORMATION

You have a number of rights under data protection laws in relation to your personal data. If you are an

individual, you have the right to:

• ask us to provide you with copies of personal information we hold about you;

POL041/SK/12082025/v15 – Public

Page

• ask us to provide your personal information to a third-party provider of services. This right only applies

where we use your personal information on the basis of your consent or performance of a contract

and where our use of your information is carried out by automated means;

• ask that we correct any personal information if it is found to be inaccurate or out of date;

• ask that your personal information is erased where it is no longer necessary for us to keep it;

• request a restriction to be placed on further processing of your personal information where there is

a dispute in relation to the accuracy or processing of your personal information;

• object on legitimate grounds to the processing of your personal information, where applicable i.e.,

where processing is based on legitimate interests (or the performance of a task in the public

interest/exercise of official authority) and processing for the purposes of scientific/historical research

and statistics);

• ask us to stop using your personal information for direct marketing purposes. If you exercise this right,

we will stop using your personal information for this purpose. If you wish to exercise this right, you

should complete our Withdrawal Consent Form available on our website (www.veezu.co.uk) or

contact the relevant third party using their given contact details, giving us or them enough

information to identify you and deal with your request. Alternatively, you can follow the unsubscribe

instructions in emails you receive from us or them.

There are some exemptions, which may apply, for example, information collected and processed for the

prevention, investigation, detection or prosecution of criminal offences. If you want to exercise any of your

data subject access rights, please contact: Veezu Compliance at compliance@veezu.co.uk.

NO FEE USUALLY REQUIRED

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However,

we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively,

we could refuse to comply with your request in these circumstances.

WHAT WE MAY NEED FROM YOU

We may need to request specific information from you to help us confirm your identity and ensure your right

to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that

personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask

you for further information in relation to your request to speed up our response.

TIME LIMIT TO RESPOND

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a

month if your request is particularly complex or you have made a number of requests. In this case, we will

notify you and keep you updated.

CONTACT

If you have any difficulty in reading or understanding this Policy, or if you would like this Policy in another

format (for example audio, large print or braille), please contact us.

The Veezu DPO and Compliance team will oversee compliance of this privacy notice. If you have any

questions about this privacy notice or how we handle your personal information, please email

compliance@veezu.co.uk

COMPLAINTS

You have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for

data protection issues (www.ico.org.uk). However, before doing so please make sure you have first made

your complaint to us or asked us for clarification if there is something you do not understand.

CHANGES TO OUR PRIVACY POLICY

POL041/SK/12082025/v15 – Public

Page

We may update our privacy policy from time to time. Any changes we make to our privacy policy in the

future will be posted on this page and, where appropriate, notified to you by post or email. Please check

back frequently to see any updates or changes to our privacy policy.