Privacy policy

Our role under UK data protection law depends on whose data is involved.

We are a data controller for personal data relating to:

• Our own business customers — the operators who subscribe to Hizke, and their staff who hold accounts with us
• Visitors to hizke.co.uk, enquirers, and people who contact us
• Applicants and recipients of our marketing communications

We are a data processor for personal data that an operator processes through the Hizke platform — principally their drivers’ and passengers’ data. In those cases the operator is the controller and decides how that data is used; we process it on their documented instructions under a data processing agreement. If you are a driver or a passenger and want to exercise your rights over that data, contact the operator you deal with in the first instance, and we will support them in responding.

Operator and staff accounts (we are controller)

Name, work email, telephone number, job role, business address, login credentials, authentication and session records, support correspondence, billing and subscription records.

Driver data (we are processor for the operator)

Name, contact details, date of birth, profile photograph, private hire or hackney carriage licence details, DVLA driving licence details, right-to-work documentation, vehicle and insurance documents, disclosure and barring information where the operator’s licensing authority requires it, bank or payout details, shift and availability records, job history, account and session identifiers, location data while on duty, expense claims and receipt images, vehicle or incident evidence, and recorded safety events. Delivery work can also include recipient names, signature drawings and dates of birth supplied for an age check.

Passenger data (we are processor for the operator)

Name, telephone number, email address when supplied, account and session identifiers, pickup and destination addresses and coordinates, saved home, work or favourite places, journey history, accessibility or service notes provided by the passenger, ratings and feedback, and payment and receipt references. If you add a trusted contact, we store the name and phone number you enter for that contact; this does not import your device address book.

Firm applicants, enquirers and marketing contacts (we are controller)

If your firm applies to join Hizke: your name, work email and phone number, your company name and town, fleet and driver numbers, operator licence number, licensing authority and expiry, insurance certificate number and expiry, DBS certificate reference and expiry if you give it, any notes you add, and the results of the checks we run on the application. If you send us an enquiry or ask for a demo: your name, contact details and what you tell us. For marketing: your name, work email, the messages we send you, your consent or opt-out choices, and whether you open or act on them.

Location data

The rider app uses foreground location access to help set a pickup point. Pickup and destination coordinates that you select or save are also processed for your booking, even if you do not grant device location permission.

Where the operator has enabled it, Hizke Driver collects location while a driver is online or on shift, including in the background, so that jobs can be allocated and journeys tracked. Drivers are told about this before background permission is requested. Going offline stops shift tracking; previously recorded journey and location records remain subject to the retention rules below.

Mobile messages and safety features

Private trip messages and driver dispatch messages are processed for the participants in those conversations. If a driver records and sends a voice note, its audio is uploaded for the dispatch conversation. A trip-sharing link is shared through the channel you choose.

The driver app can use motion information on the device to detect a possible collision and send a safety event, including derived motion measurements, time, journey context, location and the driver’s response, to the operator. Optional on-device job-offer voice commands process microphone input locally; that command audio and its transcript are not saved or sent to dispatch. This is separate from a voice note you deliberately send.

Payment data

Card and bank details are collected and processed by our payment provider, Stripe. Hizke does not store full card numbers on its own systems. We do retain payment-method references, transaction amounts and status, and journey or receipt records needed to operate the service.

If you are sent a link to pay for a journey, opening that link loads Stripe’s payment script from Stripe’s servers straight away, before you choose whether to pay. Your browser therefore connects to Stripe even if you never pay, and Stripe receives technical information such as your IP address and details of your device and browser. Stripe uses it to show the card form and to help prevent fraud, as described in Stripe’s privacy policy.

Mobile notifications and diagnostics

When push notifications are enabled, a device push token is associated with your account and used by our notification providers to deliver job or trip updates. When error and performance monitoring is enabled for the app, technical diagnostic information is sent to the monitoring provider to investigate failures and performance. This can include device, application and event context and may be associated with your account or device.

Website and technical data

IP address, browser and device information, pages visited, referral source, and cookie identifiers. See section 11.

Special category and criminal offence data

Some compliance documents an operator uploads — for example DBS certificates or medical fitness records — may constitute criminal offence data or health data. We process these only as a processor, on the operator’s instructions, for the operator’s licensing compliance purposes, and we apply additional access restrictions to them.

Where we act as controller, we rely on the following:

Where we act as processor, the lawful basis for processing driver and passenger data is determined by the operator as controller.

We share personal data only where necessary, and never sell it. Our categories of recipient are:

• Your operator and the participants in your journey who need booking, location or contact information to provide the service, and the participants in a private trip or dispatch conversation. If you choose to share a trip link, its recipient can view the trip information made available by that link
• Cloud hosting and infrastructure providers who host the platform and its databases
• Payment processors who handle card payments and driver payouts. Stripe processes card payments, and receives technical information from everyone who opens a payment link, including people who do not go on to pay
• Communications providers used to send SMS, email and push notifications relating to bookings
• Mapping and routing providers used to calculate routes, fares and estimated times
• Error monitoring and analytics providers used to keep the service reliable
• Professional advisers such as accountants and lawyers, where necessary
• Regulators, licensing authorities, the police or other authorities where we are legally required to disclose, or where an operator instructs us to do so in connection with their licensing obligations

A current list of our sub-processors is available to operators on request.

We aim to host personal data in the United Kingdom or the European Economic Area. Where a provider processes data outside those regions, we ensure an appropriate safeguard is in place — typically UK adequacy regulations, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for a copy of the safeguard we rely on at hello@hizke.co.uk.

• Operator account and billing records: for the life of the subscription and six years afterwards, to meet accounting and limitation-period requirements
• Driver and passenger data processed on behalf of an operator: for as long as the operator instructs, and deleted or returned on termination of their agreement in accordance with that agreement
• Location and telemetry data: retained for the period set out in the operator's agreement unless an operator’s licensing authority requires longer
• Website analytics and cookie data: as set out in section 11
• Firm applications: if the application is accepted, kept as part of the operator account records above; if it is withdrawn or turned down, kept for 24 months after that decision, so that we can answer questions about the application and recognise a repeat application, and then deleted
• Enquiries and demo requests: if you become a customer, kept as part of the operator account records above; if you do not, kept for 24 months after our last contact with you, and then deleted
• Marketing contacts: kept until you opt out, and reviewed 24 months after you last engaged with us. If you opt out, we keep only the minimum needed (your email or number, the channel and the date) on a do-not-contact list for as long as we might market to you again, so that we do not contact you by mistake
• Support correspondence: kept for as long as we need it to resolve the query and any follow-up

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit, encryption at rest for stored documents, role-based access controls, audit logging of administrative actions, multi-factor authentication for privileged accounts, and regular backups. Access to compliance documents is restricted to users the operator has authorised.

We do not carry out solely-automated decisions that produce legal or similarly significant effects.

Hizke is dispatch software. The software can write down what it would have done, show a suggestion to a dispatcher, and set the order jobs are offered in. A person can still step in. It cannot be switched to a mode where software alone allocates work or takes a significant adverse decision.

Software may suggest a driver for a new booking, or the agreed backup driver for a contract run. It does not put anyone on the job by itself. The same applies when a pre-booking is released for dispatch and when a driver turns down a job they were given. A named dispatcher confirms the suggestion, chooses a different driver, or turns it down, and their name is recorded. If nobody confirms, the booking stays unassigned and on the dispatch desk.

A fully automatic mode exists in the product so the required paperwork can be collected. That mode stays switched off. An operator cannot open it from a settings screen. A rubber-stamp review — a person who only ticks to agree with the software and cannot change the outcome — does not count as a person making the decision.

The following always need a named person who can change the outcome: deactivating a driver; deciding fraud liability; deciding damage liability; refusing credit; permanently closing an account; making a safeguarding finding; and releasing sensitive information.

If software was involved in a decision about you and you want a person to look at it again, contact the operator you deal with in the first instance — they are the controller for driver and passenger data. Contact us at hello@hizke.co.uk where we are the controller.

Under UK GDPR you have the right to request access to your personal data, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to processing, to data portability, to withdraw consent where processing is based on consent, and rights relating to automated decision-making. You will not be charged for making a request, and we will respond within one month. If a request is complex or you send several, the law lets us extend that by up to two further months; if we need to, we will tell you within the first month and explain why.

We do not carry out solely-automated decisions that produce legal or similarly significant effects. What the software can and cannot do is set out in section 8.

To exercise these rights against Hizke as controller, contact hello@hizke.co.uk. If your data was entered into the platform by an operator, contact that operator, who is the controller.

To complain to us about how we use your data, email hello@hizke.co.uk. We will acknowledge your complaint within 30 days and tell you the outcome.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113. We would appreciate the chance to address your concern first.

To request deletion of your data:

1. Email hello@hizke.co.uk with the subject line “Data deletion request”.
2. Tell us which account or record the request relates to, and include enough detail for us to identify it.
3. We will verify your identity and confirm what will be deleted before we act.
4. We will complete verified requests within one month and confirm in writing when the deletion is done, or explain any restriction that prevents deletion or requires particular records to be kept.

If you hold an operator account, you can also delete your account from within the console under Settings, which begins the same process.

If you use the Hizke rider app or the Hizke Driver app, both let you request account deletion from inside the app. A successful request removes or redacts identifying information and signs you out. A legal hold can prevent deletion, and required journey, compliance or financial records may remain. There is also a web fallback for anyone who cannot open the app — see Delete your account.

If your data was uploaded to Hizke by a taxi or private hire operator, we will pass your request to that operator, as they are the controller and decide what may be deleted. Some data may need to be retained where the law requires it — for example records an operator must keep for their licensing authority, or transaction records we must keep for tax purposes. We will tell you if that applies.

We use cookies and similar technologies that are strictly necessary to run the platform — for example to keep you signed in and to secure your session. These do not require consent.

Where we use analytics or marketing cookies, we ask for your consent first through our cookie banner, and you can change or withdraw that consent at any time using the banner controls. You can also block or delete cookies in your browser settings, though the platform may not function correctly without the necessary ones.

We maintain business pages on social media platforms including Facebook, Instagram, LinkedIn, X, YouTube and TikTok. We use those platforms’ official publishing tools and APIs to post our own content to our own accounts, and to view aggregated statistics about how that content performs.

We do not collect or store personal data about people who follow or interact with those pages beyond what the platform itself shows us, and we do not use these tools to access data about accounts we do not own. Each platform is a separate controller for the data it collects about you when you use it, governed by its own privacy policy.

The Hizke platform is a business tool for licensed operators and is not directed at children. We do not knowingly collect personal data from anyone under 16 through our website or operator console.

We may update this policy from time to time. When we make material changes we will update the date at the top and, where the change significantly affects our operators, notify them directly.

HIZKE LTD
71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: hello@hizke.co.uk