Privacy Policy

This Privacy Policy explains how Heathrow Airport Rides Ltd collects, uses, stores, and protects your personal data when you use our taxi comparison and booking platform at otscars.co.uk. It applies to all users of our website, mobile application, and related services.

By using our platform, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use our services.

Information you provide directly

• Full name, email address, and phone number when you create an account or make a booking
• Pickup and drop-off addresses for your journeys
• Payment card details (processed securely by our PCI DSS-compliant payment provider — we never store raw card numbers)
• Any messages or feedback you submit through our contact forms
• Corporate account details if you register on behalf of a business

Information collected automatically

• IP address, browser type, device type, and operating system
• Pages visited, time on site, and referring URLs
• Search queries entered into our booking platform
• Cookie and session data (see Cookies section)

Information from third parties

• Booking confirmation and status updates from taxi operators
• Fraud-screening signals from our payment processor
• Public profile data if you choose to sign in via Google or Apple

We will never use your personal data for automated decision-making that produces significant legal effects without human review.

We do not sell your personal data. We share data only where necessary to deliver our services or comply with the law.

• Licensed taxi operators: Your name, phone number, and journey details are shared with the operator you book with so they can fulfil your ride.
• Payment processors: Stripe or similar PCI DSS-certified providers to handle transactions securely.
• Analytics providers: Anonymised usage data may be shared with Google Analytics to improve our platform.
• Legal authorities: Where required by law, court order, or to protect the rights and safety of our users.
• Business transfers: In the event of a merger or acquisition, your data may be transferred to the acquiring entity, subject to the same privacy protections.

You can manage your cookie preferences at any time via our Cookie Settings panel, accessible in the website footer. Withdrawing consent for non-essential cookies will not affect your ability to use core booking features.

• Booking and transaction records: 7 years (UK tax and accounting requirements)
• Account information: Retained while your account is active, plus 2 years after closure
• Customer support correspondence: 3 years
• Marketing consent records: Until you withdraw consent, plus 1 year
• Analytics data: 26 months (anonymised)

After the relevant retention period, your data is securely deleted or anonymised so it can no longer be linked to you.

• Right to access: Request a copy of all personal data we hold about you.
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure: Request deletion of your data where we have no lawful reason to keep it.
• Right to restriction: Ask us to pause processing your data in certain circumstances.
• Right to portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including marketing.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without penalty.

To exercise any of these rights, email privacy@otscars.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the ICO at ico.org.uk.

We implement industry-standard technical and organisational measures to protect your data against unauthorised access, loss, or disclosure:

• All data in transit is encrypted via TLS 1.3
• Data at rest is encrypted using AES-256
• Payment data handled by PCI DSS Level 1 certified processors only
• Regular penetration testing by independent security firms
• Staff access to personal data is role-restricted and logged
• Two-factor authentication required for all internal systems

In the event of a data breach that affects your rights, we will notify you and the ICO within 72 hours as required by UK GDPR.

Our platform is intended for users aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has submitted personal data to us, please contact us immediately at privacy@otscars.co.uk and we will delete it promptly.

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. When we make material changes, we will notify you by email (if you have an account) and by displaying a prominent notice on our website for at least 30 days before the changes take effect.

The "Last updated" date at the top of this page always reflects the current version. Continued use of our services after changes take effect constitutes acceptance of the revised policy.

For any privacy-related queries, subject access requests, or to exercise your rights, contact our Data Protection Officer: