Privacy Policy

1. Introduction and scope

1.1 Who we are

CabFare is committed to protecting your privacy and complying with the privacy and data protection laws that apply in Australia, the United Kingdom, the European Union and the United States. In this Privacy Policy, “CabFare”, “we”, “us” and “our” means the CabFare company responsible for your information in your territory, as set out below, together with our related companies where the context requires.

1.2 What this Privacy Policy covers

This Privacy Policy explains how we collect, use, disclose and protect data and information on, or in relation to, the websites owned by CabFare and our other subsidiary or related sites (“Site”), the CabFare Tap-to-Pay App and any other mobile applications we may publish in the future (“Apps”), the CabFare physical payment terminal, and other supporting or future software products (together “Software”), the supporting web service, associated Application Programming Interfaces (APIs), including CabFare Connect, and other services or materials provided by us (collectively “Services”).

This Privacy Policy is linked from our App listings in Google Play and Apple App Store and from within our Apps.

1.3 Who this Privacy Policy applies to

• Rider or Passenger (Customer) means a person who pays a fare using a CabFare payment service.
• Driver means a person who onboards to use the CabFare Tap-to-Pay App or the CabFare physical payment terminal to accept payments for a commercial passenger vehicle service.
• Client or Partner means an entity or individual sole trader, such as a booking, dispatch or meter provider, a payment provider, a fleet operator or a Booking Service Provider, that uses CabFare Connect or our other Services.
• Visitor means anyone who visits our Site or contacts us.

1.4 Relationship with other documents

This Privacy Policy is subject to, and incorporates by reference, our Terms and Conditions, and should be read together with them. By using our Services, you acknowledge that you have read and understood this Privacy Policy. Where we rely on your consent to process information, we will ask for it separately and you may withdraw it at any time.

This Privacy Policy does not apply to the collection, use or disclosure of data or personal information by our Clients and Partners, or by third-party payment providers. We do not control, and are not responsible for, their privacy policies.

2. Our products and what each one collects

CabFare offers three products. Each handles personal information differently. The table below summarises what we collect for each product and where it is described in full.

2.1 Anonymous card payments

Payments by Riders or Passengers (Customers) on payment terminals and the CabFare Tap-to-Pay App are anonymous, unbooked trips, and the card holder is never revealed to CabFare. For each payment, our payment service providers give us only the transaction details the payments industry requires: the card brand, last four digits, amount, date, time and location. These details do not identify the card holder. We never receive or store full card numbers.

If a Rider or Passenger (Customer) contacts us or visits our Site, we collect the information described in Section 3.4. We cannot match card payments to a person, so questions about a card payment should be directed to the card issuer or payment provider.

3. Information we collect

We collect only the personal information necessary to provide our Services. We collect it when you onboard as a Driver, create a Client or Partner account, use our payment services or Apps, contact customer support, or visit our Site or mobile platforms. We may also receive information from third parties, such as payment providers, regulators, public registers, sanctions lists and other financial institutions, where this is needed for the purposes in Section 4.

3.1 CabFare Tap-to-Pay App: Drivers

Drivers onboard by providing their personal details and completing a third-party payment provider’s verification process. The provider manages KYC/AML verification and holds the identity verification information under its own privacy policy. CabFare does not receive or store that identity verification information.

When you use the CabFare Tap-to-Pay App we also collect the following information:

• your name, email address and phone number.
• your driver authority number and vehicle details.
• if you sign in with Google, the Google account information described under “Google user data” below.
• your device location, only while the App is open and in use (see Section 8).
• the amount, date, time and location of each payment you take using the App.
• device and app information, including IP address, device make and model, operating system, app version, device and advertising identifiers (resettable or app-specific only; we do not collect hardware identifiers such as IMEI or serial number), diagnostic logs, and how you use the App (such as features used and login times); and
• messages you send us, such as support requests.

Third-party services in the App. The App uses third-party services (including embedded third-party code) that act on our instructions and may use personal information only to provide services to us. These third-party services assert publicly they are bound by the same data handling and privacy standards, particularly regarding the non-sale of data and prominent disclosure requirements. The categories of data each service collects through or in connection with the App are:

• Payment service provider (payments, payouts and identity verification): your identity verification information (see above); your account and payout status, which it shares with us; and your device location, which it requires to accept contactless payments on your phone.
• Messaging service provider: your name and email address, solely so that it can send service and marketing messages to you on our behalf.
• Marketing measurement service provider: information about how you found and installed the App.
• Analytics and diagnostics providers: the device and app information, diagnostic logs and App usage described above.
• Hosting service provider: stores App data on servers located in Australia.

Google user data (Sign in with Google). If you sign in to the App with your Google Account, Google shares your name, email address and profile photo with us, with your permission. We do not request access to any other Google user data, such as your contacts, calendar, Gmail or Google Drive files.

How we use Google user data. We use the information we receive from Google sign-in only to create your CabFare Driver account and sign you in securely, to identify you in the App and when you contact our support team, and to send you service messages about your account.

Who we share Google user data with. We share the name and email address we receive from Google sign-in with our messaging service provider, solely so that it can send service messages to you on our behalf. Google user data is stored on servers located in Australia, provided by our hosting service provider. We do not share, transfer or disclose Google user data to anyone else, unless we are required to do so by law.

What we do not do with Google user data. We do not use Google user data for targeted or personalised advertising; sell it, including to data brokers or information resellers; use it to determine credit-worthiness or for lending purposes; use it to create databases; or use it to develop, improve or train generalised artificial intelligence or machine learning models.

Limited Use. CabFare’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect, keep and delete Google user data. Google user data is encrypted in transit and at rest, and access is restricted to authorised personnel who need it to operate the Services. We keep it while your account is active. When you delete your account, we delete your profile photo. We keep your name and email address only for as long as we need them to meet our legal obligations (see Section 10) and then delete them. You can remove CabFare’s access to your Google Account at any time at https://myaccount.google.com/permissions. This stops Google sharing further information with us but does not delete information we already hold. To request deletion, see Section 13.

3.2 Payment terminals: Drivers

Drivers onboard by submitting their personal details through an online form so that we can verify their regulatory credentials for operating a commercial passenger vehicle. This information forms part of our KYC/AML processes to ensure regulatory compliance. We may collect:

• contact details (name, phone number, email address and driver authority number).
• a copy of an identity document, which we use only for identification and verification purposes.
• payment, billing and transaction information relating to the Driver’s use of the CabFare payment system, which is processed securely via third-party payment providers; and
• any additional information we request from time to time if the information in the online form is unclear.

3.3 Clients and Partners

You may browse the Site without a CabFare account, but an account must be created to use the Software or Services. When a Client or Partner creates an account, we may collect:

• the legal name of the Client or Partner, such as the registered name of the entity that owns the application.
• the name and contact information of the representative acting on behalf of the Client or Partner.
• an email address and password to access the CabFare account.
• industry, size, intended use of the Software and Services and other similar information; and
• billing information and details of payments for use of the Software and Services.

A Client or Partner’s username and password created or issued during registration may be requested when logging in subsequently. We reserve the right to contact Clients and Partners periodically to confirm that the information we hold is correct and up to date.

3.4 Visitors, enquiries and customer support

When you visit our Site, contact customer support or send us an enquiry or complaint (including as a Rider or Passenger (Customer)), we may collect your name, contact details, the content of your communications, and identifiers such as browser type, device information and information collected by cookies and similar technologies (see Section 7).

3.5 Information we do not collect

We do not collect sensitive information (known in the UK and EU as “special category data”), such as racial or ethnic origin, health data, biometric data or political opinions, other than subsidy trip information in Australia that may indicate a passenger has a disability (see Section 3.6).

3.6 CabFare Connect: trips and subsidies

CabFare Connect links booking, dispatch and meter systems with payment providers and government subsidy schemes. When a trip is processed through CabFare Connect, the booking or dispatch system sends us the trip details, including the fare and extras, the pickup and drop-off addresses, the driver number and the vehicle details. We use these details to process the payment and to produce compliant receipts, which show the pickup and drop-off addresses. We keep trip details in our database for the periods in Section 10. For card payments, CabFare Connect holds no card holder data. CabFare Connect data is stored and processed in Australia.

Subsidy trips. For trips paid under the Government funded subsidy schemes, we read the passenger’s subsidy card during the payment, including their name, card number and expiry date. We pass this, with the trip details, to the relevant Government subsidy scheme provider, as required by law in our role as a contracted Data Collection Provider under the subsidy scheme.

Because subsidy scheme membership may indicate that a passenger has a disability, we treat subsidy trip information as sensitive information. We collect it only to process subsidised trips and as required by the subsidy scheme, and we protect it as set out in Section 9.

Partner apps. Where a booking or dispatch partner sends us trips from its own app, the partner is responsible for its passengers’ personal information. We handle that information on the partner’s behalf and under its instructions. Please read the partner’s privacy policy.

4. How we use information

We use personal information to:

• provide, operate, maintain and improve the Software, Services and Site, and better understand how they are used.
• verify and onboard Drivers and manage accounts and process transactions.
• communicate with you about your account, respond to your enquiries and customer support requests, and tailor the information we send or display to you.
• process and issue bills and charge payments for use of the Software and Services.
• comply with legal and regulatory obligations, including KYC/AML (see Section 6).
• conduct internal audits, security monitoring and fraud prevention.
• effect or enforce a transaction or agreement with account holders, including our Terms and Conditions and this Privacy Policy; and
• send you information about our company or products that we believe may be of interest, including promotional emails (with opt-out options available; see Section 16).

We use only aggregate, non-identifying information for advertising, research or similar purposes, and we may share it with third parties for those purposes. We do not share personally identifiable information with third parties for those purposes without your consent. This does not apply to marketing messages we send directly to Drivers, Clients and Partners (see Section 16).

4.1 Legal bases (United Kingdom and European Union)

If you are in the UK or EU, we process personal data only where we have a lawful basis under the UK GDPR or GDPR:

4.2 Automated decisions and fraud detection

In Australia our payment system uses automated systems to help detect and prevent fraud. These systems can block or decline a payment to you automatically, without a person reviewing it first. They use information about the payments you take and your account. For security reasons, we do not publish how these systems work.

5. How we disclose information

We do not sell personal information. We disclose personal information only in the following instances and only to the extent required:

• Related companies: our affiliates and subsidiaries, for purposes consistent with this Privacy Policy.
• Service providers: contractors and third-party service providers who perform functions on our behalf, such as payment processors, identity verification providers, cloud hosting, analytics and communications providers.
• Authorities: regulators, law enforcement, tax authorities, governmental entities and external dispute resolution schemes, where required by law or legal process.
• Protection of rights: where needed to protect or enforce our rights or property, such as those outlined in our Terms and Conditions and this Privacy Policy.
• Professional advisers: our lawyers, auditors and insurers; and
• Business transfers: in the event of a sale or dissolution (including bankruptcy) of assets, in whole or in part, of CabFare or any of its affiliates.

6. Compliance with legal obligations (KYC/AML)

We use personal information to comply with legal obligations and statutory requirements, including banking, financial, sanctions and KYC/AML legislation. KYC/AML refers to the Know Your Customer and Anti-Money Laundering legislation in each territory, including the following (as amended or replaced from time to time):

These obligations require us, or the third-party payment provider that carries out verification, to perform the following checks. They apply to Drivers, Clients and Partners, and not to Riders or Passengers (Customers).

• Integrity check: when entering a customer relationship with you, we have a legal obligation to consult available incident registers and warning systems, and national and international sanctions lists.
• Identity verification: when entering a customer relationship with you, we have a legal obligation to confirm your identity. We may do this by making a copy of your identity document, which we will use only for identification and verification purposes. To check your integrity and identity we may also rely on checks performed by other financial institutions.
• Fraud prevention and anti-money laundering and terrorism financing checks: we have a legal obligation to check for potential fraud, money laundering and terrorism financing. We monitor, among other things, unusual transactions and sanctions lists.
• Regulatory and statutory reports and data requests from our regulators, law enforcement agencies, tax authorities and external dispute resolution schemes, as further detailed in our Whistleblower and Complaints Policy and Procedures.

7. Cookies and online tracking technologies

7.1 What is a cookie?

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your device. We also use pixels, local storage objects and similar technologies (collectively “cookies”).

7.2 How we use cookies

Our Site may use the following types of cookies to distinguish you from other users, provide you with a good experience and improve our service:

• Essential cookies for core functionality, such as session cookies that maintain authentication across pages. These do not require consent.
• Analytics cookies to monitor Site usage, such as the number of views and the length of time Visitors spend on the Site, so that we can optimise the Site and Services.
• Advertising cookies for personalised marketing on our Site, such as Google Ads and other third-party advertising networks, where used. We do not use advertising cookies in our Apps.

7.3 Consent and your choices

• UK and EU: we set analytics and advertising cookies only if you have given consent through our cookie banner, and you can withdraw or change your choice at any time.
• Australia and US: you can opt out of analytics and advertising cookies using our cookie settings or your browser settings. We honour the Global Privacy Control (GPC) signal as a request to opt out of sale or sharing where required by law.
• Browser settings: you can delete, block or disable cookies in the “options” or “preferences” menu of your browser (use your browser’s “Help” option for details). Disabling cookies may affect the functionality of the Site and prevent you from accessing certain features.

To find out more about cookies, including how to see what cookies have been set and how to manage or delete them, visit https://www.allaboutcookies.org. For more information about advertising and tracking online, visit the Network Advertising Initiative at https://www.networkadvertising.org, which allows consumers in the United States to opt out of behavioural advertising delivered by member companies.

8. App permissions and location data

Our Apps request device permissions only where needed for a feature to work. Depending on the App and feature, these may include:

• NFC, location and network access: to accept contactless payments using the CabFare Tap-to-Pay App and to communicate with our systems; and
• Device information: device make and model, platform and operating system version.

Prominent in-app disclosure and consent. Before accessing device location or any other sensitive permission, our Apps display a prominent in-app disclosure that explains what data is collected, how it is used and why it is needed, and require your explicit, affirmative consent. We do not access that data until you have given your consent, and you can review or withdraw permissions at any time in your device settings.

Location in the CabFare Tap-to-Pay App. The App collects your device’s location only while the App is open and in use and never collects location in the background. We use location to set your state or country when you sign up, to enable Tap to Pay (our payment service provider requires location to accept contactless payments on your phone), and to record where each payment is taken, to help prevent fraud and resolve disputes.

We do not use data obtained through App permissions for advertising or sell it to third parties.

9. Data security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. Measures include:

• encryption of data in transit (such as HTTPS/TLS) and secure encryption and access controls for stored data.
• regular security assessments.
• data minimisation principles (only storing data for as long as necessary); and
• selecting payment and verification providers that apply recognised security standards.

No method of transmission or storage is completely secure, but we work to keep your information safe.

10. Data retention

When personal information is no longer needed for the purpose for which it was collected, and we are not required by law to keep it, we securely delete or de-identify it.

11. International transfers

CabFare operates in several territories, and our Services are supported from Australia. If you are located outside Australia, the Client and Partner and Driver information we collect or receive may be transferred to, and processed in, Australia, the United States, the United Kingdom and other countries where our service providers operate. Australian data protection laws may not provide the same level of protection as other jurisdictions, such as the European Union (GDPR), the United Kingdom (UK GDPR) and some states in the United States.

• Australia: if personal information is shared outside Australia, we comply with APP 8 (Cross-border Disclosure of Personal Information) by taking reasonable steps, including contractual protections, to ensure the recipient handles it consistently with the APPs. We are likely to disclose personal information to recipients in the United States and the United Kingdom.
• UK and EU: where personal data is transferred outside the UK or EEA to a country without an adequacy decision, we use an approved safeguard, such as the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Agreement or Addendum. You can request a copy of the relevant safeguards by contacting us.
• United States: we require our service providers to protect personal information in line with this Privacy Policy and applicable US law.

If you do not agree to a transfer, please contact us and we will work with you to find a suitable data transfer and/or processing location that meets the privacy laws of your country.

12. Your privacy rights

Because the card holder is never revealed to CabFare, we cannot identify Riders or Passengers (Customers) to action rights requests about those payments. Rights described below apply to the personal information we do hold, such as information about Drivers, Clients and Partners, Visitors and people who contact us.

12.1 Australia

Under the Privacy Act 1988 (Cth) you have the right to:

• request access to the personal information we hold about you.
• request correction of your information if it is inaccurate, out of date, incomplete, irrelevant or misleading; and
• where lawful and practicable, deal with us anonymously or by pseudonym.

We will respond within a reasonable period, normally within 30 days. If we refuse a request, we will explain why in writing, as permitted by the APPs.

12.2 United Kingdom and European Union

Under the UK GDPR and GDPR you have the right to:

• be informed about how we use your personal data (this Privacy Policy).
• access your personal data and receive a copy.
• have inaccurate or incomplete data rectified.
• have your personal data erased in certain circumstances (see Section 13).
• restrict our processing of your personal data in certain circumstances.
• receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller (data portability), where we process it based on consent or contract.
• object to processing based on legitimate interests and to direct marketing at any time; and
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

We will respond within one month (extendable by two further months for complex requests) and will not charge a fee unless a request is manifestly unfounded or excessive. You also have the right to lodge a complaint with the ICO (UK) or the supervisory authority in your EU Member State (see Section 19).

12.3 United States

Depending on the US state where you live (including California, Virginia, Colorado, Connecticut, Utah, Texas and others), you may have the right to:

• know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes and the categories of third parties to whom we disclose it.
• delete personal information we have collected from you, subject to legal exceptions.
• correct inaccurate personal information.
• opt out of the sale or sharing of personal information for cross-context behavioural advertising and of targeted advertising.
• limit the use and disclosure of sensitive personal information; and
• not be discriminated against for exercising your rights.

Our practices. We have not sold personal information in the preceding 12 months and do not sell it. We do not knowingly sell or share the personal information of anyone under 18. Where advertising cookies are used on our Site, they may be considered “sharing” or “targeted advertising” under some state laws; you can opt out using our cookie settings or a GPC signal. We use sensitive personal information (such as identity documents and driver authority numbers) only to verify identity and comply with KYC/AML obligations, and not to infer characteristics about you.

Categories of personal information we have collected in the past 12 months (Drivers, Clients and Partners, and Visitors; for Riders or Passengers (Customers), see Section 2.1):

We retain each category for the periods in Section 10. We collect these categories directly from you, automatically through our Site and Apps, and from payment and verification providers and public registers.

12.4 How to make a request

Contact us using the details in Section 19, stating which right you wish to exercise. We may need to verify your identity before acting on your request and will use the information you give us only for that purpose. You may use an authorised agent to make a request on your behalf, subject to proof of authority. If you are in a US state that provides a right of appeal and we decline your request, you can appeal by replying to our decision, and if you are unhappy with the outcome, you may contact your state Attorney General. We will respond to US requests within 45 days (extendable by a further 45 days where permitted).

13. Request to delete your personal data

You have the right to request the deletion of the personal data that we hold about you. This applies to Drivers, Clients and Partners and other individuals we hold data about. You can make a request:

• online, without needing to install or open the App, using our web account and data deletion resource at https://www.cabfare.com/delete-account, which sets out how to submit a request to support@cabfare.com from the email address you use in the App, with the subject line “Data Deletion Request” and your full name; or
• through CabFare Customer Service at Contact Us (Australia) or Contact Us (UK, EU and US), with the subject line “Data Deletion Request”, including your full name, the email address used in the CabFare app, and any other information that may help us verify your identity.

Upon receiving a verified request, we will delete your personal data from our systems, except where retention is required to comply with legal, regulatory or contractual obligations (for example, financial record-keeping, fraud prevention or KYC/AML retention under Section 10). We will tell you what we have kept and why. We will confirm when your account has been deleted.

14. Data breach notification

• Australia: in compliance with the Notifiable Data Breaches (NDB) scheme, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) of an eligible data breach that is likely to result in serious harm.
• UK and EU: where required, we will notify the ICO or the relevant supervisory authority within 72 hours of becoming aware of a personal data breach and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
• United States: we will notify affected individuals and regulators as required by applicable state breach notification laws.

15. Children

Our Services are not directed at children under 18, and Drivers must be of legal age to operate a commercial passenger vehicle. We do not knowingly collect personal information from children under 18. If you believe a child has provided personal information to us, please contact us and we will delete it.

16. Marketing communications

We may send you emails from time to time about information that we believe may be of interest, including news, special offers or information about products or services, in line with the Spam Act 2003 (Cth) in Australia, PECR in the UK, the GDPR and ePrivacy rules in the EU, and the CAN-SPAM Act in the US. In the UK and EU, we will ask for your consent where it is required.

You may opt out of promotional emails at any time by following the unsubscribe link in those emails, or by requesting that such emails no longer be sent to you at Contact Us (Australia) or Contact Us (UK, EU and US). It may take up to 10 business days to process opt-out requests. If you opt out, we may still send you emails about your account or the Software and Services you use, or for other service purposes.

17. Third-party links and services

Our Site may contain links to third-party websites, such as those of partners or service providers. Your use of those websites is governed by their own privacy policies (see Section 1.4).

18. Changes to this Privacy Policy

We may update this Privacy Policy periodically. The updated version will be published on our Site and linked from our App listings, with a revised “Date Last Updated”. Significant updates will be communicated directly where required, including by seeking fresh consent where the law requires. If we change how we use Google user data, we will notify you in the App or by email before the change takes effect and, where required, ask for your consent again.

19. How to contact us and the dispute resolution process

Please contact CabFare for general enquiries, notifications, rights requests or complaints related to this Privacy Policy:

• Australia: Contact Us
• United Kingdom, European Union: Contact Us
• United States: Contact Us
• Email: support@cabfare.com

We are committed to handling notifications and questions about this Privacy Policy in an effective, transparent and timely manner. Complaints should initially be sent to CabFare so that we can rectify breaches or errors. We will acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days. If you are not satisfied with our response, or we have not responded within 30 days, you can contact the regulator for your location, as set out below.

• Australia: if we do not handle your complaint satisfactorily you may complain to the OAIC at www.oaic.gov.au.
• United Kingdom: you may complain to the Information Commissioner’s Office at ico.org.uk.
• European Union: you may complain to the data protection supervisory authority in the Member State where you live, work or where the issue arose. A list is available from the European Data Protection Board at edpb.europa.eu.
• United States: you may contact your state Attorney General or the Federal Trade Commission at www.ftc.gov.

This policy is governed by the laws in the State of Victoria in the Commonwealth of Australia.

If you have any questions or suggestions about this Privacy Policy or any of our privacy-related practices, please contact us.