GDPR checklist for taxi apps

A note first

This guide is general information for taxi operators in the European Union. It is not legal advice. Rules differ by country, and your lawyer or data protection officer should check your situation.

1. Know what data you hold

List every kind of data your app and your office collect:

• Rider: name, phone, email, ride history, pickup and drop-off places, payment status.
• Driver: name, contact, licence and vehicle details, location while online, earnings.
• Company accounts: contact person, invoices.

If you do not need it, do not collect it.

2. Choose a legal basis for each use

The GDPR needs a reason for each use of data. For a ride, the reason is usually that you need it to provide the service (a contract). For marketing messages it is usually consent. Write down which basis you use for what.

3. Publish a clear privacy notice

Tell people who you are, what you collect, why, how long you keep it, who receives it and how to use their rights. Put it in the app, on your website and in the app store listing. HOPIN's own policy is on the privacy page as an example of how a taxi service describes this.

4. Sign contracts with your processors

Your platform, your payment provider and your email tool process data for you. You need a data processing agreement with each. Ask where they store data and who their subprocessors are.

5. Decide how long you keep data

Keep data only as long as you need it. Tax and accounting records have legal minimum periods. Location data usually needs much less time. Write the periods down and delete data when they end.

6. Be ready for requests

Riders can ask what you hold about them, ask you to correct it, delete it or stop using it for marketing. You normally need to answer within one month. Decide who handles requests and how.

7. Protect it

Use strong passwords and two-step login for your admin panel, give each staff member only the access they need, and remove access when they leave. Plan what you will do if there is a data incident. In many cases you must tell the authority quickly.

8. Marketing messages

Ask for clear consent before marketing emails or push messages, make it easy to say no, and respect the choice. Ride confirmations are different from marketing.

FAQ