Privacypolicy

1.Who is responsible for your data

RYDES LLC, 800 5th Avenue, Suite 101, Seattle, Washington 98104, United States, is the controller of the personal data described in this policy. Where this policy says we, us or RYDES, it means that company.

Once we pass your details to a licensed chauffeur operator so that they can collect you, that operator becomes a controller of that data in its own right. They decide how they hold it and are answerable for it under the law of their country. section 4 explains what they receive and why.

Representatives and contacts

• Privacy enquiries: privacy@rydes.co
• Representative in the European Union under Article 27 GDPR: {{EU_REPRESENTATIVE}}
• Representative in the United Kingdom under Article 27 UK GDPR: {{UK_REPRESENTATIVE}}
• Data protection officer: {{DPO_OR_NONE}}

2.What we collect

When you make a booking

• Your name, email address and mobile number.
• The passenger's name and number where that is not you.
• Pickup address, destination address, date and time.
• Flight, train or vessel number where you give one, and the tracking data we obtain about it.
• Passenger count, vehicle class, and any add-on requested.
• What you tell us in the notes field, which is whatever you choose to put there.

Information that may be sensitive

Some of what a booking needs is treated as a special category or as sensitive personal information by law, and we would rather name it than let it sit unremarked in a list.

• Precise location. Every booking contains two exact addresses and a time. In California this is sensitive personal information, and section 8 tells you what you can do about it.
• Accessibility requirements. If you ask for a wheelchair-accessible vehicle or tell us about a mobility need, that may reveal information about health. We collect it only because you asked for something that requires it, we pass on only what the operator needs to serve you, and we do not use it for anything else.
• Travelling with children. A child seat request tells us a child is travelling and roughly how old they are.

When you create an account

• The same contact details, plus your booking history and saved preferences.
• Verification records for the one-time passcode we send to confirm your number.

Payment and fraud checks

Payment card details are entered directly into our payment provider's systems, which are certified to the Payment Card Industry Data Security Standard. We do not receive or store your full card number. We hold a token, the last four digits, the card type, the amount and whether the payment succeeded.

To confirm that a card is being used by its owner, information such as your IP address, email address and card details may be checked by a fraud prevention provider acting on our instructions. Very occasionally, for an individual transaction, we may ask you for a copy of an identity document to verify the cardholder. If we do, redact everything we have not asked for, including all but the last four digits of the card number.

Ratings you leave

If you rate a journey, we keep the rating against your booking, and we pass it to the operator without your name attached. Ratings are used to monitor how operators are performing and to remove those who fall below the standard. Other passengers do not see your ratings.

Technical information

3.Why we use it, and on what legal basis

Under the GDPR and the UK GDPR every use of personal data needs a lawful basis. This is ours, purpose by purpose.

We do not send marketing text messages, so no basis is claimed for them.

4.Who we share it with

The operator collecting you

This is the sharing that matters most, so it is described precisely rather than generally.

To collect you, an operator needs your name, a contact number for the day, your pickup and destination, your passenger count, and anything you told us that affects the vehicle, such as a child seat, an animal, or an accessibility requirement. That is what they get. They do not receive your payment details, your booking history, your other journeys, or your email address.

The operator is an independent business, usually in another country, and becomes a controller of that information in its own right. Our agreement with them restricts what they may do with it and requires them to delete it when it is no longer needed for the journey.

Service providers acting for us

Others

• Where the law requires it, or to establish or defend a legal claim.
• Where you booked through a travel agent, hotel or corporate account, we share what that arranger needs to manage the booking they made.
• If the business is sold or reorganised, to the acquirer, under confidentiality.

We do not sell your personal data. We do not share it for cross-context behavioural advertising as that term is used in California. section 8 explains what that means for you.

5.Sending data to other countries

A worldwide chauffeur network cannot work without moving personal data across borders, and pretending otherwise would be dishonest. There are two separate flows here and they are handled differently.

To the operator collecting you

When you book, the details in section 4 go to an operator in the country you are travelling in. That may be any of around 90 countries, most of which the European Commission has not found to provide an adequate level of protection.

For this particular flow we rely on the derogations in Article 49 of the GDPR rather than on an adequacy decision or standard contractual clauses. The transfer is necessary for the performance of the contract between you and us, and for the performance of a contract concluded in your interest between us and the operator. Put plainly: a car in Osaka cannot collect you without being told your name, your number and where you are standing, and there is no version of this service in which that data stays in one country.

We send the operator the minimum that makes the collection possible, and no more. Our agreement with them restricts what they may do with it and requires deletion once the journey is done.

To our own service providers

Companies that process data on our instructions, such as our payment provider, messaging provider and hosting, are a different matter. Article 49 does not cover them, and for those transfers we rely on an adequacy decision where one exists, or on standard contractual clauses with a transfer impact assessment where one does not.

6.Automated decisions

Most of what happens to your booking is decided by people. Two things are not.

• A booking may be refused automatically where a payment method that has previously failed is entered again.
• A booking may be refused automatically where fraud checks flag it, for example an unusual combination of card, device and destination.

Both are automated decisions in the sense of Article 22 of the GDPR, and both are permitted because they are necessary to enter into the contract. Neither uses profiling to judge you as a person, and neither affects the price you are shown.

If a booking of yours is refused this way, write to privacy@rydes.co or call dispatch. You are entitled to a human review, to an explanation, and to put your side of it, and we would rather give you all three than lose a booking to a false positive.

7.How long we keep it

When a period ends we delete the data or irreversibly anonymise it. Anonymised booking counts, used for the coverage figures published on this site, contain nothing that identifies anybody and are kept indefinitely.

8.Your rights

If you are in the European Union or the United Kingdom

• Ask what we hold about you and get a copy.
• Have inaccurate information corrected.
• Have information erased, where we have no continuing basis to keep it.
• Restrict how we use it while a dispute about it is resolved.
• Receive it in a portable format, or have it sent to another controller.
• Object to a use we base on legitimate interests, and to direct marketing at any time.
• Withdraw consent where we relied on it, without affecting what came before.
• Complain to your supervisory authority. In the UK that is the Information Commissioner's Office. In the EU it is the authority in the country you live in.

If you are in California

• Know what we collect, use, disclose and why, and get a copy.
• Have it corrected or deleted.
• Opt out of sale or of sharing for cross-context behavioural advertising. We do neither, so there is nothing to opt out of, and we say so rather than presenting a switch that does nothing.
• Limit the use of sensitive personal information. Your pickup and destination addresses are precise geolocation, which California treats as sensitive. We use them only to arrange and carry out your journey, which is a purpose the law permits without a limit request, but you may still make one.
• Not be discriminated against for exercising any of these. Prices and service do not change because you did.

How to exercise them

Write to privacy@rydes.co. We will verify who you are before acting, which usually means confirming control of the email address or mobile number on the booking. We answer within one month in the EU and UK, and within 45 days in California, and we will tell you if we need the extension those laws allow rather than simply taking it.

9.Keeping it safe

We use encryption in transit, restrict access to the people who need it, and require our providers to do the same by contract.

No system is perfectly secure. If a breach affects your data and the law requires it, we will tell you and the relevant regulator within the time the law allows.

10.Cookies

Cookies and similar technologies are covered separately in our cookie policy, which explains what is set, what each one does, and how to change your choices.

11.Children

RYDES is not for children. You must be 18 or over to make a booking or hold an account, and we do not knowingly collect data from anyone under that age for that purpose.

Children do travel with us, and where they do we hold only what the booking requires: that a child is travelling, roughly their age where a seat stage depends on it, and the seat requested. That comes from the adult booking, not from the child, and it is used only to arrange the journey.

If you believe we hold data about a child that we should not, write to privacy@rydes.co and we will delete it.

12.Changes to this policy

We will update this policy as the service changes, and we review it at least once a year whether or not anything has changed. Each version is dated and numbered at the top of this page.

A privacy policy that has fallen behind the systems it describes is not merely untidy, it is inaccurate, which is the one thing a document like this cannot be.

Where a change materially affects how we use data we already hold about you, we will tell you directly rather than relying on you noticing a new date, and where the law requires your consent for the change we will ask for it.

13.Contacting us

• Privacy questions and rights requests: privacy@rydes.co
• Anything about a booking: support@rydes.co or +1 888 881 7933
• By post: RYDES LLC, 800 5th Avenue, Suite 101, Seattle, WA 98104, United States
• EU representative: {{EU_REPRESENTATIVE}}
• UK representative: {{UK_REPRESENTATIVE}}

If you are not satisfied with how we handle a privacy question you can complain to your supervisory authority, and you do not have to come to us first.