Your privacy at AECCO

1. Who is responsible for your information?

AECCO LIMITED, trading as AECCO, is the controller of personal information used to run our website, customer and driver apps, and arrange our chauffeur services. We are registered in England and Wales with company number 05375363. Our address is Craigmore, Keighley Road, Colne, BB8 7HF.

Our Information Commissioner’s Office (ICO) data protection registration number is ZA176645.

For privacy questions or a request about your information, email hello@aecco.co.uk, call 0333 016 3690 or write to that address, marking your message 'Privacy'. This notice covers our website, online booking service, AECCO customer app, AECCO Driver app and associated support. Independent providers such as Stripe and Google also explain their own processing in the notices linked below.

2. Information we collect and where it comes from

Most information comes from you. If someone books for you, we may receive it from that person, your employer, a travel organiser or another authorised representative. We also receive payment confirmations, address and routing results, flight information and updates from the people delivering your journey. Please share this notice with anyone whose information you provide and only provide information you are entitled to share.

• Contact and booking details: name, email address, phone number, booking reference, correspondence and information supplied by the person making the booking.
• Journey details: collection and destination addresses, stops, travel dates and times, vehicle choice, passenger and luggage numbers, flight details and practical travel requests. Addresses may reveal where you live or work.
• Payment and transaction records: price, payment status, payment-provider identifiers, refunds, invoices and disputes. Full card details and card security codes are entered into Stripe's checkout, rather than AECCO's website or app booking forms. This also applies to optional tips.
• Booking administration: quote and reservation history, the terms version and acceptance recorded by the booking service, operational updates and relevant support or complaint records.
• Technical information: IP address, browser and device information, requested pages, timestamps and security or error logs generated when our services are used. The booking service also keeps essential information in your browser session to maintain and recover your booking.
• App accounts and sign-in: account identifiers, name, mobile number, email address, verification status, saved addresses, preferences and sign-in/session records. SMS and email verification are used to confirm access to the contact details you provide.
• App activity: journey history and progress, driver and vehicle assignments, duty and availability status, journey messages and their timestamps, ratings, feedback and optional tip records.
• App notifications: installation/device identifiers, push notification tokens, platform, notification preferences, delivery status and relevant interaction records, so we can deliver updates to the right device.
• App location: precise coordinates, accuracy and timestamps when an enabled feature needs them; customer pickup-location sharing, nearby pickup alert checks, and driver location while on duty. The controls and purposes are explained below.
• Optional location: if you choose a current-location feature and allow the browser permission, your location is used to help identify a collection address. You can refuse permission and enter an address instead.
• Optional measurement, when you consent: website pages and interactions, advertising click identifiers, an opaque transaction identifier and confirmed gross booking value. Customer contact details, precise journey addresses and access tokens are excluded from these events.

3. Why we use it and our lawful bases

Under UK data protection law, we must have a lawful basis for each purpose. We use the bases below according to the activity and your relationship with us. Where we rely on legitimate interests, we consider your rights and reasonable expectations.

4. Accessibility, sensitive information and children

Please describe the practical assistance or equipment you need without including a diagnosis, medical history or other sensitive details in a general booking note. If health information is necessary to arrange your journey, contact us first so we can explain the purpose and request explicit consent where that is our legal basis. Voluntarily typing health information into a general field is not treated as blanket consent to use it.

Where we need to process health information, we also need a special-category condition: normally your explicit consent under Article 9(2)(a) of the UK GDPR, or Article 9(2)(f) where necessary for legal claims. We limit what is used and who receives it. You can withdraw consent by contacting us; we will explain any effect on assistance we can arrange and any information we must retain on another lawful basis.

Our booking service is intended for adults making travel arrangements. A parent, guardian or responsible organiser may provide necessary information for a child passenger. Please give only what we need to arrange safe and suitable travel.

5. Who receives information?

We share information where needed for the purposes above, including with the following recipients. We aim to share only what is relevant to their role. We do not sell customer information.

• AECCO staff, chauffeurs and any transport supplier involved in the agreed journey: relevant contact, collection, destination, timing and assistance details.
• Netlify, which hosts our website and booking application, receives and stores contact-form submissions for our team, and processes technical requests and hosting or security logs.
• CookieScript, which provides our cookie-choice banner and preference cookie. Loading the banner sends technical request information to CookieScript. Its privacy policy explains its processing; our cookie notice explains your choices.
• Stripe and the payment organisations involved in a transaction: payment, contact and transaction information needed to process, secure or refund it. Stripe can act as an independent controller for some purposes, including fraud prevention and meeting its legal duties.
• Google Maps Platform for address suggestions, address lookup and routing. Typed address searches, selected locations and technical information are sent to Google when those features are used. Optional device location is used after the relevant browser or app permission. Routing requests may include driver coordinates to calculate journey routes and arrival estimates.
• Supabase supports our app authentication and booking database. Expo and Apple push notification services process device tokens and notification payloads to deliver app notifications. SMS providers, including Twilio, and email delivery providers process contact details and message content to deliver verification codes and service communications.
• Customers receive relevant assigned-driver and vehicle details, journey progress and driver location where journey tracking is enabled. A customer who chooses to share their pickup location makes it available to the assigned driver for that pickup. Journey messages are available to the participants and processed by AECCO to provide and support the service.
• Our booking database, email, calendar and workflow service providers, which support reservation records, confirmations and operational scheduling; and flight-information providers for flight lookup requests.
• Accountants, insurers, legal advisers, regulators, licensing bodies, law enforcement and other authorities where needed for professional advice, claims or a legal duty.
• The person or organisation arranging or paying for your journey, to the extent needed to administer that booking. Please tell us if a contact arrangement raises a confidentiality concern.
• Google Analytics and Google Ads, only for the optional measurement categories you accept. They receive website activity, technical request information and limited booking conversion data described in our cookie notice.

6. International processing

Some technology providers operate internationally and may process information outside the UK, including in the United States and other countries where they or their service providers operate. Hosting in one region does not necessarily mean that all support or processing stays in that region.

Where UK transfer rules apply, the protection used must be an applicable UK adequacy regulation, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any additional measures required for the transfer. An adequacy arrangement applies only where the recipient and processing fall within its scope.

Contact hello@aecco.co.uk for details of the countries, recipients and safeguards relevant to your information, or to request a copy of applicable safeguards. The provider notices linked at the end of this page explain their international operations.

7. How long information is kept

We keep information for as long as it is needed for the purpose for which it was collected, including applicable legal and record-keeping obligations. Different records have different needs; a short-lived vehicle hold does not mean the associated transaction record disappears when the hold ends.

• Booking, invoice and accounting evidence is retained for the applicable statutory period. Company accounting records normally need to be kept for six years from the end of the financial year concerned, and sometimes longer, for example during a tax enquiry.
• Enquiries and unsuccessful quotations are kept according to the time needed to answer the enquiry, deal with follow-up questions and resolve any issue or claim. They should not be retained indefinitely merely because storage is available.
• Complaint, dispute and incident records are kept for the time needed to resolve the matter and meet relevant claim, insurance or legal requirements. A legal hold may require a longer period for particular records.
• App profile information and preferences are kept while needed to operate your account. Journey messages, notification records and feedback are kept according to their service, support, security and dispute purposes; removing an item from an inbox does not necessarily delete the underlying delivery or audit record.
• The live driver-location store holds the latest position rather than a continuous route history. It is cleared on sign-off, and maintenance removes positions older than 24 hours. Separately recorded journey addresses, vehicle-position confirmations and incident or early-ending records can be retained with operational or booking records.
• Shared customer pickup coordinates are treated as stale after 90 seconds and cleared by maintenance or when the relevant journey stage ends. Nearby pickup alerts use location and venue checks; alert preferences and recent-alert records are separate from the device permission.
• Technical and security logs are kept according to their operational purpose, the provider's relevant retention settings and any incident under investigation.
• Essential booking data in browser session storage normally lasts for the browser tab's session; browser session restoration can extend it. You can remove it using your browser's site-data controls. This does not delete a booking already sent to us or cancel a reservation.
• Information that no longer has a necessary purpose should be deleted or anonymised. Contact us for the retention criteria applicable to a particular record or to request erasure; legal duties may mean some information must be retained.

8. Your choices and automated booking checks

We need enough contact, journey and payment information to quote accurately, reserve an appropriate vehicle and deliver the service. If required details are missing, we may be unable to complete the booking. Optional notes, device location and marketing choices are not a condition of simply browsing our website.

The booking service automatically calculates prices and checks vehicle availability using the journey, requested capacity, vehicle type, timing, routing and configured tariffs. It may return no available vehicle or an expired quotation. If a result seems wrong or you need assistance, contact us for a person to review the circumstances. Payment providers also perform their own security and fraud checks under their notices.

Booking messages, confirmations and service updates are communications about the service you requested. Agreeing to booking terms or reading this notice does not subscribe you to marketing. Where marketing is based on consent, you may withdraw that consent at any time through the message's unsubscribe method or by contacting us.

9. Your data protection rights

Depending on the circumstances and the lawful basis, you can request access to your personal information and a copy of it, correction of inaccurate information, erasure, restriction of processing, or transfer of information you supplied in a portable format. You can also withdraw consent where we rely on it; this does not affect lawful use before withdrawal.

Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time, and we must stop using your information for that purpose.

To make a request, contact hello@aecco.co.uk or use the contact details above. We may need proportionate information to confirm your identity or clarify what you need. We normally respond within one month, subject to extensions or pauses permitted by law, and will explain if one applies. There is normally no fee.

You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or call 0303 123 1113. We would welcome the opportunity to address a concern first, but you do not have to contact us before contacting the ICO.

10. Website and app storage, security and updates

See our cookie notice for the distinction between the public information pages, essential booking session storage and independent address and payment services. The support form prepares a message in your email app: it is not sent until you choose to send it. Your email provider then processes that message under its own terms.

The apps keep sign-in/session information, installation identifiers and selected preferences on your device to maintain access and apply your choices. Signing out removes access to the current session; managing permissions in iPhone Settings does not by itself delete information already held by AECCO.

We use technical and organisational measures appropriate to the information and service. No internet service can promise absolute security. Keep booking access links private, use a trusted device for payment and tell us promptly if you suspect misuse of your booking.

We will update this notice when our use of information changes and provide any additional notice required before a materially different use. This version was updated on 31 October 2026.