Last Updated: 30 April 2025

AM2PM Innovations Ltd, trading as AM2PM Travel ("we", "us", "our"), is committed to protecting and respecting your privacy. This policy explains how we collect, use, disclose, and safeguard your personal information when you use our services, visit our website (if applicable), or interact with us in any other way.

We are the data controller responsible for your personal data. Our registered office is:

AM2PM Innovations Ltd 44 Bath Hill Keynsham Bristol BS31 4HG

Our trading name is AM2PM Travel.

Please read this policy carefully to understand our views and practices regarding your personal data and how we will treat it.

We may collect and process the following types of personal data:

• Identity Data: Includes first name, last name, title.
• Contact Data: Includes billing address, delivery address (pickup and drop-off locations), email address, and telephone numbers.
• Booking Data: Includes details about the journeys you book with us, such as dates, times, locations, number of passengers, luggage requirements, and any specific instructions or preferences.
• Financial Data: Includes payment card details or bank account information for processing payments. (Note: We typically use third-party payment processors and do not store full card details ourselves).
• Technical Data (if applicable): Includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website or booking platform.
• Usage Data (if applicable): Includes information about how you use our website, products, and services.
• Communication Data: Includes records of your communications with us, such as emails, phone call recordings (if applicable and notified), and messages via any booking apps or platforms.
• Location Data: Real-time geographical location of our vehicles for operational and safety purposes, and potentially your device location if using a booking app (with your permission).
• Special Category Data: We only collect sensitive personal data (e.g., information about health or disabilities requiring specific vehicle access or assistance) when you provide it to us voluntarily and with your explicit consent, or where necessary for reasons of substantial public interest (e.g., safeguarding).
• Children's Data: We may collect limited personal data about children when necessary for a booking (e.g., age, requirement for child seats). We require parental or guardian consent for processing children's data where applicable by law. We take special care to ensure the safety and privacy of children using our services, including specific procedures for drop-offs (e.g., ensuring safe entry into their home).

We collect information in the following ways:

• Direct Interactions: You give us your Identity, Contact, Booking, and Financial Data by filling in forms, making bookings over the phone, via email, through our website/app, or by corresponding with us.
• Automated Technologies or Interactions (if applicable): As you interact with our website or app, we may automatically collect Technical Data about your equipment, browsing actions, and patterns using cookies and similar technologies.
• Third Parties: We may receive personal data about you from various third parties, such as booking platforms you use to book our services, payment service providers, or analytics providers.
• Vehicle Technology: Location data may be collected from GPS systems installed in our vehicles.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• To Perform a Contract: To process and fulfil your bookings, manage payments, fees, and charges, and provide customer support. (Legal Basis: Performance of a contract)
• Legitimate Interests: To manage our relationship with you, improve our services, ensure the safety and security of our passengers and drivers, manage our fleet, prevent fraud, maintain operational efficiency, and for business management and planning, including accounting and auditing. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. (Legal Basis: Legitimate interests)
• Legal Obligation: To comply with applicable laws and regulations (e.g., licensing requirements, financial regulations, health and safety laws). (Legal Basis: Compliance with a legal obligation)
• Consent: Where you have provided explicit consent, for example, to process special category data related to health for accessibility needs, or for sending direct marketing communications (you can withdraw consent at any time). (Legal Basis: Consent)

Specifically, we use your data to:

• Register you as a new customer.
• Process and deliver your booking requests.
• Manage payments and collect money owed to us.
• Communicate with you regarding your bookings or inquiries.
• Notify you about changes to our terms or privacy policy.
• Administer and protect our business (including troubleshooting, data analysis, testing, system maintenance, support, reporting, and hosting of data).
• Ensure the safety of passengers and drivers.
• Comply with licensing and regulatory requirements.

We may share your personal data with the parties set out below for the purposes set out in section 4:

• Drivers/Employees/Contractors: To enable them to carry out the booked journeys. We only provide the necessary information required for the specific service.
• Service Providers: Third-party companies that provide services on our behalf, such as payment processing, IT and system administration, booking system software, communication tools, cloud hosting, and analytics.
• Professional Advisers: Lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
• Regulatory Authorities: HM Revenue & Customs, regulators (e.g., local licensing authorities), and other authorities who require reporting of processing activities in certain circumstances.
• Third Parties in Business Transfers: Parties to whom we may choose to sell, transfer, or merge parts of our business or our assets.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. We will never sell your personal data to third parties.

We have implemented appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. These measures include:

• Secure servers and data encryption where appropriate.
• Access controls to limit access to personal data to those employees, agents, contractors, and other third parties who have a business need to know.
• Regular security reviews and updates.
• Training for staff on data protection.

We also have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and whether we can achieve those purposes through other means, along with the applicable legal requirements (e.g., financial records must often be kept for 6 years). Journey details may be kept for a period necessary to handle complaints, insurance claims, or regulatory inquiries.

When we no longer need your personal data, we will securely delete or anonymise it.

Under UK data protection law, you have rights including:

• Right of Access: To request copies of your personal data.
• Right to Rectification: To request correction of inaccurate personal data.
• Right to Erasure: To request deletion of your personal data where there is no good reason for us continuing to process it.
• Right to Restrict Processing: To request the suspension of processing of your personal data in certain scenarios.
• Right to Data Portability: To request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format (where processing is based on consent or contract and is automated).
• Right to Object: To object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: To withdraw consent at any time where we are relying on consent to process your personal data.

To exercise any of these rights, please contact us using the details below. We may need to request specific information from you to help us confirm your identity.

Our services may involve the transportation of children. We collect minimal necessary data about children for booking and safety purposes, always striving to obtain parental or guardian consent where required. We implement specific safeguards for children's data and their physical safety during transport, in line with best practices and regulatory guidance.

We generally do not transfer your personal data outside the UK or the European Economic Area (EEA). If we do need to transfer data internationally (e.g., if using a service provider based outside these areas), we will ensure a similar degree of protection is afforded to it by ensuring appropriate safeguards are in place, such as adequacy decisions or Standard Contractual Clauses approved by the UK authorities.

[If AM2PM Travel has a website or app, this section should be detailed. Example placeholder:]Our website/app may use cookies and similar technologies to distinguish you from other users, provide functionality, and improve user experience. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the website/service may become inaccessible or not function properly. A separate Cookie Policy may provide more detailed information.

We keep our privacy policy under regular review. Any changes will be posted on this page, and where appropriate, notified to you by email or other means. The date the policy was last updated is shown at the top.

If you have any questions about this privacy policy or our privacy practices, or if you wish to exercise any of your data protection rights, please contact us:

• By Email: booking@am2pm.travel
• By Post: Data Protection Enquiry, AM2PM Innovations Ltd, 44 Bath Hill, Keynsham, Bristol, BS31 4HG

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.