Data Protection Policy

This policy sets out how Tawithsa complies with the Data Protection Act 2018 and the UK GDPR in managing personal data of passengers, drivers, and employees.

This policy applies to all staff, drivers, contractors, and anyone handling personal information on behalf of Tawithsa.

All personal data shall be:

• •Processed lawfully, fairly, and transparently.
• •Collected for specific and legitimate purposes.
• •Limited to what is necessary for the purpose.
• •Accurate and kept up to date.
• •Stored securely and retained only as long as necessary.
• •Processed in a way that ensures appropriate security.

• •Data Protection Officer: Director.
• •Ensures compliance with UK GDPR, oversees data requests, and reports any breaches to the ICO if necessary.

• •All data is stored in password-protected systems or encrypted cloud storage.
• •Access is limited to authorised personnel only.
• •Physical documents are locked securely when not in use.

All staff receive basic data protection and confidentiality training at induction and annually thereafter.

Booking, driver, and complaint records are retained for at least 12 months, in line with TfL’s operator licence requirements.

Any suspected data breach must be reported immediately to the Director, who will assess and notify the ICO within 72 hours if required.

This policy will be reviewed annually or sooner if there are changes in legislation or TfL requirements.