Privacy Policy
How Singh Car Service collects, uses, shares and protects your personal data across our operations in the United States, United Kingdom, France and Japan.
Contents
- Scope and application
- Data controller and contact
- Data we collect
- How we use your data
- Legal basis for processing
- Cookies and tracking technologies
- Data sharing and third parties
- International data transfers
- Data retention
- Data security
- Your rights
- California privacy rights (CCPA/CPRA)
- EU and UK rights (GDPR)
- Japan privacy rights (APPI)
- Children's privacy
- Changes to this policy
- How to contact us
1. Scope and application
This Privacy Policy explains how Singh Car Service ("Singh Car Service", "we", "us", "our") collects, uses, discloses and protects personal information when you visit our website singhcarservice.com, book chauffeur or limousine services, use our mobile applications, contact our customer support team, or otherwise interact with our services.
This policy applies to individuals in every jurisdiction where we operate, including the United States, the United Kingdom, France (European Union) and Japan. Where regional laws apply additional or different rights, those are addressed in dedicated sections below (see California, EU/UK, and Japan sections).
This policy does not apply to services offered by third parties, including our chauffeur partners' personal websites, third-party payment gateways, or external hotels and airports that we work with. Each of those has its own privacy policy.
2. Data controller and contact
The data controller responsible for your personal data is:
Singh Car Service
[YOUR REGISTERED COMPANY ADDRESS]
Washington DC, United States
Email: privacy@singhcarservice.com
For customers in the European Union and United Kingdom, our EU/UK representative and Data Protection Officer contact is available at the same email address above.
Singh Car Service has been operating since 2008 and provides chauffeur, limousine and airport transfer services in Washington DC, London, Paris and Tokyo. Our processing of personal data reflects that global operating model.
3. Data we collect
We collect personal data in three main ways: information you provide directly, information collected automatically when you use our services, and information from third-party sources.
3.1 Information you provide directly
| Category | Examples |
|---|---|
| Identity data | Title, first name, last name, date of birth (only if required for corporate account or child seat compliance) |
| Contact data | Email address, phone number, billing address, employer/company name |
| Booking data | Pickup location, drop-off location, date and time, flight number, vehicle preference, number of passengers, special requests |
| Payment data | Credit card details (processed by our payment providers, we store only the last four digits and expiry), billing name, VAT number for corporate accounts |
| Account data | Username, password (hashed), account preferences, saved locations, preferred vehicle class |
| Communication data | Emails, chat messages, phone call records (where legally permitted and disclosed at time of call), support tickets, feedback and reviews |
3.2 Information collected automatically
- Device data: device type, operating system, browser type and version, mobile network information, device identifiers
- Usage data: pages visited, features used, search queries within our site, referral source, session duration
- Location data: IP-based approximate location, and precise GPS location if you enable it in our mobile app for pickup identification
- Ride data: actual route taken (from chauffeur GPS during your ride), estimated and actual pickup and drop-off times, journey duration
- Log data: server logs, error logs, access timestamps
3.3 Information from third-party sources
- Corporate travel bookers who book on your behalf
- Travel agencies and hotel concierge services that reserve rides for you
- Flight tracking services (to monitor your arrival time)
- Payment processors and fraud prevention services
- Google, Apple or Facebook if you sign in using their identity services
- Publicly available business directories for B2B corporate accounts
4. How we use your data
We use your personal data for the following purposes:
- Service delivery: to book, dispatch, execute and complete your chauffeur or limousine service, communicate with your chauffeur, track your flight, confirm pickup, and provide the ride itself
- Payment processing: to charge your card, issue receipts and invoices, handle refunds and disputes, and process corporate account billing
- Customer support: to answer your questions, resolve service issues, handle complaints and process feedback
- Account management: to maintain your account, verify identity, restore access, and provide account statements
- Safety and security: to protect passengers and chauffeurs, verify identity for high-value bookings (embassy transfers, VIP protection), maintain lost-and-found records
- Fraud prevention: to detect and prevent fraudulent bookings, chargebacks, and unauthorized use of payment methods
- Legal compliance: to comply with tax, transport licensing, anti-money laundering and other legal obligations in each jurisdiction where we operate
- Marketing (with consent): to send you promotional emails about our services in cities you have used us, only when you have opted in
- Service improvement: to analyze usage patterns, improve our website and apps, train our chauffeurs, and develop new services
- Corporate account management: to manage your employer's account, produce monthly consolidated invoicing, and provide cost-centre reporting
5. Legal basis for processing (EU and UK)
For individuals in the European Union and United Kingdom, we process your personal data on the following legal bases under Article 6 of the GDPR and UK GDPR:
| Basis | Applied to |
|---|---|
| Contract performance (Art. 6(1)(b)) | All processing necessary to deliver the booked service: dispatch, chauffeur communication, payment, receipts, customer support |
| Legitimate interests (Art. 6(1)(f)) | Fraud prevention, service improvement, network security, direct marketing to existing customers |
| Consent (Art. 6(1)(a)) | Marketing emails to prospects, non-essential cookies, sharing data with social media platforms, precise location tracking |
| Legal obligation (Art. 6(1)(c)) | Tax records, transport licensing compliance, response to lawful requests from authorities |
8. International data transfers
Singh Car Service operates in the United States, United Kingdom, France and Japan. To deliver services and provide a consistent global booking experience, we transfer personal data between these regions.
8.1 Transfers from the EU/UK to the United States
When we transfer personal data from our France operations to our US headquarters or US-based service providers, we rely on the following safeguards:
- EU Standard Contractual Clauses (SCCs) approved by the European Commission
- UK International Data Transfer Agreement (IDTA) or UK Addendum to the SCCs
- Additional technical measures including encryption in transit and at rest
- EU-US Data Privacy Framework certification where applicable to our processors
8.2 Transfers involving Japan
Japan has an adequacy decision from the European Commission (Art. 45 GDPR), so transfers between our France and Japan operations do not require additional safeguards. Transfers between our US and Japan operations rely on APPI-compliant data protection agreements.
8.3 Transfer impact assessments
We have conducted transfer impact assessments for all our international data flows and continue to monitor legal developments (including US surveillance law and EU adequacy decisions) that may affect these transfers.
9. Data retention
We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law.
| Data category | Retention period |
|---|---|
| Ride booking and payment records | 7 years (tax and accounting requirements in the US, UK, France and Japan) |
| Account data (active accounts) | For the life of the account, plus 30 days after closure |
| Marketing consent records | Until consent is withdrawn, plus 3 years |
| Customer support communications | 3 years from last interaction |
| Chauffeur GPS route data | 90 days for standard rides; 12 months for disputed rides |
| Website analytics (anonymized) | 26 months (Google Analytics default) |
| Marketing email data | Until unsubscribe, plus suppression list retention indefinitely |
After the retention period expires, data is either securely deleted or irreversibly anonymized for statistical purposes.
10. Data security
We use technical and organizational security measures to protect personal data:
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for sensitive data at rest
- Payment card data handled per PCI DSS by our payment processors; we do not store full card numbers
- Multi-factor authentication for all administrative access
- Role-based access control on internal systems
- Regular security audits and penetration testing
- Employee training on data protection and confidentiality obligations
- Incident response plan and notification procedures
No system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and notify affected individuals without undue delay, as required by GDPR, UK GDPR, US state breach notification laws and APPI.
11. Your rights
Depending on your jurisdiction, you have certain rights over your personal data. Regardless of your location, we honor these baseline rights for all customers:
- Access: request a copy of the personal data we hold about you
- Rectification: correct inaccurate or incomplete data
- Erasure: request deletion of your data (subject to legal retention obligations)
- Restriction: ask us to limit our processing of your data
- Objection: object to processing based on legitimate interests or direct marketing
- Portability: receive your data in a machine-readable format for transfer to another provider
- Withdraw consent: where processing is based on your consent, withdraw it at any time
To exercise any of these rights, email privacy@singhcarservice.com from the email address associated with your account, or use the account settings page when logged in. We respond within 30 days (extendable by two months for complex requests, with notice).
Requests are free of charge. We may charge a reasonable fee or refuse manifestly unfounded, excessive or repetitive requests, in line with applicable law.
12. California privacy rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act (together "CCPA") gives you additional rights:
12.1 Categories of personal information collected
In the past 12 months, we have collected the following CCPA categories: identifiers (name, email, phone), commercial information (booking history), internet activity (browsing on our site), geolocation, and inferences drawn from the above.
12.2 Sale and sharing of personal information
We do not sell personal information for monetary consideration. We may "share" personal information for cross-context behavioral advertising as defined by the CPRA, specifically when advertising platforms like Google Ads and Meta receive site interaction data. You have the right to opt out of this sharing.
12.3 Sensitive personal information
We do not use sensitive personal information for purposes beyond those permitted without a right to limit use. We do not collect precise geolocation without your explicit consent through the app.
12.4 Your California rights
- Right to know what personal information we collect, use, disclose and sell/share
- Right to delete personal information
- Right to correct inaccurate personal information
- Right to opt out of sale or sharing
- Right to limit use of sensitive personal information
- Right to non-discrimination for exercising CCPA rights
12.5 How to exercise California rights
Use the "Do Not Sell or Share My Personal Information" link in the website footer, email privacy@singhcarservice.com, or call our toll-free number listed in the footer. We honor the Global Privacy Control (GPC) signal as a valid opt-out.
Authorized agents may submit requests on your behalf. We will verify agent authority before processing.
13. EU and UK rights (GDPR)
If you are in the European Economic Area, United Kingdom or Switzerland, you have the rights listed in Section 11 plus the additional rights under GDPR and UK GDPR:
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)
- Right not to be subject to automated decision-making (Art. 22 GDPR)
13.1 Supervisory authorities
- France: Commission Nationale de l'Informatique et des Libertes (CNIL) - cnil.fr
- United Kingdom: Information Commissioner's Office (ICO) - ico.org.uk
- Other EU member states: the data protection authority in your country of residence
13.2 Automated decision-making
We use limited automated decision-making for fraud prevention (payment risk scoring). A human reviews all refusals before final decision. You have the right to request human review, express your point of view, and contest the decision.
14. Japan privacy rights (APPI)
If you are in Japan, the Act on the Protection of Personal Information (APPI) applies. In addition to the general rights in Section 11:
- You have the right to request disclosure of your retained personal data
- You have the right to request correction, addition, or deletion of retained personal data
- You have the right to request cessation of use or third-party provision
- You have the right to request disclosure of records of third-party provision
The Personal Information Protection Commission (PPC) of Japan is the supervisory authority. You may file a complaint at ppc.go.jp.
For transfers of your personal data outside Japan, we obtain your consent or rely on other legal bases as required by APPI.
15. Children's privacy
Our services are directed to adults. We do not knowingly collect personal information from children under the age of 16 (or the applicable minimum age in your jurisdiction) without verifiable parental consent.
Where children are transported as passengers on a family booking, we collect only the child's approximate age and weight for the purpose of selecting appropriate car seats. This data is retained only for the duration of the booking and deleted after the ride.
If you believe we have collected personal information from a child in violation of this policy, contact us at privacy@singhcarservice.com and we will investigate and delete the data promptly.
16. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements or service offerings. When we make material changes, we will:
- Update the "Last updated" date at the top of this page
- Notify registered users by email at least 30 days before the change takes effect (for material changes)
- Post a notice on our website home page for material changes
- Where required by law, obtain your consent to the new terms
Prior versions of this Privacy Policy are available on request.
17. How to contact us
For any question about this Privacy Policy, to exercise your rights, or to lodge a privacy complaint, contact us:
Privacy inquiries
Email: privacy@singhcarservice.com
Mail: Singh Car Service, 10640 John Ayres Dr Fairfax, VA, United States
Phone: +1 (202) 320-6627
UK/EU Representative: Available at the same email address above.
Data Protection Officer (EU/UK): Available at the same email address above.