Canadian Privacy Notice

1. Which law applies to you

Canada has a federal privacy statute and several provincial ones, and which applies depends on where the organisation collecting your information operates.

Alberta and BC PIPA have been declared substantially similar to PIPEDA, so what we do is the same in each. Quebec's regime is stricter in several specific respects, and section 7 covers those separately.

2. Who is accountable for your information

PIPEDA's first principle is accountability, and it stays with the organisation that collected your information. It does not transfer to a supplier.

3. Your information is processed outside Canada

This is the part Canadian operators and passengers most need to know, so it is not buried further down.

Cabica Ltd is a UK company. Personal information processed through the platform is stored and handled in the United Kingdom and the European Economic Area, and some subprocessors operate in the United States. While it is in those countries it is subject to their laws, and it may be accessible to their courts, law enforcement and national security authorities under those laws.

PIPEDA permits transferring personal information to a service provider outside Canada for processing. It requires two things of the transferring organisation, and we support both: that the information gets a comparable level of protection through contract, and that individuals are told the processing happens abroad. Our Data Processing Addendum provides the contractual protection; this section provides the notice.

Comparable protection is provided through the UK GDPR standard we already apply to all operator data — the same encryption in transit and at rest, the same access controls, the same subprocessor obligations, and the same breach commitments. Those terms are in our Data Processing Addendum and apply to Canadian operators without amendment.

4. What we handle and why

We collect only what the service needs. For passenger and driver information the purposes are set by the operator; the table records the purposes the platform is built to serve.

We do not sell personal information, we do not disclose it for advertising, and we do not use it to build profiles of anyone. This website sets no cookies and runs no analytics.

5. Consent, and withdrawing it

PIPEDA is a consent-based statute. In practice the consent for a taxi booking is obtained by the operator at the point of booking — you give your name and where you want to go because you want a taxi, and the purpose is obvious from the circumstances.

For anything not obvious from the circumstances, express consent is required and it is the operator's job to obtain it. Marketing messages are the usual example: an operator using the platform to send promotional messages must have consent that also satisfies Canada's anti-spam legislation, and that is their obligation, not ours.

Withdrawing consent. You may withdraw consent at any time, subject to legal and contractual restrictions and reasonable notice. Withdrawing consent for information needed to provide a service means the service can no longer be provided — an operator cannot dispatch a taxi to someone who has withdrawn consent to hold an address. Some information must be kept regardless of withdrawal: booking records required by a licensing authority, and financial records required by tax law.

6. Your rights

Access

Ask what personal information is held about you, how it is used, and to whom it has been disclosed. Response within 30 days, extendable with notice.

Correction

Have inaccurate or incomplete information corrected. If we disagree, we record that you disputed it.

Withdraw consent

Subject to legal and contractual restrictions, and to the consequences described above.

Complain

To the accountable organisation first, then to the relevant Commissioner if you are not satisfied.

Portability (Quebec)

Since September 2024, receive computerised personal information in a structured, commonly used technological format.

De-indexing (Quebec)

Request that information about you cease to be disseminated, or that a link to it be de-indexed, in the circumstances Law 25 provides for.

Automated decisions. The platform assigns bookings to drivers automatically, based on availability, vehicle type and queue position. Under Quebec Law 25, where a decision is based exclusively on automated processing, the individual must be informed and may ask for the reasons and the main factors behind it, and may submit observations to a human. Dispatch allocation is that kind of decision, so: the factors are driver availability, vehicle suitability for the booking, and how long each driver has waited in the pickup zone. A controller can override any allocation, and any driver or passenger may ask the operator to review one.

7. Additional information for Quebec

Law 25 imposes obligations beyond PIPEDA. Where Cabica is the accountable organisation, the following applies. Where the operator is accountable, these are obligations we support them in meeting.

• Privacy officer. Law 25 requires a designated person with published contact details. Ours is reachable at privacy@cabica.co.uk.
• Privacy by default. Any settings we offer that affect the privacy of an individual default to the most protective option. Operators can loosen them deliberately; they are never loosened silently.
• Privacy impact assessments. Required before a transfer outside Quebec and before acquiring or overhauling a system involving personal information. We provide the technical detail an operator needs to complete one.
• Confidentiality incidents. Law 25 requires a register of confidentiality incidents and notification where there is a risk of serious injury. Our breach process below feeds both.
• Biometrics. The platform does not collect or process biometric information. If that ever changes, Law 25 requires disclosure to the Commission before the database is brought into service.

8. If something goes wrong

PIPEDA requires an organisation to report a breach of security safeguards to the Privacy Commissioner and to affected individuals where it creates a real risk of significant harm — and to keep a record of *every* breach for 24 months, whether or not it met that threshold. Quebec has an equivalent obligation framed around risk of serious injury.

Where Cabica is the processor and the operator is accountable, our commitments are:

• we notify the operator without undue delay and in any case within 24 hours of becoming aware, so they can meet their own reporting deadline;
• we provide what they need to assess real risk of significant harm — what happened, when, which categories of information and how many people were affected, and what we have done;
• we record every incident in our own register regardless of severity, and keep it for at least 24 months;
• we do not notify individuals directly unless the operator asks us to, because notifying an operator's passengers over their head would cause its own harm.

Where Cabica is the accountable organisation — our website visitors, sales contacts and operator billing records — we report and notify ourselves.

9. Contact and complaints

Privacy requests, questions and complaints: privacy@cabica.co.uk.

We respond to access requests within 30 days. If we need an extension the law permits one, and we will tell you before the 30 days are up, not after.

If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, or to your provincial Commissioner if you are in Alberta, British Columbia or Quebec. You do not need our permission and you do not need to tell us first — though we would rather have the chance to put it right.