US State Privacy Rights

1. Who is responsible for your information

This is the question that determines everything else in this document, and the answer depends on how you came into contact with us.

2. What we collect, and why

The categories below use the CCPA's own vocabulary so they can be compared against the statute directly.

Sensitive personal information. Driver licence numbers and background-check status are sensitive personal information under the CPRA. We use them only to provide the service the operator asked for — compliance tracking — and never to infer characteristics about anyone. That is a permitted use, so the "limit the use of my sensitive personal information" right does not restrict it further; you can still ask us to delete it, subject to the operator's legal retention duties.

3. We do not sell or share your information

We have never sold personal information, and we do not share it for cross-context behavioural advertising. Those two terms have specific statutory meanings, and we mean them in that sense, not in a loose one.

Concretely, that means: no advertising pixels on this website, no data brokers, no analytics that follow you across sites, and no arrangement under which anyone receives personal information from us in exchange for anything of value.

We disclose personal information only to the subprocessors listed in our Data Processing Addendum — hosting, database, payments and push notifications — each of which is contractually barred from using it for their own purposes. Under the CCPA those are service-provider disclosures, not sales.

4. Your rights

California residents have the rights below under the CCPA as amended by the CPRA. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have closely equivalent rights, and we handle all of them through the same process.

Right to know

What personal information we hold about you, where it came from, why we have it, and who we disclosed it to.

Right to delete

Ask us to delete personal information we hold about you, subject to the exceptions below.

Right to correct

Have inaccurate personal information corrected.

Right to portability

Receive a copy in a portable, machine-readable format.

Right to opt out of sale or sharing

Not applicable to us in practice — we do neither — but it exists and we will honour it if that ever changes.

Right to limit sensitive information use

Restrict use of sensitive personal information to what is necessary to provide the service.

Right to non-discrimination

We will not deny service, charge a different price or give you a worse experience because you exercised a right.

Right to appeal

If we refuse a request, you may appeal. Several states require this; we offer it to everyone.

5. How to exercise a right

Email privacy@cabica.co.uk with the word "Privacy request" in the subject line, and tell us:

• which right you want to exercise;
• which state you are a resident of;
• whether you are a passenger, a driver, an operator contact or a website visitor — and, if you are a passenger or driver, the name of the taxi firm.

Timing. We acknowledge within 10 business days and respond substantively within 45 days. If we need longer we will tell you why, and take no more than a further 45 days.

Verification. We will ask you to confirm details we already hold, to a standard proportionate to what you are asking for — more for a deletion than for a copy of a mailing preference. We will not ask you to create an account to make a request, and any information you give us for verification is used only for that.

Authorised agents. You may use an authorised agent. We will ask for written permission signed by you, and we may still contact you directly to confirm.

Appeals. If we refuse, our refusal will say why and how to appeal. Send an appeal to the same address with "Appeal" in the subject; a different person reviews it and responds within 45 days. If we still refuse, we will tell you how to complain to your state Attorney General.

6. When we may refuse

We may decline a request, in whole or in part, where:

• we cannot verify who you are to a reasonable standard;
• you are asking us about operator data. We hold passenger and driver records on the operator's instructions as their service provider. Deleting them on our own initiative would breach our contract with them and could destroy records they are legally required to keep. We will forward your request to them within 5 business days and tell you we have done so;
• the law requires the information to be kept — licensing records, tax records, and records needed for a legal claim are the usual cases;
• the request is manifestly unfounded or excessive, particularly if repetitive. We will explain why rather than simply not replying.

7. A note on whether the CCPA applies to us

Cabica Ltd is a UK company. The CCPA applies to businesses doing business in California that meet at least one statutory threshold — broadly, annual gross revenue above $25 million, personal information of 100,000 or more California consumers or households, or deriving 50% or more of revenue from selling or sharing personal information.

We do not currently meet any of those thresholds. We are publishing this document, and honouring these rights, because a prospective customer is entitled to know where they stand before they ask, and because the alternative — writing this the week we cross a threshold — is how compliance gaps happen.

8. Contact

Privacy requests and questions about this document: privacy@cabica.co.uk.

If you are a passenger or a driver, contacting the taxi firm you dealt with will almost always get you a faster answer, because they hold both the relationship and the legal responsibility.