# Who owns your booking data? Data ownership in taxi software contracts

> Under UK data protection law nobody owns passenger data outright. As the licensed operator you're normally the controller, and your taxi software supplier is a processor acting on your instructions. Article 28 of the UK GDPR says the contract must make the supplier return or delete your data when you leave. Exports, prices and reports depend on what the contract says, so read it before you sign.

By Joe, founder of Dispatch AI. Updated 2026-10-18. The web page: https://dispatchai.co.uk/guides/who-owns-your-taxi-booking-data/

Your bookings, your regulars' numbers, your account customers and your price list are most of what your firm is worth. They also live on somebody else's computer. This guide explains who has which rights over that data under UK law, where the contract matters more than the law, and what to check before you sign with any dispatch or booking software supplier, so taxi software data ownership is something you decide rather than something you find out when you try to leave.


## Who owns the booking data in your taxi software?

Data ownership in taxi software is set by two things: data protection law, which decides who is responsible for the personal details in it, and your contract, which decides almost everything else.

Data protection law doesn't talk about owning personal data. It talks about who decides what happens to it. Your passengers' names, numbers and addresses, and your drivers' details, are personal data, and the question is whether you or your supplier is the "controller" of them.

The rest of your data is a different matter. Your price list, your zone map, your booking history as a whole and your reports aren't personal data in the same way. For a database as a whole, the Copyright and Rights in Databases Regulations 1997 create a "database right" where there has been "a substantial investment in obtaining, verifying or presenting the contents". The maker is the first owner of that right, and the maker is the person who "takes the initiative" and "assumes the risk of investing". A firm that has built up years of bookings has a fair claim to that, but a contract can say otherwise, so read the clause on intellectual property and data before you sign.


## Are you the controller or the processor?

As the licensed operator you're normally the controller, and the software company is your processor. The ICO puts it simply: if you decide why and how personal data is used, you're a controller; if you handle it on someone else's instructions, you're a processor.

You take the booking in your firm's name, under your licence, because you have to record it and do the job. Section 56 of the Local Government (Miscellaneous Provisions) Act 1976 makes you record the particulars of every booking. The software supplier stores and handles that data for you. The ICO's own example is a gym that hires a printer to address event invitations to its members: the gym is the controller, and the printer only acts on its instructions.

Three consequences follow:

- **You stay responsible.** The ICO says a controller remains "primarily responsible for its own compliance and ensuring the compliance of its processors". Choosing a supplier with poor security is your problem as well as theirs.
- **The data protection fee is yours to pay.** Unless you're exempt, you pay the data protection fee to the ICO as a controller. Since 17 February 2025 it has been £52 a year at tier 1 (turnover up to £632,000 or no more than 10 staff) and £78 at tier 2. Your supplier's own fee doesn't cover your firm.
- **A supplier that uses your data for itself stops being just a processor.** Article 28(10) of the UK GDPR says a processor that decides the purposes and means of processing is treated as a controller for that processing. A supplier that markets to your passengers, or uses your prices to set someone else's, is acting for itself, not for you.

The same idea runs through taxi licensing. The Department for Transport's Statutory Standards say operators can outsource booking and dispatch but can't pass on the obligation to protect children and vulnerable adults. Software changes who does the work, not who answers for it.


## What must a dispatch software contract say about your data?

Article 28 of the UK GDPR says a contract between a controller and a processor must contain certain terms. Here's what each one means for a taxi firm:

| Article 28 term | What it means for you |
|---|---|
| Acts only on your documented instructions | The supplier uses your passengers' details to run your bookings, and nothing else unless you agree |
| Sub-processors only with your authorisation | The supplier uses other companies, such as hosting, phone or AI providers, only with your written authorisation, and tells you before it adds or changes one so you can object |
| The same terms passed down | Any sub-processor signs up to the same data protection terms, and the supplier stays liable for them |
| Helps you with your duties | The supplier helps you answer a passenger's request for their data and deal with a breach |
| Deletes or returns the data at the end | At your choice, the supplier returns or deletes all the personal data when the service ends, and deletes its copies unless the law requires it to keep them |
| Audits and information | The supplier gives you what you need to show it's meeting these terms |

If a supplier's contract doesn't have these terms, or the only contract is a tick box on a sign-up page, ask for a data processing agreement before you load a single customer.


## What should you check that the law doesn't cover?

The law sets a floor for personal data. It doesn't give your firm a right to a usable export, to your price list, or to your phone number. The UK GDPR's right to data portability belongs to individuals, not businesses: the ICO describes it as a right for individuals to receive "personal data they have provided to a controller". So your firm's right to leave with its data is whatever the contract gives you.

Eight things to check in any dispatch or booking software contract:

1. **A clear statement that the data is yours.** Bookings, customers, drivers, prices and call recordings, and that you're the controller.
2. **How you export your bookings.** Which data, in what format (ask for CSV), how often, and whether it costs anything.
3. **What happens when you leave.** Return first, then deletion, with a timescale in days. You need the bookings back because the Statutory Standards suggest keeping booking records for at least 6 months, and some councils ask for 12.
4. **What the supplier may do with your data.** Nothing beyond running your account, unless the contract names it.
5. **Anonymised totals and AI training.** Whether the supplier uses figures from your account, or recordings of your calls, to improve its product, and whether you can say no.
6. **Who can open your account.** Which of the supplier's people can see your data, and whether that access is logged.
7. **Sub-processors and where the data goes.** The list of other companies involved and the countries they work from. The ICO says sending personal data to a separate organisation outside the UK is a "restricted transfer", which needs UK adequacy regulations, safeguards such as the International Data Transfer Agreement, or an exception.
8. **The things that aren't data.** Who holds your booking phone number, your app store listings and your website booking form when the contract ends.

If you're moving between systems, our guide to [switching taxi dispatch systems](https://dispatchai.co.uk/guides/switching-taxi-dispatch-system/) shows how to use these clauses on the way out, and our [questions to ask a dispatch software supplier](https://dispatchai.co.uk/guides/taxi-dispatch-software-questions-to-ask/) covers the rest of the conversation.


## What happens to your data when bookings come from an aggregator?

When a passenger books through someone else's app or website and the job is passed to you, that platform sets the rules for the passenger's details. The passenger signed up with the platform, so the platform decides what it collects, which on the ICO's definitions makes it a controller in its own right. You get what it chooses to pass on.

That's the aggregator problem. You do the driving and carry the licence duties, because if you accept the booking you still have to record it under section 56, but the customer relationship stays with the platform. Its terms decide whether you can contact the passenger again.

Marketing is where this bites. The ICO's soft opt-in rule "means you may be able to email or text your own customers, but it does not apply to prospective customers or new contacts". A passenger who bought from a platform has been the platform's customer, so check its terms and the ICO's rules before you send them any offer.

The practical answer is to win more bookings directly, where the passenger is your customer from the first call. Our guides to [where your taxi bookings come from](https://dispatchai.co.uk/guides/where-your-taxi-bookings-come-from/) and [turning passengers into regulars](https://dispatchai.co.uk/guides/turning-passengers-into-regulars/) cover how.


## What does Dispatch AI's contract say about your data?

Dispatch AI is booking and dispatch software for taxi and private hire firms. What its contract says about your bookings, passengers, drivers and prices is set out on [the Dispatch AI data page](https://dispatchai.co.uk/your-data/), so you can hold it up against the eight checks in this guide.

## Frequently asked questions

### Can my software supplier contact my passengers?

Only to run your bookings on your instructions, such as sending the confirmation you've set up. A supplier that uses your passengers' details for its own marketing is deciding the purpose itself, and Article 28(10) treats it as a controller for that use. Your contract should rule it out in plain words.

### Do I have to tell passengers which software company handles their details?

Your privacy information has to tell people who their data is shared with. The ICO's checklist includes "the recipients or categories of recipients of the personal data", so naming your booking and dispatch supplier, or at least the kind of supplier, belongs in your privacy notice.

### Who owns the recordings of calls to my booking line?

The callers' voices and details are personal data, so the same controller and processor rules apply, with you as the controller. Make sure the contract says how long recordings are kept, who can listen to them, and that they come back to you or get deleted when you leave.

### What if my supplier goes out of business?

Take a full export regularly, monthly at least, and keep it somewhere you control. Then you're never relying on one company staying in business to show a council officer last year's bookings.

### Is a data processing agreement the same as the main contract?

It can be part of the main contract or a separate document. What matters is that the Article 28 terms are written down and signed. If a supplier can't show you them, treat that as an answer.


## Sources

- [What are 'controllers' and 'processors'? (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/) the definitions and the gym and printer example (event invitations)
- [What needs to be included in the contract? (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/) the Article 28 contract terms
- [What responsibilities and liabilities do controllers have when using a processor? (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/responsibilities-and-liabilities-for-controllers-using-a-processor/) the controller stays primarily responsible
- [UK GDPR, Article 28: Processor (legislation.gov.uk)](https://www.legislation.gov.uk/eur/2016/679/article/28) 28(3)(g) return or deletion, 28(10) a processor that decides purposes becomes a controller
- [Right to data portability (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-data-portability/) a right for individuals; the ICO notes the page is under review after the Data (Use and Access) Act
- [A brief guide to international transfers (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide/) restricted transfers, adequacy, the IDTA and exceptions
- [Electronic mail marketing (ICO)](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/) the soft opt-in for your own customers
- [Right to be informed (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-be-informed/) privacy information must name recipients or categories of recipients
- [The Data Protection (Charges and Information) Regulations 2018, regulation 3 (legislation.gov.uk)](https://www.legislation.gov.uk/uksi/2018/480/regulation/3) the fee amounts and tiers as amended by S.I. 2025/63, in force 17 February 2025
- [Data protection fee regime: government response (DSIT)](https://www.gov.uk/government/consultations/data-protection-fee-regime-proposed-changes/outcome/data-protection-fee-regime-government-response) the tier 1 and tier 2 limits
- [The Copyright and Rights in Databases Regulations 1997, regulation 13 (legislation.gov.uk)](https://www.legislation.gov.uk/uksi/1997/3032/regulation/13) when database right exists
- [The Copyright and Rights in Databases Regulations 1997, regulation 14 (legislation.gov.uk)](https://www.legislation.gov.uk/uksi/1997/3032/regulation/14) who the maker of a database is
- [The Copyright and Rights in Databases Regulations 1997, regulation 15 (legislation.gov.uk)](https://www.legislation.gov.uk/uksi/1997/3032/regulation/15) the maker is the first owner
- [Statutory Taxi and Private Hire Vehicle Standards (Department for Transport)](https://www.gov.uk/government/publications/statutory-taxi-and-private-hire-vehicle-standards/statutory-taxi-and-private-hire-vehicle-standards) outsourcing booking and dispatch doesn't pass on the safeguarding duty
- [Private hire operator's general conditions (Bath & North East Somerset Council)](https://bathnes.gov.uk/sites/default/files/jsna/Private%20Hire%20Operator%20Conditions.pdf) an example of a council asking for 12 months of records
- [Local Government (Miscellaneous Provisions) Act 1976, section 56 (legislation.gov.uk)](https://www.legislation.gov.uk/ukpga/1976/57/section/56) the operator records every booking

Dispatch AI is a trading name of CABO TECH SOLUTION AI LTD, registered in England and Wales, company no. 16255667.