Who owns your booking data? Data ownership in taxi software contracts

Your bookings, your regulars' numbers, your account customers and your price list are most of what your firm is worth. They also live on somebody else's computer. This guide explains who has which rights over that data under UK law, where the contract matters more than the law, and what to check before you sign with any dispatch or booking software supplier, so taxi software data ownership is something you decide rather than something you find out when you try to leave.

Who owns the booking data in your taxi software?

Data ownership in taxi software is set by two things: data protection law, which decides who is responsible for the personal details in it, and your contract, which decides almost everything else.

Data protection law doesn't talk about owning personal data. It talks about who decides what happens to it. Your passengers' names, numbers and addresses, and your drivers' details, are personal data, and the question is whether you or your supplier is the "controller" of them.

The rest of your data is a different matter. Your price list, your zone map, your booking history as a whole and your reports aren't personal data in the same way. For a database as a whole, the Copyright and Rights in Databases Regulations 1997 create a "database right" where there has been "a substantial investment in obtaining, verifying or presenting the contents". The maker is the first owner of that right, and the maker is the person who "takes the initiative" and "assumes the risk of investing". A firm that has built up years of bookings has a fair claim to that, but a contract can say otherwise, so read the clause on intellectual property and data before you sign.

Are you the controller or the processor?

As the licensed operator you're normally the controller, and the software company is your processor. The ICO puts it simply: if you decide why and how personal data is used, you're a controller; if you handle it on someone else's instructions, you're a processor.

You take the booking in your firm's name, under your licence, because you have to record it and do the job. Section 56 of the Local Government (Miscellaneous Provisions) Act 1976 makes you record the particulars of every booking. The software supplier stores and handles that data for you. The ICO's own example is a gym that hires a printer to address event invitations to its members: the gym is the controller, and the printer only acts on its instructions.

Three consequences follow:

• You stay responsible. The ICO says a controller remains "primarily responsible for its own compliance and ensuring the compliance of its processors". Choosing a supplier with poor security is your problem as well as theirs.
• The data protection fee is yours to pay. Unless you're exempt, you pay the data protection fee to the ICO as a controller. Since 17 February 2025 it has been £52 a year at tier 1 (turnover up to £632,000 or no more than 10 staff) and £78 at tier 2. Your supplier's own fee doesn't cover your firm.
• A supplier that uses your data for itself stops being just a processor. Article 28(10) of the UK GDPR says a processor that decides the purposes and means of processing is treated as a controller for that processing. A supplier that markets to your passengers, or uses your prices to set someone else's, is acting for itself, not for you.

The same idea runs through taxi licensing. The Department for Transport's Statutory Standards say operators can outsource booking and dispatch but can't pass on the obligation to protect children and vulnerable adults. Software changes who does the work, not who answers for it.

What must a dispatch software contract say about your data?

Article 28 of the UK GDPR says a contract between a controller and a processor must contain certain terms. Here's what each one means for a taxi firm:

If a supplier's contract doesn't have these terms, or the only contract is a tick box on a sign-up page, ask for a data processing agreement before you load a single customer.

What should you check that the law doesn't cover?

The law sets a floor for personal data. It doesn't give your firm a right to a usable export, to your price list, or to your phone number. The UK GDPR's right to data portability belongs to individuals, not businesses: the ICO describes it as a right for individuals to receive "personal data they have provided to a controller". So your firm's right to leave with its data is whatever the contract gives you.

Eight things to check in any dispatch or booking software contract:

1. A clear statement that the data is yours. Bookings, customers, drivers, prices and call recordings, and that you're the controller.
2. How you export your bookings. Which data, in what format (ask for CSV), how often, and whether it costs anything.
3. What happens when you leave. Return first, then deletion, with a timescale in days. You need the bookings back because the Statutory Standards suggest keeping booking records for at least 6 months, and some councils ask for 12.
4. What the supplier may do with your data. Nothing beyond running your account, unless the contract names it.
5. Anonymised totals and AI training. Whether the supplier uses figures from your account, or recordings of your calls, to improve its product, and whether you can say no.
6. Who can open your account. Which of the supplier's people can see your data, and whether that access is logged.
7. Sub-processors and where the data goes. The list of other companies involved and the countries they work from. The ICO says sending personal data to a separate organisation outside the UK is a "restricted transfer", which needs UK adequacy regulations, safeguards such as the International Data Transfer Agreement, or an exception.
8. The things that aren't data. Who holds your booking phone number, your app store listings and your website booking form when the contract ends.

If you're moving between systems, our guide to switching taxi dispatch systems shows how to use these clauses on the way out, and our questions to ask a dispatch software supplier covers the rest of the conversation.

What happens to your data when bookings come from an aggregator?

When a passenger books through someone else's app or website and the job is passed to you, that platform sets the rules for the passenger's details. The passenger signed up with the platform, so the platform decides what it collects, which on the ICO's definitions makes it a controller in its own right. You get what it chooses to pass on.

That's the aggregator problem. You do the driving and carry the licence duties, because if you accept the booking you still have to record it under section 56, but the customer relationship stays with the platform. Its terms decide whether you can contact the passenger again.

Marketing is where this bites. The ICO's soft opt-in rule "means you may be able to email or text your own customers, but it does not apply to prospective customers or new contacts". A passenger who bought from a platform has been the platform's customer, so check its terms and the ICO's rules before you send them any offer.

The practical answer is to win more bookings directly, where the passenger is your customer from the first call. Our guides to where your taxi bookings come from and turning passengers into regulars cover how.

What does Dispatch AI's contract say about your data?

Dispatch AI is booking and dispatch software for taxi and private hire firms. What its contract says about your bookings, passengers, drivers and prices is set out on the Dispatch AI data page, so you can hold it up against the eight checks in this guide.