This notice explains how Surrey Link Transport collects and uses personal information when you request a quote, make or manage a booking, create a customer account, contact us, apply to work with us, or travel under a council, school or other transport arrangement.
Surrey Link Transport is the data controller for personal information handled for our own business purposes. Our business address is Newton Court, 27–31 Chessington Road, Epsom, Surrey, KT19 9UX. For privacy enquiries, email info@surreylink.co.uk or call 07736 936636.
For some council, school or contract journeys, the organisation arranging the transport may also be a separate data controller. Its own privacy notice may apply to the information it provides to us.
- Directly from you when you use our website, contact us, make a booking, create an account or travel with us.
- From a parent, carer, passenger, employer, council, school, broker or other person arranging transport.
- From payment, mapping, security, communications and website service providers when they support a booking or our systems.
- Identity and contact details, including name, telephone number, email address and booking contact information.
- Journey details, including pickup and drop-off locations, dates, times, routes, passenger and luggage numbers, flight details, vehicle choice, booking notes and return-journey information.
- Booking-management information, including booking references, status, changes, cancellation requests, request times, refunds, complaints and communications.
- Payment information, including payment amount, method, status and provider reference. Full card details are handled by Stripe and are not stored by us.
- Customer-account information, including account name, email, mobile number, marketing preference and login activity. Passwords are stored as secure hashes rather than readable passwords.
- Passenger-support information where necessary for safe and suitable travel, including accessibility, mobility, child-seat, medical, SEN or safeguarding requirements.
- Messages sent through website forms, email, telephone, WhatsApp or other communication channels.
- Recruitment, employment-history, right-to-work, licensing, safeguarding and reference information where you apply to work with us or provide a reference.
- Technical and security information, including IP address, browser or device information, user agent, security logs, reCAPTCHA results, cookie-consent choices and website interaction data where permitted.
- To calculate quotes, review requests, confirm and deliver bookings, take payments, manage returns, cancellations and refunds, and provide customer support.
- To communicate with passengers, booking contacts, drivers, Passenger Assistants, councils, schools and other relevant parties about a journey.
- To plan safe and suitable transport and manage accessibility, safeguarding and passenger-support requirements.
- To create and operate customer accounts and verify access to booking records.
- To prevent duplicate or fraudulent bookings, secure our website and systems, investigate misuse and maintain business records.
- To process job applications, driver or Passenger Assistant applications and references.
- To meet legal, licensing, safeguarding, insurance, accounting, tax and regulatory duties and to establish, exercise or defend legal claims.
- To improve our website and services and, where you have consented, measure advertising or send occasional marketing.
- Contract and steps before a contract: to provide quotes, accept and manage bookings, take payment and provide the requested transport service.
- Legal obligation: where records or action are required by tax, licensing, equality, safeguarding or other applicable law.
- Legitimate interests: to operate the business, provide customer service, keep evidence of transactions, prevent fraud and duplicate submissions, secure systems, manage complaints and improve services. We consider the impact on individuals before relying on this basis.
- Consent: for optional direct marketing and non-essential cookies or similar technologies. You may withdraw consent at any time.
- Special-category data: health, disability or similar sensitive information is used only where necessary. Depending on the circumstances, the additional condition may be explicit consent, vital interests in an emergency, or substantial-public-interest safeguarding where permitted by UK law.
We do not sell personal information. We share only what is reasonably needed with:
- Drivers, Passenger Assistants, staff and suitably licensed transport providers involved in the booking.
- Stripe and other payment or fraud-prevention providers where online payment is used.
- Website hosting, database, IT, email and communications providers, including Microsoft services used to send booking messages.
- Google services used for Maps, Places, routes, reCAPTCHA and, where permitted, advertising or conversion measurement.
- Councils, schools, parents, carers, brokers, contract partners or other booking organisers where relevant to the transport arrangement.
- Licensing authorities, regulators, insurers, auditors, professional advisers, emergency services or law-enforcement bodies where necessary or required.
Some service providers may process information outside the UK. Where this happens, we require an appropriate legal safeguard, such as UK adequacy regulations, an approved contractual safeguard or another lawful transfer mechanism. You may contact us for more information about the safeguards relevant to your data.
- Booking, payment, refund and related transaction records are normally kept for up to 6 years where needed for tax, accounting, contract, insurance and legal purposes.
- Customer-account credentials are kept while the account remains active and are removed or anonymised when the account is closed, except where linked booking records must still be retained.
- General enquiries and complaint correspondence are kept only for as long as reasonably needed to respond, follow up and protect legal rights.
- Recruitment, staff, safeguarding and contract records are retained according to the role, outcome, relevant contract and legal or regulatory requirements.
- Technical and security logs are kept for a limited period based on security, fraud-prevention and hosting needs.
- When information is no longer required, we delete it, anonymise it or securely restrict it from ordinary use.
- We use essential browser storage to remember your cookie choice and support core website functions.
- Google advertising or conversion-measurement technologies are used only according to your consent choice where consent is required.
- Google Maps, Places and reCAPTCHA may receive technical information needed to provide route, address and security functions. Their own privacy information also applies.
- You can accept or reject non-essential technologies through the cookie banner and revisit your choice using Change cookie settings. You can also clear site data through your browser.
Our website uses automated mapping and pricing rules to calculate estimated distance, journey time and price. We may review booking details before confirmation. We do not use solely automated decision-making that produces legal or similarly significant effects about you.
We use reasonable technical and organisational measures to protect personal information, including access controls, restricted storage areas, secure transmission where supported, password hashing and security checks. No internet service can be guaranteed completely secure, so please do not send unnecessary sensitive information in free-text booking notes.
- Depending on the circumstances, you may ask for access, correction, deletion, restriction, objection or transfer of your personal information.
- You may withdraw consent at any time where processing is based on consent. Withdrawing consent does not affect earlier lawful use.
- You have the right to object at any time to personal information being used for direct marketing.
- Some rights are not absolute, particularly where we must keep records for legal, tax, safeguarding or claims purposes.
- We may ask for information to verify your identity before completing a request.
Our transport services may involve children or vulnerable passengers, but customer accounts and online booking tools are intended for adults arranging transport. Information about a child or vulnerable passenger should be supplied only by an authorised parent, carer, council, school or other responsible organiser and should be limited to what is necessary for safe transport.
To exercise a privacy right or ask a question, email info@surreylink.co.uk. Please include enough information for us to identify the relevant booking or account. You may also complain to the Information Commissioner’s Office through the ICO complaints service.
21 June 2026