Privacy & Data Retention Policy

We only collect personal information by lawful and fair means, and only what we reasonably need for the purposes below.

We also use personal information to comply with laws, respond to lawful requests from authorities, protect our rights and the safety of passengers and chauffeurs, and send marketing if you have not opted out (see section 4).

We only use your information for another purpose if you agree, you would reasonably expect it, or the law allows or requires it.

Sensitive information

• Passengers: you may tell us about health, mobility or accessibility needs, for example that you need a wheelchair-accessible vehicle or help with luggage. We only use this to arrange and carry out your trip. By giving it to us, you consent to that use. Please do not include sensitive details we do not need.
• Chauffeurs and applicants: we collect criminal history and medical fitness information only with consent and where needed to meet licensing and safety requirements.

Call recordings and vehicle tracking

We record phone calls with our reservations and customer service teams for staff training, quality checks and resolving disputes. We tell you at the start of each call that it may be recorded.

Our vehicles are tracked by GPS for the duration of each journey. We use this to dispatch and monitor trips, give accurate arrival times, keep passengers and chauffeurs safe, and answer questions about a trip. We do not use it to track you outside your trip.

How we collect it

We collect most information directly from you, through our websites, app, forms, phone calls and emails.

We also collect information from other people, including:

• whoever books a trip for you, such as an assistant, employer, travel agent, airline, cruise line or education provider;
• corporate clients that hold an account with us;
• our partner operators;
• Google, if you use Sign in with Google;
• a flight-data service that updates flight arrival times; and
• for chauffeurs and applicants, referees, former employers, background-check providers and licensing authorities.

If you book a trip for someone else, please make sure they know you are sharing their details with us and point them to this policy. The trip confirmation we send to the passenger also identifies Hughes and links to this policy.

If you do not give us information

You can make a general enquiry without telling us who you are. To book a trip we need a name for the passenger and a way to contact them. Without that we cannot carry out the trip.

Adding your itinerary

Using an itinerary is optional. You can enter your trips yourself, or call us on 1300 615 165 (+61 2 9317 9000 from outside Australia).

If you choose to upload or paste an itinerary, this is what happens:

1. We read it on our own servers. For photos and scanned pages we use our own text-recognition software, not AI.
2. We remove personal details using fixed rules. These include travellers’ names (replaced with placeholders such as “Person 1”), email addresses, phone numbers, booking and ticket references, and membership, passport, date-of-birth and card numbers. Details your booking needs are kept, such as flight numbers, airlines, airports, dates, times, and hotel names and street addresses.
3. We send only that cleaned text to an AI service. The service is Claude, provided by Anthropic PBC in the United States. We send the cleaned text with today’s date and our instructions. Your file or photo is never sent, and nor are the details we removed. Under our commercial agreement, Anthropic does not use this information to train its models and deletes it within 30 days.
4. We put the names back on our own servers and fill in your booking.
5. You check everything. You can change or delete every trip before you book. Nothing is booked or paid for until you confirm.

The AI only reads text. It does not make decisions about you or your booking.

Our removal rules look for the places where names and numbers are normally written. If a detail appears somewhere unusual, such as a name in the middle of a casual pasted email, it may occasionally be missed. Please do not upload documents containing more personal information than you are comfortable sharing.

What we keep. We do not keep your itinerary or the text we read from it. We keep a record of each reading: the type and size of the file, how it was read, how many personal details of each kind were removed (counts only), whether it worked, what you did next, and the flights, hotels and travellers’ names it found. We keep this record for 12 months, then delete it.

If a reading fails, we may ask whether we can keep your itinerary for 30 days to improve how we read them. We keep it only if you agree. Only our team can see it, and it is deleted automatically after 30 days.

Diagnosing website errors

Our technical staff use Claude, under our commercial agreement with Anthropic, to help diagnose website errors. When they choose to analyse an error, the error record (its category, location, message and technical detail) is sent to Claude. It is technical information, but it can occasionally include incidental details from a booking request. We keep error records for 90 days.

Automated decisions

Some of our systems, run by our service providers, can make or significantly contribute to decisions about you automatically:

The itinerary feature does not make decisions about you. We do not use automated systems to decide whether to employ or engage a chauffeur.

We share personal information only as this policy describes. We do not share it with other businesses for their own direct marketing.

• Chauffeurs and partner operators who carry out your trip receive the passenger’s name, mobile number, pick-up and drop-off details, flight details and relevant notes. For trips outside Australia this may be a partner operator in the country where your trip takes place.
• Whoever booked or pays for the trip, such as your employer or travel agent, receives booking confirmations, trip details and invoices.
• Service providers who help us run our business, listed below. They may only use your information to provide services to us.
• Professional advisers and insurers, for advice and to manage claims.
• Government agencies, regulators, courts and police, where the law requires or allows it, or to deal with a serious threat to someone’s life, health or safety.
• A buyer or investor, if all or part of our business is sold, merged or restructured, under confidentiality obligations.
• Anyone else you authorise.

Our service providers

Overseas transfers

Your personal information is likely to be sent or stored outside the country where you live. Based on the table above, this includes the United States, the Netherlands, and, for trips you take there, New Zealand, Singapore, the United States and other countries where a partner operator carries out your trip.

Section 7 explains the extra safeguards that apply in New Zealand and Singapore. Before we send information overseas we take reasonable steps to make sure the recipient protects it to a standard comparable to the law that applies to you. We do this mainly through contracts. Under Australian law we remain responsible for how our overseas service providers handle your information.

Analytics and advertising

Our websites use Google Analytics to understand how they are used, and the Google Ads tag to show our ads to people who have visited and to measure how our advertising performs. These tools use cookies and similar technology and receive the pages you visit, your browser and device, screen size, language, the referring site, and an approximate location worked out from your IP address.

When you complete a booking, we also tell Google Analytics the booking’s value, currency, type (for example one way, return or by the hour), vehicle type, number of trips, and whether it came from an itinerary or the ordinary form. We add a scrambled code so the same booking is not counted twice. The code cannot be turned back into your booking number. For the itinerary feature we count only how often it is used and whether it worked, never its content.

We do not send Google your name, email address, phone number, street address, flight number, booking number, notes, payment details or anything you type into our forms. Links containing a booking code are cleaned so Google sees only our home page address.

Your choice. When you first visit our websites, we ask whether you accept analytics and advertising cookies. If you decline, or have not yet chosen, these tags do not load. You can change your choice at any time using the “Cookie settings” link in our website footer. You can still book without these cookies.

Google Analytics keeps the data linked to these cookies for no more than 14 months. Google may also use its own advertising cookies. Google explains how it uses information from sites that use its services at https://policies.google.com/technologies/partner-sites. You can also turn off personalised ads at https://adssettings.google.com or install Google’s Analytics opt-out add-on at https://tools.google.com/dlpage/gaoptout.

Do Not Track and Global Privacy Control

There is no agreed standard for browser “Do Not Track” signals, so our websites do not respond to them. We do respond to the Global Privacy Control signal. If your browser sends it, we treat it as a request to opt out of advertising cookies on that browser.

Other services on our booking website

• Google Maps Platform receives the addresses you type, to suggest places, and your pick-up and drop-off points, to draw routes and estimate drive times.
• Sign in with Google: if you use it, Google receives your sign-in and we receive the name and email address Google provides.
• Sign in with Apple: if you use it, Apple receives your sign-in.
• Google Pay and Apple Pay may be offered by our payment provider, Adyen, if your device supports them.
• Google Fonts: our pages load fonts from Google’s servers, which see your IP address.
• ipapi.co: our website sends your IP address to ipapi.co to work out your country and set the country code in the phone number box.

Marketing

• We may send you news and offers about our services by email, text message, phone or post.
• We send electronic marketing only where we have your consent or the law otherwise allows it.
• Every marketing message tells you how to opt out, and we act on your request promptly (for emails and texts, within 5 working days).
• We do not buy or rent marketing lists.

To opt out at any time, use the unsubscribe link or reply STOP, email [email protected], or call 1300 615 165 (+61 2 9317 9000 from outside Australia). Booking confirmations, trip updates and other service messages are not marketing, so you will still receive them.

Retention

We keep personal information only as long as we need it for the purposes in this policy or to meet legal requirements. When we no longer need it, we securely delete it or permanently de-identify it.

We may keep information longer if the law requires it, or if it is needed for a legal claim or investigation that is under way.

Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include encryption of data in transit, access controls that limit staff access to what they need, secure hosting, and requiring our service providers to protect the information they receive. Card payments are processed by Adyen, a payment provider certified under the Payment Card Industry Data Security Standard (PCI DSS).

We also take reasonable steps to keep personal information accurate, complete, up to date and relevant.

Data breaches

If a data breach is likely to cause serious or significant harm, or is of a significant scale, we will notify affected people and the relevant regulator as the law requires. This includes the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner, Singapore’s Personal Data Protection Commission and US state authorities.

Access and correction

Wherever you are, you can ask us for a copy of the personal information we hold about you, and ask us to correct anything that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact our Privacy Officer (section 9).

• We will check your identity before we act on a request, and only ask for what we need to do that.
• Access is free. If a request is unusually large, we may charge a reasonable fee to cover our costs where the law allows, and we will tell you first.
• We respond within 30 days. Section 7 sets out the timeframes for New Zealand and the United States.
• If we refuse a request, we explain why in writing, as far as the law allows, and tell you how to complain. If we do not correct information, you can ask us to attach a statement that you believe it is wrong.

Complaints

If you are concerned about how we have handled your personal information, please contact our Privacy Officer first. We will acknowledge your complaint within 7 days, look into it, and give you a written response within 30 days.

If you are not satisfied, you can contact the privacy regulator where you live:

The rest of this policy applies everywhere we operate and is written to meet Australian law. This section adds what is specific to New Zealand, Singapore and the United States.

New Zealand

• Access and correction: we tell you our decision on a request within 20 working days.
• Privacy Officer: our Privacy Officer (section 9) is our Privacy Officer under the Privacy Act 2020.
• Information from others: when someone else books for you, the trip confirmation we send you tells you that Hughes holds your details, why, and how to see or correct them.
• Overseas disclosure: we disclose information overseas only where the recipient is subject to comparable safeguards, or another exception in the Privacy Act 2020 applies.
• Marketing: we send commercial emails and texts only with your consent, and each one includes a working unsubscribe, as the Unsolicited Electronic Messages Act 2007 requires.
• Complaints: you can complain to the Office of the Privacy Commissioner (privacy.org.nz · 0800 803 909).

Singapore

• Data Protection Officer: our Privacy Officer (section 9) is our Data Protection Officer under the Personal Data Protection Act 2012.
• Withdrawing consent: you can withdraw your consent to our collection, use or disclosure of your personal data by contacting us. We will explain the likely consequences, for example that we may not be able to carry out a booking.
• Access and correction: we respond within 30 days. If we need longer, we will tell you within that time when we expect to respond.
• Overseas transfers: we transfer personal data outside Singapore only to recipients bound by legally enforceable obligations that give it a standard of protection comparable to Singapore law.
• Do Not Call Registry: we do not call or text Singapore numbers listed on the Registry for marketing unless you have given us clear consent.
• Complaints: you can complain to the Personal Data Protection Commission (pdpc.gov.sg).

United States

Residents of California and other US states with consumer privacy laws have the following rights, subject to exceptions in those laws:

• Know and access: what personal information we have collected about you, where we got it, why we use it, who we disclose it to, and a copy of it.
• Delete: ask us to delete personal information we collected from you.
• Correct: ask us to correct inaccurate personal information.
• Opt out of “selling”, “sharing” and targeted advertising: we do not sell personal information for money. Our use of Google advertising cookies can count as “selling” or “sharing” for cross-context behavioural or targeted advertising under some state laws. You can opt out using the “Do Not Sell or Share My Personal Information” link in our website footer, by turning on Global Privacy Control in your browser, or by contacting us.
• Limit sensitive information: we use sensitive personal information only to provide our services and for other purposes the law allows, so we do not offer a separate “limit” option.
• No discrimination: we will not treat you differently for using your rights.
• Appeal: if we decline your request, you can appeal by replying to our decision. We will respond to an appeal within the time your state’s law sets.

To make a request, email [email protected] or call toll-free (888) 389-1908. We respond within 45 days, and if we need up to another 45 days we will tell you why. You can use an authorised agent; we will ask for proof that they act for you and may need to verify your identity directly.

Categories of personal information we collect (last 12 months). Identifiers (name, email, phone, IP address, cookie identifiers); customer records (contact and billing details); commercial information (bookings and payments); internet activity (website use); approximate geolocation (from IP address); audio and electronic communications (call recordings and messages with us); professional or employment information (chauffeur and applicant records); and sensitive personal information (precise geolocation from vehicle tracking during your trip, health or accessibility needs you share, account sign-in details and, for chauffeurs and applicants, driver licence and background-check results). Sources, purposes and recipients are in sections 1 and 3, and retention periods in section 5.

Selling and sharing. In the last 12 months we have “sold” or “shared” only identifiers (cookie identifiers and IP address) and internet activity, with Google, for advertising. We do not knowingly sell or share personal information of anyone under 16. We do not offer financial incentives in exchange for personal information.

Marketing. We send marketing text messages to US numbers only with your prior express written consent. Every marketing email includes our postal address and a working unsubscribe.

Children

Our websites and app are for adults. We do not knowingly collect personal information online directly from children under 13, or from anyone under 16 for marketing.

Children do travel with us, for example on international student transfers. Those trips are booked by a parent, guardian, school, education provider or other responsible adult, and we collect only the details needed to carry out the trip safely. If you believe a child has given us information directly, contact us and we will delete it.

Other websites

Our websites link to other sites, such as Google’s privacy pages. We are not responsible for their privacy practices, so please read their policies.

Changes to this policy

We review this policy regularly and update it when our practices or the law change. We will post the new version here with a new effective date. If we make a significant change to how we use your personal information, we will also tell you by email or a notice on our websites before the change takes effect.

Our Privacy Officer handles privacy questions, requests and complaints. They are also our Data Protection Officer for Singapore and our Privacy Officer for New Zealand.

Email: [email protected]

Phone (Australia): 1300 615 165

Phone (outside Australia): +61 2 9317 9000

United States (toll-free): (888) 389-1908

New Zealand (toll-free): 0800 446 493

Post: Privacy Officer, Equity Transport Group Pty Ltd, 6 Alexandra Parade, Fitzroy VIC 3065, Australia