Who we are
Orbiy Limited, trading as Park & Lane (“Park & Lane”, “we”, “us”), is the data controller for the personal data described in this policy. We process personal data in line with the UK GDPR and the Data Protection Act 2018.
- Orbiy Limited, trading as Park & Lane, registered in England and Wales, company number 16472677
- Registered office: 167-169 Great Portland Street, Fifth Floor, London W1W 5PF
- Registered with the Information Commissioner’s Office (ICO), registration number ZC010815
- Contact: privacy@parkandlane.com
This policy explains what we collect, why, who we share it with, how long we keep it, and your rights.
1. Information we collect
Identity and verification (Rent and Chauffeur)
- Full name, date of birth, email address, phone number and home address
- Proof of identity, such as a passport, driving licence or national ID card
- A selfie and a face comparison against your ID photo (biometric data, only with your explicit consent)
Credit reference and address checks (Rent and Chauffeur)
- The results of a soft search with a credit reference agency, used to confirm your identity and address and to help prevent fraud
- A soft search is recorded on your credit file but is only visible to you and does not affect your credit score
Driver eligibility (Rent only)
- Driving licence details, including your driver number, licence country and photos of the licence
- Your driving record from DVLA (GB licences), described below
- For non-GB licences, the information our insurers need to approve you as a driver
Your driving record from DVLA (GB licences, Rent only)
Before you hire a self-drive car, and with your signed declaration, we ask the Driver and Vehicle Licensing Agency (DVLA) for your driver record through its Access to Driver Data service. DVLA may give us:
- your personal details held on the record (name, date of birth, address, driver number)
- your driving entitlements, with any restriction codes
- valid endorsements, penalty points and disqualifications
- your photo, in some circumstances
We do not request Certificate of Professional Competence (CPC) or digital tachograph card details. We also keep the declaration you signed and a record of each check.
Booking and payment
- Booking dates, times, locations and routes, and the vehicle or service booked
- Payment card details (handled by our PCI-compliant payment providers; we do not store full card numbers)
- Deposits, refunds, charges, invoices and transaction history
Telematics and vehicle data (Rent and Chauffeur)
- GPS location, journey routes, mileage and timestamps
- Speed, braking and acceleration patterns
- Engine, battery and diagnostic data, ignition and lock/unlock events
Communications
- Emails, in-app and WhatsApp messages, and support notes
- Call recordings, only where we tell you in advance
Technical and website data
- IP address, device and browser information
- Cookies and analytics data (see section 9)
2. How we use your information and our lawful basis
| What we use it for | Lawful basis (UK GDPR) |
|---|---|
| Creating and managing your booking, payments, deposits and refunds | Contract (Article 6(1)(b)) |
| Verifying your identity and preventing fraud | Contract and legitimate interests in preventing fraud (Article 6(1)(b) and (f)) |
| Automatic face comparison against your ID | Explicit consent (Article 9(2)(a)) |
| Checking your driving licence with DVLA before a self-drive hire | Contract and legitimate interests in hiring only to drivers who are entitled and insurable (Article 6(1)(b) and (f)) |
| Meeting our insurers’ driver requirements | Legitimate interests (Article 6(1)(f)) |
| Tracking vehicles for safety, theft prevention and insurance claims | Legitimate interests (Article 6(1)(f)) |
| Handling PCNs, congestion and ULEZ charges, damage and incidents | Contract and legal obligation (Article 6(1)(b) and (c)) |
| Keeping financial and tax records, and responding to regulators and the police | Legal obligation (Article 6(1)(c)) |
| Handling complaints, claims and disputes | Legitimate interests (Article 6(1)(f)) |
| Marketing, only if you opt in | Consent (Article 6(1)(a)) |
DVLA licence checks
We use your DVLA record only to check your entitlement to drive, your endorsements and any disqualifications, so we can decide whether we can offer you self-drive hire. We do not use it to check your identity.
We only make a check after you have read and signed DVLA’s fair processing declaration in our app or website. The declaration names Orbiy Limited, explains why we are checking, shows your details, and lasts 3 years from the date you sign it, or until you stop hiring from us. While your declaration is valid, we may check your DVLA record again whenever you book or before a hire starts, without asking you to sign again. We usually do this when your last check was more than 60 days before the hire starts. When your declaration expires, we will ask you to sign a new one before any further check.
Endorsements and disqualifications relate to motoring offences. We process this information under Article 10 UK GDPR and Schedule 1, paragraph 29 of the Data Protection Act 2018 (consent), given when you sign the declaration.
You can withdraw your declaration at any time by contacting us. If you do, we cannot run further checks and cannot offer you self-drive hire, but this does not affect checks already made.
Credit reference and address checks
We may run a soft search with a credit reference agency, such as Creditsafe, to confirm your identity and address and to help prevent fraud. We do this under our legitimate interests in preventing fraud and making sure we know who is hiring our vehicles (Article 6(1)(f)). A soft search does not affect your credit score and is not used to decide whether to lend you money.
The agency will use the information we send under its own privacy notice, which explains how credit reference agencies use and share personal data. We will link to it here once our provider is confirmed.
4. How long we keep it
| Information | How long |
|---|---|
| Booking, contract and payment records | 6 years after the booking ends |
| DVLA declarations and records of each licence check | 2 years after the last check the declaration covered |
| Driver record information received from DVLA | Only as long as needed to decide on your hire, then deleted, unless it relates to a claim or dispute |
| Results of credit reference and address checks | 2 years after your last booking, unless needed for a fraud investigation |
| ID documents, selfie and face comparison | While your account is active and verified, then securely deleted, unless needed for a claim or fraud investigation |
| Driving licence details | While your account is active, plus 2 years after your last DVLA check |
| Telematics data | Up to 12 months, unless needed for an investigation or claim |
| Communications | Up to 12 months, unless needed for a complaint or claim |
| Marketing preferences | Until you unsubscribe or ask us to delete them |
When you close your account, we delete what we no longer need and keep only what the periods above require.
5. Where your data is held
Information we receive from DVLA, and your DVLA declarations, are stored and accessed only in the UK.
Some of our other providers may process data outside the UK. When they do, we use a country with a UK adequacy decision or put in place the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
6. Automated decisions
When we check your licence with DVLA, our system decides automatically whether you meet our self-drive driver requirements, such as limits on penalty points and endorsements. If we cannot offer you self-drive hire, you can ask a member of our team to review the decision by contacting privacy@parkandlane.com.
7. Your rights
Under UK data protection law you can:
- access the personal data we hold about you
- ask us to correct inaccurate or incomplete data
- ask us to delete your data in certain circumstances
- object to, or ask us to restrict, how we use your data in some situations
- ask for a copy of your data in a portable format
- withdraw your consent at any time, including for marketing, the face comparison and your DVLA declaration
- ask for a human review of an automated decision
To use any of these rights, contact privacy@parkandlane.com. You can also see the information DVLA holds about you through DVLA’s View Driving Licence service on GOV.UK.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.
8. Children and safeguarding
Bookings must be made by adults aged 18 or over. We do not knowingly contract with, or collect personal data directly from, children.
Children may travel as passengers, including alone where a parent or legal guardian has clearly authorised the journey. The booking adult is responsible for consent and for safe pick-up and drop-off arrangements. For chauffeur journeys involving children, our drivers:
- behave professionally and appropriately
- avoid unnecessary physical contact
- follow the authorised pick-up and drop-off instructions
- only release a child to the authorised receiving adult
- do not take photos or videos of child passengers
- do not ask children for unnecessary personal information
We record only the minimum needed, such as a first name and the person authorised to meet the child.
10. Changes to this policy
We may update this policy from time to time. We will post changes on this page with a new “last updated” date, and tell you directly about significant changes.
11. Contact us
- privacy@parkandlane.com
- Park & Lane (Orbiy Limited), 167-169 Great Portland Street, Fifth Floor, London W1W 5PF
- Company number 16472677 · ICO registration ZC010815