← Back to home

GDPR & Your Data Rights

Last updated: May 2026 · Storm Dispatch — sole trader, United Kingdom

Storm Dispatch is a sole trader registered in the United Kingdom. We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This page explains your rights as a data subject and how to exercise them.

For full details of what data we collect and how we process it, please read our Privacy Policy.

Who controls your data?

This depends on how you interact with Storm Dispatch:

  • Operator accounts (subscription holders): Storm Dispatch is the data controller for personal data you provide when registering and managing your operator account (name, email, billing details).
  • Passengers and drivers of operators: The operator who uses Storm Dispatch is the data controller for data relating to their passengers, drivers, and bookings. Storm Dispatch acts only as a data processor on that operator's behalf. If you are a passenger or driver, you should direct your data rights requests to the operator in the first instance. Operators can action many requests directly through the dispatch console GDPR tools.

Your rights under UK GDPR

Right of access (Article 15)

You can request a copy of the personal data we hold about you — a Subject Access Request (SAR). We must respond within one calendar month (extendable by two further months for complex requests, with notice).

Right to rectification (Article 16)

You can ask us to correct inaccurate personal data or complete incomplete data. We will act within one month.

Right to erasure — “right to be forgotten” (Article 17)

You can request deletion of your personal data where: the data is no longer necessary for the purpose it was collected; you withdraw consent and there is no other lawful basis; you have objected and our legitimate interests do not override yours; or the data has been unlawfully processed. This right is not absolute — we may retain data where required by law (e.g. tax records).

Right to restriction of processing (Article 18)

You can ask us to pause processing your data whilst a rectification or objection request is being assessed.

Right to data portability (Article 20)

Where we process your data by automated means on the basis of consent or contract, you can request a copy in a structured, commonly used, machine-readable format (e.g. JSON or CSV).

Right to object (Article 21)

You can object to processing based on our legitimate interests. We must stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defence of legal claims.

Right to withdraw consent (Article 7)

Where processing is based on your consent (e.g. marketing communications), you can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Rights relating to automated decision-making (Article 22)

Storm Dispatch does not make solely automated decisions that produce legal or similarly significant effects about individuals.

How to exercise your rights

Submit a request to: [email protected]

Please include:

  • Your full name and, if applicable, the email address associated with your account.
  • A clear description of the right you wish to exercise and the data concerned.
  • If you are acting on behalf of another person (e.g. as a parent or legal representative), evidence of your authority to do so.

We will acknowledge receipt within 5 working days and respond in full within one calendar month. We may ask for additional information to verify your identity before processing your request — this is to protect you.

There is no charge for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act, with written explanation.

Data retention

  • Booking and journey records are automatically anonymised after 2 years — passenger name and contact details are replaced with tokens; aggregate route and fare data is retained for operational reporting.
  • Driver personal data (name, contact, licence, compliance documents) is retained for the duration of the driver's active relationship with the operator, plus 12 months, then deleted.
  • Operator account data is retained for the duration of the subscription plus 6 years (as required by UK tax legislation), then securely deleted.
  • Server and access logs are retained for 90 days.

Customer app data deletion

Customers who have registered on an operator's customer app can request deletion of their account and personal data by navigating to Profile → Request data deletion within the app. This request is routed to the operator (as data controller). If you do not receive a response within 30 days, you may escalate to us at [email protected].

ICO registration

Storm Dispatch is in the process of registering with the Information Commissioner's Office (ICO) as required under the Data Protection Act 2018. ICO registration is mandatory for organisations that process personal data for commercial purposes. Our registration application is in progress and will be confirmed here once complete.

Right to complain

If you are unhappy with how we have handled your personal data or responded to a rights request, you have the right to lodge a complaint with the ICO:

Information Commissioner's Office

Website: ico.org.uk

Helpline: 0303 123 1113

Live chat: available via ico.org.uk

We would appreciate the opportunity to address your concern before you contact the ICO — please email us first at [email protected].

Contact

Data protection enquiries: [email protected]
Storm Dispatch · United Kingdom