Privacy policy
Privacy Policy
Last updated: 20 April 2026
1. Who we are
This Privacy Policy explains how Lanz CTS Chauffeured Travel Solutions Ltd (“Lanz CTS”, “we”, “us”, “our”) collects, uses, stores and protects your personal data when you book or use our chauffeur services, visit our websites, or contact us.
We are the data controller for the personal data described in this policy.
- Registered office: 1st Floor, 85 Great Portland Street, London W1W 7LT
- Operations address: The Light Box 213, 111 Power Road, London W4 5PY
- Company number: 11867963
- VAT number: 384860950
- ICO registration number: ZB157842
- Contact for privacy matters: info@lanzcts.com
This policy applies to lanzcts.com and all related subdomains, our booking engine, our customer and driver portals, our mobile sites and apps, and any data we collect by phone, email, live chat, social media or in person.
2. The personal data we collect
Depending on how you interact with us, we may collect the following categories of personal data:
Identity data — first name, last name, title, company name (where applicable).
Contact data — billing address, pickup and drop-off addresses, email address, phone number, WhatsApp number.
Booking data — pickup and drop-off locations, dates and times, vehicle preferences, passenger numbers, flight numbers, tail numbers and FBO codes (for airport and private aviation transfers), special requests, notes about your journey.
Passenger data — where you book on behalf of someone else, we collect the passenger’s name, phone number, and any details necessary to deliver the ride safely (e.g. accessibility requirements, child seat requirements).
Financial data — payment card details (processed directly by Stripe; we do not store full card numbers on our systems), billing details, transaction history.
Account data — login credentials and account preferences if you create an account on our customer portal.
Marketing data — your communication preferences and our records of marketing emails sent to you.
Technical data — IP address, browser type and version, device information, operating system, time zone, referring website, pages viewed, and the date and time of your visits.
Usage data — how you use our website, booking engine and portals.
Communications data — records of correspondence between you and us by email, live chat, phone, WhatsApp or other channels.
We do not knowingly collect special category data (such as health data) unless you voluntarily provide it (e.g. an accessibility requirement). Where you do, we treat it with additional care and rely on your explicit consent or substantial public interest as our lawful basis.
3. How we collect your personal data
We collect personal data when you:
- Make a booking through our website, by phone, by email, by live chat, or via WhatsApp
- Request a quote
- Create an account on our customer portal
- Sign up to our newsletter or marketing communications
- Complete a contact form
- Travel with us as a passenger (where someone else has booked on your behalf)
- Interact with our website (cookies and similar technologies — see Section 9)
- Are referred to us by a corporate account holder or travel partner
4. Why we use your personal data and our lawful basis
Under UK GDPR we must have a lawful basis for processing your personal data. The lawful bases we rely on, and the purposes we use your data for, are:
| Purpose | Lawful basis |
|---|---|
| To deliver the chauffeur service you’ve booked (route planning, dispatching a vehicle, communicating with you about the ride, processing your payment) | Performance of a contract |
| To allocate a chauffeur and share the necessary booking details with them | Performance of a contract / legitimate interests (efficient dispatch) |
| To keep records of bookings, complaints and lost property as required by Private Hire Vehicle (PHV) operator licensing | Legal obligation |
| To keep accounting and tax records | Legal obligation |
| To comply with anti-money-laundering, fraud-prevention and other regulatory requirements | Legal obligation |
| To send transactional communications (booking confirmations, status updates, receipts, refund notifications) | Performance of a contract |
| To send marketing emails and newsletters to existing customers about similar services | Legitimate interests (subject to your right to opt out at any time) |
| To send marketing emails to prospects who have not previously bought from us | Consent |
| To improve our services, train our staff and analyse usage of our website | Legitimate interests |
| To prevent fraud, secure our systems and investigate suspected misuse | Legitimate interests |
| To establish, exercise or defend legal claims | Legitimate interests / legal obligation |
| To use non-essential cookies and similar tracking technologies | Consent |
Where we rely on legitimate interests, we have carried out a balancing test to ensure your rights and freedoms are not overridden. You can ask us for details of this assessment at any time.
5. Who we share your personal data with
We share personal data only where necessary, and only with parties bound by appropriate data protection obligations. The categories of recipients are:
Our chauffeurs — we share booking details (pickup, drop-off, passenger name and phone, flight details where relevant) with the assigned chauffeur so they can deliver your ride.
Affiliate operators — for journeys outside our direct operating area, or where capacity requires it, we work with vetted partner chauffeur operators. These partners receive only the booking details necessary to fulfil the journey.
Payment processors — Stripe Payments Europe Ltd processes card payments on our behalf. Card details are entered directly into Stripe’s secure environment and are not stored on our servers.
Email and communication providers — Resend (transactional emails), Mailchimp (newsletter and marketing emails), Hostinger (SMTP email), Crisp (live chat).
Hosting and infrastructure providers — Railway (database and backend hosting), Vercel (frontend hosting), Cloudflare (content delivery and security), Hostinger (WordPress site hosting).
Authentication and operational tools — Clerk (staff authentication for our dispatch system), Sentry (error monitoring).
Mapping and routing services — Google Maps Platform (route calculation, address autocomplete).
Analytics and marketing tools (subject to your cookie consent) — Google Analytics, Meta (Facebook) Pixel, LinkedIn Insight Tag.
Accountants, auditors, and legal advisors — when professional advice or audit is required.
Regulators and authorities — including HMRC, the Information Commissioner’s Office, licensing authorities (such as Transport for London) and law enforcement, where we are legally required to disclose data or where disclosure is necessary to protect our legal rights.
Corporate buyers — in the event of a merger, acquisition or restructuring, your data may be transferred to the new entity, subject to the same protections.
We do not sell your personal data to anyone, and we do not share it with third parties for their own marketing purposes.
6. International transfers
Some of our service providers (including Stripe, Resend, Mailchimp, Clerk, Vercel, Sentry and Google) process data outside the United Kingdom, primarily in the European Economic Area and the United States.
When personal data is transferred outside the UK, we ensure appropriate safeguards are in place. These include:
- Transfers to countries deemed “adequate” by the UK government (such as the EEA)
- The UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, where adequacy decisions do not apply
- The UK Extension to the EU–US Data Privacy Framework for transfers to certified US providers
You can request details of the specific safeguards in place by emailing info@lanzcts.com.
7. How long we keep your personal data
We keep your personal data only as long as necessary for the purposes we collected it for, plus any period required by law:
| Data type | Retention period |
|---|---|
| Booking records (PHV operator requirement) | 12 months minimum from the date of the booking |
| Customer account data | For the duration of your account, plus 12 months after closure |
| Accounting and tax records | 6 years from the end of the financial year (HMRC requirement) |
| Card payment records (held by Stripe) | Per Stripe’s retention policies |
| Marketing data | Until you unsubscribe or withdraw consent, after which we retain a suppression record only |
| Live chat and email correspondence | 24 months, unless related to an unresolved matter |
| Website analytics | Up to 26 months |
After the retention period ends, data is securely deleted or anonymised.
8. How we protect your personal data
We use appropriate technical and organisational measures to protect your data, including:
- Encryption of data in transit (HTTPS/TLS) and at rest where supported
- Access controls and role-based permissions for staff
- Multi-factor authentication on administrative accounts
- Tokenised card payments via Stripe (we never store full card numbers)
- Regular security reviews and dependency updates
- Staff training on data protection
- Formal data processing agreements with all our suppliers
No system is 100% secure, but we take all reasonable steps to protect your information. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office within 72 hours and inform you without undue delay where required.
9. Cookies and similar technologies
A cookie is a small text file stored on your device when you visit a website. We use cookies to:
- Make our site work (essential cookies — these are always on)
- Remember your preferences (functional cookies)
- Understand how visitors use our site (analytics cookies)
- Deliver relevant marketing and measure ad performance (marketing cookies, including Meta Pixel and LinkedIn Insight Tag)
Non-essential cookies are only set after you give consent through our cookie banner. You can change your preferences at any time by clicking “Cookie Settings” in our footer or by clearing cookies in your browser.
For a full list of the cookies we use, their purpose and duration, please see our Cookie Policy.
10. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — to obtain a copy of the personal data we hold about you
- Right to rectification — to correct inaccurate or incomplete data
- Right to erasure (“right to be forgotten”) — to ask us to delete your data, subject to legal retention requirements
- Right to restriction — to limit how we use your data
- Right to data portability — to receive your data in a structured, machine-readable format
- Right to object — to object to processing based on legitimate interests, including direct marketing (you can opt out of marketing at any time)
- Right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting prior lawful processing
- Rights regarding automated decision-making — we do not currently use automated decision-making or profiling that produces legal or similarly significant effects on you
To exercise any of these rights, please email info@lanzcts.com. We will respond within one calendar month. There is no fee for most requests, although we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
We may need to verify your identity before responding to a request.
11. Marketing communications
We send marketing emails and newsletters about our services. You can:
- Opt out at any time by clicking the “unsubscribe” link in any marketing email
- Update your preferences by emailing info@lanzcts.com
If you are an existing customer, we may send you marketing about similar services on the basis of legitimate interests (the “soft opt-in”). You can opt out at any time. If you are not an existing customer, we will only send you marketing where you have given consent.
We do not send marketing texts or make marketing phone calls without consent.
12. Links to external sites
Our websites may contain links to third-party websites. This Privacy Policy applies only to Lanz CTS. We are not responsible for the privacy practices of external sites and recommend you review their own privacy policies before sharing any personal data with them.
13. Children
Our services are not directed at children. We do not knowingly accept bookings from anyone under the age of 18 in their own name. Children may travel as passengers when booked by an adult. If you believe a child has provided us with personal data without appropriate consent, please contact us at info@lanzcts.com and we will delete it.
14. Right to complain
If you have any concerns about how we handle your personal data, please contact us first at info@lanzcts.com so we can try to resolve the matter directly.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
15. Changes to this policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page shows when it was most recently revised. For material changes, we will notify you by email or through a prominent notice on our website. Your continued use of our services after a change indicates your acceptance of the updated policy.
16. Contact us
For any questions about this Privacy Policy or how we handle your personal data:
Email: info@lanzcts.com Phone: +44 20 8123 8337 Post: Lanz CTS Chauffeured Travel Solutions Ltd, 1st Floor, 85 Great Portland Street, London W1W 7LT
