Last updated: 26 September 2026

1. Who we are

Thor Transfer is the trading name of Booking & Transport Limited, a company registered in England and Wales (Company No. 15383016), with its registered office at 50 Devonshire Road, Hornchurch, England, RM12 4LQ. We are licensed by Transport for London as a private hire operator (Operator Licence No. 11832).

We are the “controller” of your personal data. This means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner’s Office (registration number ZC038725).

Contact us about your data: info@thortransfer.co.uk, 020 3488 1747 (office), 07455 721989 (bookings), or by post to the address above.

2. The data we collect

When you book a journey or ask for a quote:

your name, phone number and email address
pickup and drop-off addresses, date and time of travel
flight or cruise details (if applicable)
number of passengers, luggage, child seats and any special requests
any accessibility needs you tell us about (see section 4)
payment information. Card payments are handled by Stripe; we never see or store your full card number.

When you contact us (email, phone, WhatsApp, contact form, or through Bark.com): your name, contact details and the content of your message.

When you use our website: technical data such as your IP address, browser, device and pages visited, collected through cookies and similar technologies only in line with your cookie choices (see section 8).

For business (corporate and hotel) accounts: the names and business contact details of the people who book on behalf of the business.

3. How we use your data and our lawful basis

To take, manage and carry out your booking, allocate a driver and vehicle, send confirmations and contact you about your journey. Lawful basis: performance of a contract with you (or taking steps at your request before a contract).
To keep booking records required by our TfL private hire operator licence and to meet tax, accounting and other legal duties. Lawful basis: legal obligation.
To answer enquiries and quote requests, handle complaints and lost property, prevent fraud and misuse, and improve our service. Lawful basis: our legitimate interests in running and improving our business. We have balanced these interests against your rights.
To use analytics and other non-essential cookies on our website. Lawful basis: your consent, given through our cookie banner.

We send two monthly newsletter editions. The customer edition goes only to people who sign up on our website (double opt-in: you must confirm by email) or who tick the newsletter box on our booking form; the lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in every email. The business edition goes only to organisations we have already been in contact with, on the basis of our legitimate interests as allowed for corporate subscribers under the Privacy and Electronic Communications Regulations (PECR); every email includes an unsubscribe link. We keep your sign-up and consent record while you are subscribed and for 2 years afterwards; once you unsubscribe, we keep only your email address on a do-not-email list so that we do not contact you again.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Special category data

If you tell us about a disability or a health or mobility need so that we can arrange suitable transport (for example help getting in or out of the vehicle, or with luggage), we use this only to provide your journey. We rely on your explicit consent, which you give by telling us, and you can withdraw it at any time.

5. Who we share your data with

We do not sell or rent your personal data. We share it only as needed with:

Your driver: your name, phone number, pickup and drop-off details and any journey notes.
Almighty Dispatch (book.almightydispatch.com): our booking and dispatch system, which stores bookings and passes jobs to drivers.
Stripe: card payment processing.
Google: email and office tools (Gmail, Google Drive), website analytics (Google Analytics, only with your consent) and fonts on our website.
Anthropic: an AI service we use to help draft replies to customer emails, and to run the automated assistant that answers calls and WhatsApp messages on our bookings line when our team is not available. A member of our team checks every email reply before it is sent. Under our commercial terms, Anthropic does not use this data to train its AI models.
Meta (WhatsApp): if you choose to contact us by WhatsApp.
Twilio: carries phone calls, text messages and WhatsApp messages to and from our bookings line.
Trustindex: shows our Google reviews on the website.
Resend (Resend Inc., EU region): sends our newsletter emails on our behalf.
Namecheap: hosts our website.
Our IT and automation providers, who store and process data for us under contract.
Transport for London, the police, HMRC or other authorities when the law requires it, and our insurers, professional advisers or courts where needed to handle a claim or complaint.

All our service providers act on our instructions and must keep your data secure.

6. International transfers

Some of the providers above (for example Google, Stripe, Anthropic, Meta, Twilio and Namecheap) may process data outside the UK, mainly in the United States. When this happens we make sure the transfer is protected, by relying on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement or Addendum. You can ask us for more details.

7. How long we keep your data

Booking, payment and invoice records: 6 years from the end of the financial year of the journey, for tax and accounting purposes. This also covers the booking records we must keep under our TfL operator licence.
Quote requests and enquiries that did not become a booking: 12 months from our last contact.
Complaints and lost property records: 3 years.
Website analytics: no longer than 14 months, as set out in our Cookie Policy.
Newsletter sign-up and consent records: while you are subscribed, plus 2 years; after that we keep only your email address on a do-not-email list.

After these periods we securely delete or anonymise the data.

8. Cookies

We use strictly necessary cookies to make our website work. We only use analytics and other non-essential cookies if you agree through our cookie banner. You can change your choice at any time using the “Cookie settings” link on every page. Full details of each cookie are in our Cookie Policy.

9. Your rights

You have the right to:

ask for a copy of your personal data
ask us to correct inaccurate or incomplete data
ask us to delete your data
ask us to restrict how we use your data
object to how we use your data, including for direct marketing (this right is absolute)
ask us to transfer your data to you or another organisation
withdraw your consent at any time, where we rely on consent.

Some rights have limits: for example, we must keep booking records for legal reasons. We will reply within one month. There is normally no charge. To use any of these rights, contact info@thortransfer.co.uk.

10. How to complain

If you are unhappy with how we have used your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113.

11. Keeping your data secure

We use appropriate technical and organisational measures to protect your data, including secure payment processing, access controls and two-step sign-in on our business accounts.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed. We will tell you about significant changes where appropriate.

Privacy Policy