Privacy Policy

Scope and our role

This Privacy Policy applies to the B2B Cabs website at b2bcabs.in, our mobile applications, company administration tools, communications, and corporate mobility or related transport services (together, the “Services”).

In this policy, “B2B Cabs”, “we”, “us”, and “our” refer to the operator of the Services. Depending on how a corporate transport programme is arranged, we may process personal data for our own purposes or on the instructions of the organisation that arranged your travel. Your employer, client, agent, or transport provider may have a separate privacy notice that also applies.

Personal data we collect

The data we handle depends on your relationship with B2B Cabs and the features you use. It may include:

• Identity and contact data: name, email address, telephone number, profile photo, employee or driver identifier, and emergency contact details.
• Organisation and account data: company name, work location, department, shift, role, permissions, login records, and account preferences.
• Trip and roster data: pickup and drop-off locations, routes, shifts, ride requests, vehicle and driver assignments, attendance, timestamps, trip status, missed rides, support incidents, and travel history.
• Location data: device or vehicle location, live journey position, geofence events, and route progress when location-enabled features are used.
• Driver and fleet data: driving licence and verification information, vehicle registration and compliance documents, availability, route performance, payroll-related records, and bank details where needed for payments.
• Billing and transaction data: invoices, wallet or payment records, billing contacts, amounts, taxes, credits, commissions, and payment status. Payment providers may collect payment credentials directly under their own privacy terms.
• Communications: enquiries, proposal details, calls or messages with support, feedback, complaints, notification preferences, and records of email, SMS, WhatsApp, or push communications.
• Technical and usage data: IP address, browser or device type, operating system, app version, device identifiers, diagnostic logs, security events, pages or features used, and approximate location inferred from network data.

How we collect personal data

We collect data directly from you when you submit an enquiry, create or use an account, request or take a ride, contact support, or otherwise interact with the Services. We may also receive data from your employer or another organisation arranging transport, authorised administrators, drivers, fleet partners, agents, payment or communication providers, and other people involved in delivering a trip.

Some technical, usage, and location data is collected automatically through websites, apps, devices, server logs, cookies, local storage, software development kits, or similar technologies. You can control certain permissions, including device location and notifications, through your device settings, although disabling them may prevent some trip or safety features from working.

How and why we use personal data

We use personal data only where we have a lawful reason under applicable law, including your consent, to provide a service you requested, for permitted legitimate uses, or to meet a legal obligation. We may use it to:

• respond to enquiries, prepare proposals, onboard organisations and users, and manage accounts;
• plan routes and rosters, assign vehicles and drivers, coordinate pickups and drops, track active journeys, and provide trip alerts;
• verify drivers and vehicles, support passenger safety, investigate incidents, prevent fraud or misuse, and protect accounts and systems;
• process payments, payroll, commissions, invoices, credits, reconciliation, and financial records;
• provide customer support, service notices, shift summaries, operational messages, and communications you have requested;
• measure service performance, troubleshoot problems, improve routing and products, generate business reports, and develop new features;
• comply with law, respond to lawful requests, enforce agreements, and establish or defend legal claims; and
• send promotional communications where permitted. You can opt out of marketing without affecting essential operational messages.

Where we use aggregated or de-identified information, we take reasonable steps not to use it to identify an individual.

Location, geofence, and trip data

Location information helps us coordinate rides, show estimated arrival times, confirm route progress, trigger pickup or safety alerts, investigate service issues, and give authorised company administrators visibility into transport operations. Depending on your role and device settings, location may be collected while you use the app, during an assigned trip, or in the background where you have granted that permission.

Drivers, employees, passengers, and administrators should only use location features for legitimate transport purposes. Your device settings may allow you to limit location access, but precise or background location can be necessary for live tracking and route features. When no longer needed, location data is retained or deleted in line with the retention principles below.

How we share personal data

We do not sell personal data. We may share only what is reasonably necessary with:

• Your organisation and authorised users, such as company, HR, admin, security, or transport teams managing your programme.
• Drivers, passengers, and transport partners, so they can identify the correct trip, coordinate pickup, operate the route, and resolve incidents.
• Service providers, including hosting, cloud, mapping, analytics, customer support, communications, security, payment, and professional advisers who process data for defined purposes.
• Authorities and other parties, when required by law or reasonably necessary to protect people, prevent wrongdoing, enforce agreements, or respond to an emergency.
• Parties to a business transaction, such as a merger, financing, reorganisation, or transfer, subject to appropriate safeguards.

An authorised company administrator may be able to view employee, driver, route, attendance, trip, and billing information within the scope of that organisation’s account. Corporate customers are responsible for configuring access appropriately and using that information lawfully.

Data retention

We retain personal data only for as long as reasonably needed for the purpose for which it was collected, including active account and transport operations, support, safety, accounting, tax, audit, fraud prevention, dispute resolution, and legal requirements. Retention periods differ by record type and contractual requirement.

When data is no longer required, we will delete, anonymise, or securely isolate it, unless continued retention is required or permitted by law. Backup copies may remain for a limited period until they are overwritten through normal recovery processes.

Data security

We use reasonable administrative, technical, and organisational safeguards designed to protect personal data, such as access controls, role-based permissions, encrypted connections, logging, backups, and service-provider controls where appropriate. No website, app, transmission, or storage system is completely secure, so we cannot guarantee absolute security.

You are responsible for keeping account credentials confidential, using a secure device, and promptly telling us if you suspect unauthorised access or misuse.

Your rights and choices

Subject to applicable law and the context in which we process your data, you may ask us to provide information about processing, give access to a summary of personal data, correct or update inaccurate data, erase data that is no longer needed, withdraw consent, nominate another person to exercise rights where the law allows, or raise a grievance.

You may also update certain account details in the Services, change app permissions in your device settings, use available account-removal features, and opt out of marketing by following the instructions in a message or contacting us. Withdrawing consent does not affect processing already carried out and may prevent us from providing a feature that depends on that data.

To make a request, email call@b2bcabs.in. We may need to verify your identity and authority. If your organisation provided the data and controls the relevant account, we may direct your request to its authorised administrator or coordinate with that organisation.

Children’s data

Our Services are intended for organisations and authorised adult users and are not directed to children. A parent, guardian, school, employer, or other organisation must not provide a child’s personal data unless it has the authority and any verifiable consent required by applicable law. If you believe a child’s data was provided without appropriate authority, contact us so we can review it.

Data storage and transfers

We and our service providers may process or store data in India and other locations where our vendors operate. Where personal data is transferred across borders, we take reasonable steps to use appropriate safeguards and comply with applicable transfer restrictions.

Cookies, app stores, and third-party services

Our website may use essential cookies or similar technologies needed for security, forms, preferences, and site operation. Third-party links or services—including app stores, maps, payment providers, communication channels, or websites—operate under their own terms and privacy policies. We are not responsible for how an independent third party handles your data.

Changes to this policy

We may update this Privacy Policy when our Services, data practices, or legal obligations change. We will post the revised version here and update the “Last updated” date. Where required, we will provide additional notice or seek fresh consent.

Privacy contact and grievances

For privacy questions, requests, or grievances, contact our privacy team using the details below. Please describe your concern and provide enough information for us to identify the relevant account or interaction.

We will review and respond to grievances within the timeframe required by applicable law. This policy is intended to support compliance with applicable Indian data-protection and information-technology laws, including the Digital Personal Data Protection Act, 2023 and rules brought into force under it.