Privacy notice for cablink.ie

Who is responsible

The controller of the personal data described here is Marius Sorin Zamfir, a sole trader trading as CabLink, [to be confirmed before release: postal address of the operator].

For anything about this notice or your data, email sorinzamfir83@gmail.com (interim address; [to be confirmed before release: permanent CabLink contact email for privacy requests]).

The CabLink apps

The CabLink passenger and driver apps have their own privacy notices, which explain how the apps handle accounts, trips and locations:

• Passenger app privacy notice
• Driver app privacy notice

The contact form

The contact form asks for:

• your name and email address (required);
• your phone number (optional);
• what your message is about (a general question, CabLink Business, partnerships and press, or something else);
• the name and type of your business, if you choose CabLink Business and fill it in;
• your message (required).

Where it goes today: the contact form is not connected to anything yet. Its fields and its Send button are switched off, so nothing can be typed into it or sent from it.

Spam filtering: once the form is switched on, the page will check, inside your browser, that the form was not filled in by a program: it contains a hidden field that people never see and leave empty, and it checks that a few seconds have passed since the page opened. These checks send nothing extra; the hidden field is never sent.

Where it will go once the form is switched on: your message, together with the address of the page you sent it from and the time it was sent, will be delivered over an encrypted connection to [to be confirmed before release: the service that receives contact form messages]. It will be read only by the operator of CabLink named above, who uses it only to answer your enquiry. We do not sell it or pass it to anyone else, and we do not use it for marketing.

Legal basis: [proposed: our legitimate interest in answering messages that people choose to send us, and, for business enquiries, taking steps you ask for before any agreement — to be confirmed before release].

How long we keep it: [proposed: 12 months after the enquiry is closed — to be confirmed before release].

The Long Distance request form

The Long Distance page shows a preview of a journey request form. It asks for the pickup address, destination, date, pickup time, number of passengers, luggage, whether a wheelchair accessible vehicle is needed, your name, phone number, email address (optional) and notes.

Where it goes today: nowhere. The form is switched off: its fields and its button are disabled, and the website blocks the form from being sent. Nothing you type in it leaves your browser.

If CabLink later opens long-distance requests (which will only happen once it holds a Dispatch Operator Licence), this notice will be updated first to say who receives the request and how long it is kept. Until then, the same retention would apply as for the contact form: [proposed: 12 months after the enquiry is closed — to be confirmed before release].

CabLink Business accounts

Today: CabLink Business accounts are not open yet. The signup, login and dashboard pages are switched off: they load nothing from other companies and send nothing. Before opening, CabLink may run one internal test account, used only by CabLink, under the terms below. [to be confirmed before release: this section is reviewed, and the date of opening is set, before Business accounts are switched on.]

Once accounts are open, CabLink stores for each business:

• the business name, contact person, phone number, full business address and the login name chosen at signup;
• the email address given at signup. It is the account's sign-in identity and is used to send password reset links. It is kept by Firebase Authentication and in a record that only the business and CabLink's administrators can read;
• the password, which is handled by Firebase Authentication: CabLink never sees it or stores it in readable form;
• the account's status and its history (requested, approved, not approved with the reason, suspended, reactivated, details corrected), with who made each change and when;
• the pickup point CabLink sets for the business after checking it (an address and its map position).

For each booking a business makes: the room number or reference, the destination if one is given, the number of passengers, whether a wheelchair accessible vehicle is needed, notes, the time (for bookings ahead), what happened to the booking and the driver who took it. Optionally, the passenger's name. For bookings ahead only, the passenger's phone number (required, so that driver and passenger can reach each other; bookings for now ask for no phone number).

Who sees what:

• The business sees its own account and its own bookings only. For each of its bookings it sees the driver's name, phone number, vehicle and registration once a driver accepts, an estimated arrival time, and the driver's live position on a map only while the driver is on the way to its pickup.
• Drivers who could take a booking see the business name, the reference, the pickup, the destination if given, and the time. They never see the passenger's name or phone number before accepting. The driver who takes the booking also sees the passenger's name if one was given, and for bookings ahead the passenger's phone number.
• CabLink's administrators see business accounts, their history and bookings, to review requests and run the service.

Where it is kept: in Google Firebase (Firebase Authentication, Cloud Firestore and Cloud Functions in the europe-west1 region, Belgium), which processes it on CabLink's behalf. [to be confirmed before release: Cloud Firestore database location, and Google's data processing terms as they apply to CabLink.]

Your browser: when you log in, the Business pages keep your sign-in in your browser's storage (IndexedDB, or local storage if that isn't available) so that you stay signed in until you log out. It is needed for the login you asked for; it is not a cookie and is not used for anything else. Logging out removes it. The Firebase code also keeps a small technical record there of which Firebase libraries it used and on which days (Firebase's "heartbeat"), which it sends to Google with its requests; it contains nothing about you or your bookings.

Google services the Business pages use: once open, these pages load the Firebase code from www.gstatic.com and connect to Google's servers to sign in (identitytoolkit.googleapis.com, securetoken.googleapis.com), to read your account and bookings (firestore.googleapis.com) and to make requests (CabLink's Cloud Functions at europe-west1-cablink-ff664.cloudfunctions.net). If the live map is switched on, the dashboard also loads Google Maps from maps.googleapis.com and maps.gstatic.com while a driver is on the way. Like any server, Google receives your IP address and browser details when your browser connects.

Passengers: a business that enters a passenger's name or phone number should tell the passenger that it does so to book their taxi with CabLink. [to be confirmed before release: the roles of CabLink and the business for passenger details (controller / processor) and the wording given to businesses.]

Legal basis: [proposed: performing our agreement with the business (its account and bookings), and our legitimate interest in getting the passenger picked up for the passenger name and phone number a business enters — to be confirmed before release].

How long we keep it: [to be confirmed before release: how long business accounts, their history and business bookings are kept after an account closes or a booking ends].

cablink.ie/go

The cablink.ie/go page (the address in CabLink QR codes) currently shows information only. It does not detect your device, redirect you or collect anything. When CabLink launches, the page will check your browser's own description of your device (Android, iPhone or other) inside your browser, only to show the right link. That check sends nothing to us.

Server logs

Like almost every website, the web server that hosts cablink.ie (Caddy) writes a line to an access log for each request your browser makes: each page, picture, stylesheet and script. Each line contains:

• your IP address and network port;
• the date and time;
• the address requested, including anything after a "?" in it (for example /contact/?topic=business). The forms on this site never put what you type into the address;
• the response code, size and how long the response took;
• the headers your browser sends, which include your browser and device type (the "user agent"), the page that linked you here (if your browser shares it) and your language settings. Caddy hides cookie and login headers by default, and this site sets no cookies.

Why: to keep the website working and secure, for example to find errors or deal with abuse. We do not use the logs to build profiles of visitors or combine them with anything else.

How long: the server configuration starts a new log file each time the current one reaches 20 MiB and keeps the 5 most recent older files; anything older is deleted. The configuration does not set an age limit. Caddy's standard setting, which applies when none is set, deletes older log files after 90 days [to be confirmed on the server before release]. Because the rotation depends on size, on a quiet website a log line can stay in the current file for longer than 90 days until that file fills up.

Visits to www.cablink.ie are redirected to cablink.ie. The server configuration writes no access log for the redirect itself.

Where: the website runs on a rented server provided by [to be confirmed before release: hosting provider and the country where the server is located], which stores the logs on our behalf.

Other companies your browser contacts

On the public pages, none. Everything on them is loaded from cablink.ie itself:

• text uses the fonts already on your device; no web fonts are downloaded from Google Fonts or anywhere else;
• the animated map on the home page is drawn from map data built into the page (© OpenStreetMap contributors). No map service or map tiles are loaded, and the taxis on it are a simulation;
• photos are stored on cablink.ie.

Links to other websites (such as OpenStreetMap or the app privacy notices) are ordinary links: your browser contacts those sites only if you click them.

The exception is the CabLink Business account pages once they are open: they connect to Google Firebase, and the dashboard's live map to Google Maps. See CabLink Business accounts.

Cookies and browser storage

This website sets no cookies and uses no analytics. It uses no local storage, session storage or other browser storage, with one exception: if you log in to a CabLink Business account, your sign-in is kept in your browser until you log out (see CabLink Business accounts). That storage is strictly necessary for the login you asked for, so there is no cookie banner.

Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected (rectification);
• have your data deleted (erasure);
• restrict how we use your data;
• object to our use of your data.

To use any of these rights, email us at the address in Who is responsible. We will reply within one month. To find your lines in the server logs we would need to know the IP address you used and roughly when you visited.

Complaints

You can complain to the Data Protection Commission at any time:
Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland
www.dataprotection.ie

We would appreciate the chance to deal with your concern first, but you do not have to contact us before going to the Commission.

Changes to this notice

We will update this page before any form on the website starts sending information, and whenever anything else described here changes.

Last updated: [to be confirmed before release: publication date] · Draft of 30 September 2026