CabHubWho we are
CabHub is a product of Exevia BV, Katelijnsesteenweg 39/1, 2570 Duffel, Belgium, KBO 1041.395.760. For anything about your data, write to info@cabhub.be. We answer within one month, as the GDPR requires.
Controller or processor
We are the controller for the accounts of our customers and for visitors of this website: we decide why and how that data is used.
We are a processor for the data a taxi company enters about its drivers, customers and rides. The taxi company is the controller and we only process that data on its instructions, under the data processing terms in our terms and conditions. If you drive for a taxi company, that company is your first contact for your data.
What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data: name, email, company details | Giving you access and billing you | Contract (art. 6.1.b) |
| Driver data: name, phone number, driver pass number | Linking the driver app and reporting rides | On behalf of the taxi company (art. 28) |
| Ride and shift data: times, vehicle, distance, fare, location of the phone during a ride | Measuring rides, receipts, legal records | On behalf of the taxi company (art. 28) |
| Chiron keys (encrypted) | Sending rides to Chiron for the company | On behalf of the taxi company (art. 28) |
| Payment status and amount (via Mollie) | Activating paid driver seats | Contract (art. 6.1.b) |
| Sign-in codes and security logs | Protecting accounts against misuse | Legitimate interest (art. 6.1.f) |
| Anonymous page view counts | Improving this website | Legitimate interest (art. 6.1.f) |
We do not sell personal data, do not use it for advertising and do not make automated decisions about people with it.
Sharing with Chiron
Taxi operators in Flanders must report their rides to Chiron, the central ride database of the Flemish government. CabHub sends these messages for the taxi company, with the company's own keys and under its own enterprise number. This is how the company meets its legal obligation (art. 6.1.c GDPR).
Where the data is stored
Your data is stored in data centres in the European Union. We work with these providers, each bound by a data processing agreement:
| Provider | Used for | Location |
|---|---|---|
| Supabase | Database | Ireland (EU) |
| Render | Application servers | Frankfurt, Germany (EU) |
| Vercel | Hosting of this website and the web apps, cookieless visitor statistics | EU and global edge network |
| Brevo | Sign-in codes and account emails | EU |
| Mollie | Payments for driver seats | Netherlands (EU) |
Transfers outside the EU
The database and application servers are in the EU. Some providers are companies from the United States or deliver pages through servers worldwide. Where data may leave the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep it
- Ride and shift records: seven years, because they are part of a taxi company's legal records.
- Account data: while the account is active, then deleted unless the law requires us to keep it, such as invoices for accounting.
- Sign-in codes: expire after a few minutes.
- Website statistics: only anonymous totals.
Security
- All connections are encrypted (HTTPS).
- Each company's data is separated in the database itself, so one company can never see another's.
- Chiron keys are encrypted at rest and only decrypted when a ride is sent.
- Ride records are append only and linked to each other, so changes cannot go unnoticed.
- Passwords and codes are stored as one-way hashes, never in plain text.
If a data breach puts your rights at risk, we inform the taxi company or you without undue delay, and the Data Protection Authority within 72 hours where required.
Your rights
Under the GDPR you can ask to see your data, correct it, have it deleted, limit its use, object to it, or receive a copy to take elsewhere. Records a taxi company must keep by law cannot be deleted before the legal period ends.
You can always file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), dataprotectionauthority.be.
More about storage on your device is on our cookies page.