This version is effective from: June 2026 

 

1. INTRODUCTION

 

This privacy notice (the “Privacy Notice”) explains how your personal data is processed in connection with the operation of the “Freenow by Lyft” autonomous vehicles (“AVs”) in the United Kingdom (“UK”). For more information about how Freenow and/or Lyft process your personal data in connection with their services more broadly please see their respective privacy notices.

Please take a moment to read this Privacy Notice as it provides you with important information about your personal data, including the rights you have in relation to it.

This Privacy Notice is intended to meet the requirements of the data protection and privacy laws of the UK, in particular the UK General Data Protection Regulation (the “UK GDPR”) and the Data Protection Act 2018.

Any changes we make to this Privacy Notice will be posted on:

https://www.free-now.com/uk/autonomous/

2. ABOUT US

Lyft Autonomous UK OpCo Limited (“Lyft OpCo”) is responsible for operating the “Freenow by Lyft” AV fleet in the UK.

For most of the activities described in this Privacy Notice, Lyft OpCo will be the “controller” of your personal data. In simple terms, this means Lyft OpCo decides how and why your personal data is collected, used and stored.

In very limited circumstances, such as where your personal data is processed in connection with an insurance investigation or claim, Lyft Autonomous UK AssetCo Limited (“Lyft AssetCo”), as owner of the AV fleet, may also act as a controller of your personal data.

Where both Lyft OpCo and Lyft AssetCo act as controllers, they do so independently. This means each company is separately responsible for complying with data protection law in relation to its own processing activities. Lyft OpCo is registered in England and Wales (company number: 17032121) and Lyft AssetCo is also registered in England and Wales (company number: 17032016). Both companies have their registered office at Harling House, 47-51 Great Suffolk Street, London, United Kingdom, SE1 0BS.

Throughout this Privacy Notice, when we use the words “Lyft”, “our”, “us” or “we”, we are referring to Lyft OpCo, Lyft AssetCo, or both, depending on the context.

 

3. HOW TO CONTACT US

If you want more information or have any questions about us or how we process your personal data, you can contact us using the following methods:

Email: privacy-av-eu@lyft.com

Post: Harling House, 47-51 Great Suffolk Street, London, United Kingdom, SE1 0BS

 

4. HOW WE COLLECT AND RECEIVE PERSONAL DATA

We collect and receive personal data through the following methods:

  • Personal data collected automatically by our vehicles. Our vehicles are fitted with cameras and various types of sensors (including light detection and ranging (“LiDAR”) and radar sensors) that continuously record while a vehicle is in operation. This means that images, video, audio, and sensor data about people near or inside the vehicle will be collected automatically, without those individuals actively providing their data to us.
  • Personal data you provide to us. You may give us your personal data directly, for example, when you contact us with a query, to use your data subject rights, or to submit a complaint; or when you provide information to us in connection with an incident.
  • Personal data we receive from third parties. We may receive personal data from third parties, such as law enforcement authorities, insurers, other parties involved in an incident, or witnesses.

 

5. WHAT DATA DO WE COLLECT?

We may process the following personal data:

  • Image and Video Data. Images and video recordings captured by external cameras on our vehicles showing the vehicle’s surroundings (including pedestrians, cyclists, other drivers, and passers-by), and by interior cameras showing passengers and R&D drivers inside the vehicle.
  • Audio Data. Audio recordings captured by microphones located on the interior of the vehicle only, which may capture conversations of those travelling in the vehicle, including with our remote support team.
  • Location and Sensor Data. Precise location data and data from various sensors such as LiDAR and radar. While this data primarily relates to the vehicle and its environment, it may be linked to individuals in certain circumstances (for example, where it is associated with a passenger journey or an incident).
  • Incident Data. Information about any incident you may be involved in (including as a witness) involving or in the vicinity of one of our autonomous vehicles, including any personal data you or others provide (such as a factual description of the incident); details of any injury suffered; vehicle registration details; insurance information; actions taken by us or others in response to the incident; and any images, video, audio, or sensor data captured by our vehicle around the time of the incident.
  • Contact and Communications Data. Name, email address, telephone number, the content of any communications when you contact us, including in relation to a query, request, or complaint, and your communication preferences.
  • R&D Data. If you are one of our R&D drivers, technical data may be collected about how and when you control the vehicle. For example, whether you accelerated, applied the brakes, changed gears, took back control of the vehicle, etc. and when you took such actions in connection with different events occurring on the road.

 

6. OUR PROCESSING ACTIVITIES

 

Please see in the following table the purposes for which we process the personal data described in this Privacy Notice and the lawful bases we rely on to do so.

PurposePersonal DataDescriptionLawful Basis
Providing access to and operating the AV

Image and Video Data

Location and Sensor Data

To verify your identity and provide you with access to one of our vehicles, and to enable our vehicles to operate, including to perceive their surroundings, navigate safely, and make driving decisions in real time.Legitimate interests – to ensure the safe operation of our vehicles and the safety of road users, passengers, and the public.
Issue diagnosis and resolution

Image and Video Data

Audio Data

Location and Sensor Data

To diagnose and resolve issues. Where issues relate to the vehicles, this may involve sharing anonymised data with our technology partner. If an issue is detected with the vehicle or a passenger initiates a call, data may also be processed by our remote support team (including any audio calls you have with them).Legitimate interests – to ensure the safe operation of our vehicles, the safety of road users, passengers, and the public, and providing assistance to passengers remotely.
Investigating incidents and related actions

Image and Video Data

Audio Data

Location and Sensor Data

Contact and Communication Data

Incident Data

R&D Data

If an incident occurs involving or near one of our vehicles, we may process data to investigate the incident, establish the facts, and take any necessary or proportionate action, including with insurers, regulators, and law enforcement. Please note that data sharing for this purpose will be decided on a case-by-case basis.

Legitimate interests – to investigate incidents, improve safety, and to establish, exercise, or defend legal claims.

Compliance with a legal obligation – where we are required by law to report or investigate the incident.

Dealing with queries, requests, and/or complaints

Image and Video Data

Audio Data

Contact and Communication Data

To respond to and resolve any query, request or complaint that you submit to us in relation to our autonomous vehicles.Legitimate interests – to respond to and resolve queries, requests, and/or complaints from individuals affected by our operations.
Complying with legal obligationsAll categories of personal data described in this Privacy NoticeTo comply with our legal and regulatory obligations, including obligations under road traffic legislation, the Automated Vehicles Act 2024, health and safety law, and data protection law.Compliance with a legal obligation.
Business administration and legal claimsAll categories of personal data described in this Privacy NoticeTo enforce our legal rights, defend against potential legal claims, protect the rights of third parties, and facilitate any business transition such as a merger, reorganisation, or acquisition.

Legitimate interests – to operate our business effectively and to establish, exercise, or defend legal claims.

Compliance with a legal obligation.

Research and Development

Image and Video Data

Location and Sensor Data

Incident Data

R&D Data

Collecting data for the purposes of mapping, training, testing, and improving the safety and performance of our autonomous driving systems.

Please note, while personal data may be collected for this purpose, e.g. via the vehicle’s external cameras, robust anonymisation techniques are applied to personal data before it is used for the above purposes.		Legitimate interests – to enable our vehicles to operate safely and effectively, and to improve their performance over time.

 

Some of the data collected by our vehicle cameras may reveal information that is classified as

“special category data” under the UK GDPR, such as data from which racial or ethnic origin

could be inferred (for example, from facial images). We do not intentionally collect special

category data, and we do not use the data collected by our cameras for the purpose of

identifying individuals by reference to such characteristics.

 

Where we collect special category data, we do so on the basis that it is necessary for reasons

of substantial public interest (specifically, the safe development and operation of autonomous

vehicles on public roads) under Schedule 1 of the Data Protection Act 2018, or on the basis

that the processing is necessary to establish, exercise, or defend legal claims. We apply strict

safeguards to any special category data, including anonymisation techniques (before such

data is used for mapping, training or testing) and robust access controls.

 

7. SHARING PERSONAL DATA

 

We only share personal data with third parties when we are legally permitted to do so. When

we share personal data with others, we put contractual arrangements and security

mechanisms in place to protect the personal data and to maintain its confidentiality and

security. We will not sell your personal data to any third party.

 

The categories of recipients who we may share personal data with are summarised below:

 

  • Technology partners. We work with leading technology partners, such as Baidu, who provide services that support the development, testing, and operation of our autonomous driving systems. These partners may process personal data on our behalf (as data processors) and are required by contract to keep your data secure and to process it only in accordance with our instructions.
  • Insurers. We may share personal data with our insurers in connection with insurance claims, incident investigations, or to comply with the terms of our insurance policies.
  • Regulators and government bodies. We may share personal data with regulators, government agencies, and other official bodies where required by law or where necessary to comply with our regulatory obligations. This may include sharing data with the Driver and Vehicle Standards Agency, the Department for Transport, Transport for London, or other bodies with oversight of autonomous vehicle operations.
  • Law enforcement authorities. We share personal data with the police or other law enforcement authorities where required by law, in connection with the investigation of a crime, or where necessary to protect the safety of individuals.
  • Professional advisers. We share personal data with our legal advisers, auditors, or other professional advisers where necessary for us to obtain advice or to establish, exercise, or defend legal claims.

  • IT and data storage providers. We share personal data with providers of information

    technology, cloud storage, and data hosting services who support the operation of our

    systems.

  • Group companies. We may share personal data with other companies in our corporate group for the purposes described in this Privacy Notice and for internal administration.

  • Business partners. We may disclose personal data to third parties if we sell or buy any

    business or assets, in which case we may disclose personal data to the prospective seller

    or buyer, or if we or substantially all our assets are acquired by a third party.

Please note, we may also share Image and Video Data, Location and Sensor Data, and R&D Data with our technology partners for research & development purposes but only on an anonymised basis. We will not use personal data for these purposes.

 

8. YOUR RIGHTS

 

You have the following rights in relation to your personal data:

  • Your right of access. If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies.
  • Your right to rectification. If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we’ve shared your personal data with so that you can contact them.
  • Your right to erasure. You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
  • Your right to restrict processing. You can ask us to “block” or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you object to us processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us processing it further. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
  • Your right to data portability. You have the right, in certain circumstances, to obtain personal data you have provided to us (in a structured, commonly used and machine- readable format) and to reuse it elsewhere or to ask us to transfer it to your chosen third party.
  • Your right to object. You can ask us to stop processing your personal data, and we will do so, if we are:

(i) relying on our own or someone else’s legitimate interest to process your

personal data, except if we can demonstrate compelling legal grounds for the

processing; or

(ii) processing your personal data for direct marketing purposes.

  • Your rights in relation to automated decision-making and profiling. To the extent we make a decision about you based solely on automated processing, including profiling, that has a legal or other similarly significant effect on you, we will provide you with meaningful information about how any such decision is reached and what it means for you. We will only make such decisions where we are permitted by law to do so. Where we do, you will have the right to obtain meaningful human involvement, to express your point of view, and to contest the decision.
  • Your right to withdraw consent. If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
  • Your right to complain.

If you believe that our processing of your personal data does not comply with applicable

data protection law or you otherwise have a concern about the way we have handled your

personal data, you have the right to complain to us.

 

You also have the right to complain to a supervisory authority if you believe our

processing of your data does not comply with applicable data protection law. As our

vehicles operate in the UK, our main supervisory authority is the Information Commission

(“IC”). You can complain to the IC by visiting their website: https://ico.org.uk/make-a-

complaint/.

You can exercise your rights by contacting us using our contact details in the How to contact us section or, in respect of your right to withdraw consent, by using any other mechanism we may provide, such as an unsubscribe link in an email.

 

9. INFORMATION SECURITY

 

We are committed to keeping personal data secure and we have implemented information security policies, rules and technical and organisational measures to protect personal data under our control from unauthorised access, improper use or disclosure, unauthorised modification and unlawful destruction or accidental loss.

In addition, our personnel and data processors (third parties that process personal data on our behalf) are obliged to respect the confidentiality of the personal data under our control.

 

10. HOW LONG WE KEEP YOUR PERSONAL DATA

 

We will only keep your personal data for as long as necessary for the purposes set out in this Privacy Notice, or as required by law. The retention period will depend on the type of data and the purpose for which it is processed.

For example:

  • In the case of Video and Image Data, if footage captured by our external cameras does not need to be retained for a specific purpose (such as an incident investigation, research and development, or a legal or regulatory requirement), it is deleted within one week of collection. Similarly, internal camera footage and Audio Data are retained for no longer than three days unless required for a specific purpose.
  • Incident-related data is retained for as long as necessary to investigate and resolve the incident and to deal with any related legal or insurance claims, after which it is securely deleted.
  • Contact and Communications Data provided in connection with a query, request, or complaint, is retained for no longer than 6 years after the matter has been resolved. Where we are required by law to retain data for a minimum period (for example, under road traffic, health and safety, or similar legislation or regulatory guidance), we will retain the data for that period and no longer than is necessary.

 

11. IF YOU FAIL TO PROVIDE YOUR PERSONAL DATA

 

Where we are required by law to collect personal data, or we need to collect personal data to investigate an incident or for any other purpose, and you fail to provide that personal data, we may not be able to fulfil our obligations to you.

 

12. INTERNATIONAL TRANSFERS OF PERSONAL DATA

 

Some of the third parties we share your personal data may be located outside the United

Kingdom. For example, we may share your personal data with group companies and IT

providers located in the United States.

Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place to protect your data, as required by UK data protection law.

When transferring personal data to third countries, we usually rely on one of the following:

a) Adequacy decisions: We may transfer your personal data to countries or

organisations that the UK Government has determined provide an adequate level of

protection for personal data.

b) Contractual safeguards: We may use the UK International Data Transfer

Agreement or the UK Addendum to the EU Standard Contractual Clauses to

safeguard personal data.

You can contact us using the contact details in the How to contact us section for more information.