Last updated: 31 March 2025
This Privacy Policy explains how DriverLite Ltd ("DriverLite", "we", "us", or "our") collects, uses, stores, and protects your personal information when you use our website, mobile applications, and services (collectively, the "Platform"). We are committed to protecting your privacy and ensuring that your personal data is handled in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable data protection legislation. By using our Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use our services.
DriverLite Ltd is the data controller responsible for your personal data. If you have questions about this policy or our data practices, you can contact our Data Protection Officer at privacy@driverlite.com or write to us at: DriverLite Ltd, Data Protection Officer, [Registered Address], United Kingdom.
We collect several categories of information:
Account Information: When you register, we collect your full name, email address, phone number, date of birth, postal address, and profile photograph.
Identity Verification: For instructors, we collect driving licence details, ADI badge number, vehicle registration, insurance certificates, and DBS check references.
Payment Information: We collect billing addresses and payment method details. Card numbers are processed securely by our PCI-DSS compliant payment processor and are never stored on our servers.
Lesson & Booking Data: Lesson dates, times, locations, duration, instructor notes, progress records, and booking history.
Communications: Messages sent through our in-app messaging system, support tickets, and email correspondence.
Device & Usage Data: IP address, browser type, operating system, device identifiers, pages visited, features used, click patterns, session duration, and referring URLs.
Location Data: With your consent, approximate location data to show nearby instructors. You can disable location services in your device settings at any time.
We use your personal data for the following purposes:
Service Delivery: To create and manage your account, facilitate bookings, process payments, and provide our core platform features.
Communication: To send booking confirmations, lesson reminders, payment receipts, and respond to support requests.
Platform Improvement: To analyse usage patterns, diagnose technical issues, and improve the functionality and user experience of our Platform.
Safety & Verification: To verify instructor credentials, prevent fraud, and ensure the safety of all platform users.
Legal Compliance: To comply with legal obligations, including tax reporting, regulatory requirements, and law enforcement requests.
Marketing (with consent): To send newsletters, promotional offers, and product updates. You can opt out at any time via your account settings or the unsubscribe link in any marketing email.
We process your personal data under the following legal bases:
Contract Performance: Processing necessary to fulfil our contract with you, including account management, booking facilitation, and payment processing.
Legitimate Interests: Processing necessary for our legitimate business interests, such as fraud prevention, platform security, analytics, and service improvement, provided these interests are not overridden by your rights.
Legal Obligation: Processing necessary to comply with applicable laws and regulations.
Consent: Where we rely on your consent (e.g., marketing communications, location data), you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.
We may share your information with:
Instructors/Learners: Relevant booking details are shared between instructors and learners to facilitate lessons. Instructors see your name, contact details, and lesson history. Learners see instructor profiles, ratings, and availability.
Payment Processors: We use PCI-DSS compliant payment processors to handle transactions securely.
Cloud Infrastructure: Our platform is hosted on secure cloud infrastructure providers located in the UK and EEA.
Analytics Providers: We use analytics tools to understand platform usage. Data shared with these providers is anonymised or pseudonymised where possible.
Legal & Regulatory Bodies: We may disclose data when required by law, court order, or regulatory authority.
We do not sell your personal data to third parties. All third-party processors are bound by data processing agreements that ensure the security and confidentiality of your data.
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
Active Accounts: Data is retained for the duration of your account and for 2 years after account closure to handle any disputes or legal claims.
Financial Records: Transaction records are retained for 7 years in accordance with UK tax and accounting regulations.
Communications: Support tickets and in-app messages are retained for 3 years after resolution or account closure.
Analytics Data: Anonymised analytics data may be retained indefinitely for trend analysis.
You can request deletion of your account and associated data at any time, subject to our legal retention obligations.
We implement robust technical and organisational measures to protect your data:
- All data in transit is encrypted using TLS 1.3 - Data at rest is encrypted using AES-256 encryption - Access to personal data is restricted on a need-to-know basis with role-based access controls - We conduct regular security audits and penetration testing - Our infrastructure is monitored 24/7 for security threats - We maintain an incident response plan and will notify affected users and the ICO within 72 hours of any qualifying data breach
Under UK GDPR, you have the following rights:
Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your data where there is no compelling reason for continued processing.
Right to Restrict Processing: Request that we limit how we use your data.
Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
Right to Object: Object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
To exercise any of these rights, contact us at privacy@driverlite.com. We will respond within one month of receiving your request.
Your data is primarily stored and processed within the United Kingdom and the European Economic Area. If we transfer data outside these regions, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the ICO, adequacy decisions, or your explicit consent.
Our Platform is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly. Learners aged 16-17 may use the Platform with parental or guardian consent.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by email or through a prominent notice on our Platform at least 30 days before the changes take effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy.
If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us at privacy@driverlite.com.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.