Privacy notice

This notice explains how we collect and use your personal information when you use the Blitz Driving School website at blitzdrive.co.uk, our booking app, or our driving lessons, and the rights you have. It applies to learners, people who contact us, and people who visit our website. (Instructors and staff receive a separate notice.)

We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

#1. Who we are

The controller of your personal information is Blitz Driving School.

For any question about your personal information, or to use your rights, please contact us.

#2. What we collect

Information you give us:

• Account details: your name, email address and/or mobile number.
• Lesson details: your pickup postcode, whether you learn in a manual or automatic car, your booking history, and anything you choose to tell us your instructor should know.
• Documents you upload: photos of your driving licence (front and back) and, if you upload it, your theory test pass certificate. Your licence shows your photo, date of birth, licence number and address.
• Payments: what you've paid and owe, lesson credit, and refunds. Card payments are handled by Stripe: we never see or store your full card number.
• Messages: what you send through our contact forms, and our replies.

Information created when you use the service:

• Lesson records: lessons booked, taken and cancelled, and the progress feedback your instructor records after each lesson.
• Messages we send you: confirmations, reminders and sign-in codes, and whether they were delivered.
• Security and technical information: your IP address, browser and device type, sign-in history, the devices you're signed in on, passkeys you've set up (we store only the public key, never your fingerprint or face data), and records of automated checks that protect our forms from robots.

Special category information. If you choose to tell us about a health condition or disability so your instructor can teach you safely, that's "special category" information. We use it only with your explicit consent, only to adapt your lessons, and we share it only with the instructors who teach you. You can ask us to delete it at any time.

#3. Why we use it, and our lawful bases

#4. Who we share it with

We share only what's needed, with:

• Your instructor. Instructors who teach you see your name, pickup postcode, lesson details, anything you've told us they should know, and your progress. They must keep it confidential and use it only to teach you. Before an instructor takes a lesson, they see only the general area of your pickup.
• Service providers who help us run the service, under contracts that require them to protect your information and use it only on our instructions. These include providers of hosting (Vercel and our server hosting provider), card payments (Stripe), email (Resend), WhatsApp messages (Meta), text messages (Twilio), protection from robots (Cloudflare Turnstile), website statistics (Vercel Analytics), and postcode lookups (postcodes.io, which receives a postcode but no information about you).
• Authorities where the law requires it, for example the police, HMRC or a court.
• A buyer of our business, if we sell or restructure it, who would have to respect this notice.

We never sell your personal information.

#5. International transfers

Some of our service providers store or access information outside the UK, including in the United States. Where they do, we make sure your information is protected as UK law requires, for example through the UK–US data bridge, the UK's International Data Transfer Agreement or Addendum, or an adequacy decision. You can contact us for more details.

#6. How long we keep it

We keep personal information only for as long as we need it:

• Your account and lesson records: while you have an account, and for up to 2 years after your last lesson or sign-in, so we can deal with questions or complaints, then we delete or anonymise them.
• Uploaded licence and certificate images: only as long as we need them to check your entitlement to drive and keep accurate records, and no longer than your account details.
• Financial records: 6 years from the end of the financial year they relate to, as tax law requires.
• Enquiries: up to 2 years after we've dealt with them.
• Security logs: up to 12 months.

#7. How we protect it

We use appropriate technical and organisational measures, including encryption in transit, encryption of uploaded documents and sensitive settings at rest, short-lived signed links for documents, passwordless sign-in with codes and passkeys, and access controls so that staff and instructors see only what they need.

#8. Your rights

You have the right to:

• access your personal information and get a copy of it
• ask us to correct information that's wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use it
• object to us using it where we rely on legitimate interests
• data portability: get the information you gave us in a usable format, or have it sent to someone else
• withdraw consent at any time, where we rely on it (this doesn't affect what we did before)

Some rights have conditions. For example, we may need to keep financial records even if you ask us to delete your account. We'll respond within one month, and tell you if we need longer. There's normally no charge.

To use any of these rights, please contact us.

#9. Complaining to the ICO

If you're unhappy with how we've used your personal information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, helpline 0303 123 1113.

#10. Children

Our lessons are for people aged 17 and over (or 16 in limited cases). Some learners are under 18. We collect only the information we need to provide the service, whatever your age.

#11. Cookies

We use only a small number of cookies and similar technologies that are needed to make the service work. See our cookies policy.

#12. Changes to this notice

We may update this notice from time to time. The date at the top shows when it last changed. If we make significant changes, we'll tell you.