Privacy Policy

DriveBuddy Group Ltd ("DriveBuddy", "we", "us") is the data controller for the personal information described in this policy, except where Section 3 says otherwise.

• Company: DriveBuddy Group Ltd
• Registered in: Northern Ireland, company number NI736130
• Registered office: 19 Hillhall Park, Lisburn, Northern Ireland, BT27 5DE
• Contact: support@drivebuddy.uk
• Data protection contact: Jakub Debowski, reachable at info@drivebuddy.uk
• ICO registration reference: ZC165164

DriveBuddy is software for driving instructors and their learners. Instructors use it to schedule lessons, take payment, keep notes and track progress. Learners use it to book lessons, pay, and see how they're getting on.

We don't teach anyone to drive. Lessons are provided by independent instructors, and the agreement for a lesson is between the learner and their instructor.

Our progress tracking is not the DVA Logbook. Northern Ireland's Graduated Driver Licensing scheme requires a Programme of Training and Logbook that the DVA runs itself, and it is the DVA's system that allows a practical test to be booked. Anything recorded in DriveBuddy has no regulatory status and does not count towards any GDL requirement.

Our role under data protection law depends on the information in question. This isn't a technicality — it changes who you ask about what.

So: if you're a learner and you want to know what your instructor has written about you, or want it corrected, ask your instructor. If they can't help, contact us and we'll do what we can.

Payments are handled by Stripe, which is a controller in its own right for the identity and anti-fraud checks it carries out.

When you create an account: name, email address, phone number, password, date of birth, and whether you're a learner or an instructor.

Instructors also give us: business details, ADI or PDI registration details, and the identity and bank information Stripe needs to verify you and pay you. Stripe collects that directly — we don't see full bank details.

Learners also give us: provisional licence details, which we record because you must hold a provisional licence before lessons can begin and your instructor needs to know you have one. We may also collect your address and lesson preferences.

Automatically, when you use DriveBuddy: device type and operating system, app version, IP address, and how you use the app — which screens, which features, when. Approximate location only where you turn it on.

From your instructor, if you're a learner: lesson notes, progress assessments, GDL module entries, attendance and cancellations.

Payment information: we don't store your card number. Stripe processes it and we receive only the last four digits, card type, and whether the payment succeeded.

Health information. DriveBuddy isn't designed to hold health data and we don't ask for it. Cancellation reasons are selected from a fixed list rather than typed freely, so health information shouldn't reach us. If it does arrive some other way, we treat it as special category data and keep it no longer than necessary.

Where we rely on legitimate interests we've carried out a balancing assessment. You can ask us for a summary at support@drivebuddy.uk.

We don't make decisions about you by automated means alone, and we don't profile you in a way that produces legal or similarly significant effects.

We don't sell your information. We share it with:

Your instructor, or your learners. Instructors see their own learners' booking and progress information; learners see their instructor's name and availability.

Service providers who process data for us:

Each is bound by contract to process data only on our instructions.

Others, where we have to: law enforcement or regulators where legally required; professional advisers; and a buyer or successor if the business is sold, in which case we'll tell you.

We use no crash reporting or advertising SDKs. If that changes, this policy and our app store declarations change with it, before the feature ships.

Your information is held in the United Kingdom and the European Economic Area. Supabase and Lovable host in London; Resend and PostHog operate in their EU regions.

The exception is Stripe, which processes payment data across the UK, EEA and United States. Where information reaches the United States, we rely on the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as applicable.

On progress and PoT records specifically: because our tracking has no regulatory status, we have no legal obligation to retain it. That means we can honour a deletion request in full. We won't claim otherwise.

Every DriveBuddy account starts on the most private settings available, whatever your age. Optional location sharing is off. Profile visibility is at its most restricted. You can open things up if you want to; we don't do it for you.

Learners aged 16 and 17 use DriveBuddy in their own right, and they're a core part of the GDL cohort rather than an edge case. The ICO's Children's Code applies to us in full. In addition to the defaults above, for under-18 accounts:

• We never send marketing — no email, no SMS, no exceptions. Service messages about your own bookings still reach you.
• We collect less analytics data, and we don't profile you or personalise anything.
• We don't use design techniques intended to nudge you into sharing more than you need to.
• The payment method used for lessons must belong to someone aged 18 or over.

You can ask us to: give you a copy of your information; correct it; delete it; restrict how we use it; send it to another provider; or stop using it where we rely on legitimate interests. Where we rely on consent, you can withdraw it at any time.

Email support@drivebuddy.uk. We'll respond within one month, and tell you if we need longer because the request is complex.

When you delete your account, we delete your data — not hide it. Retention periods in Section 8 apply only where we're required to keep records, such as payment records for tax purposes.

You can delete your DriveBuddy account at any time: Delete your account.

If we don't act on your request, we'll tell you why, and we'll tell you what you can do next — complain to us, complain to the ICO, or seek a remedy through the courts.

Remember Section 3: for lesson notes written by your instructor, they're in charge, so start with them.

You have a legal right to complain directly to us about how we've handled your personal information, and we have a legal duty to deal with it properly.

Email support@drivebuddy.uk with "Data protection complaint" in the subject line.

We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

If you're not satisfied, you can complain to the Information Commissioner's Office — ico.org.uk/make-a-complaint, or 0303 123 1113. You can go to them at any time; you don't have to come to us first.

We don't currently send marketing messages. If we start, it will be a separate opt-in — never bundled into accepting the terms — with an unsubscribe link on every message. We will not send marketing to under-18 learners at all.

Service messages aren't marketing: booking confirmations, lesson reminders, changes to your account, and anything we're required to tell you. You can't opt out of those while you hold an account.

Our website and web app use cookies and similar technologies. Our Cookie Policy explains which ones, what they do, and how to control them.

We protect your information with:

• Encryption in transit and at rest
• Role-based access controls and row-level security, so our team and other users only reach what they need
• Authentication managed through our platform provider
• Logging of access to personal data
• Separation of live data from development environments
• Regular backups

If a breach happens that's likely to put your rights at risk, we'll report it to the ICO within 72 hours of becoming aware of it, and tell you directly where the risk to you is high. We have a written breach response procedure with a named owner.

We review this policy regularly and update it when our service or the law changes. Every version has a number and a date, and we record which version you accepted.

If we make significant changes we'll tell you, and where the law requires it we'll ask you to accept the updated policy before you carry on using DriveBuddy.