Privacy Policy

This policy applies to the DriveBuddy website, web app and mobile app (iOS and Android).

DriveBuddy Group Ltd ("DriveBuddy", "we", "us") is the data controller for the personal information described in this policy, except where Section 3 says otherwise.

• Company: DriveBuddy Group Ltd
• Registered in: Northern Ireland, company number NI736130
• Registered office: 19 Hillhall Park, Lisburn, Northern Ireland, BT27 5DE
• Contact: support@drivebuddy.uk
• Data protection contact: Jakub Debowski, at support@drivebuddy.uk
• ICO registration reference: ZC165164

DriveBuddy is software for driving instructors and their learners, available on the web and as a mobile app. Instructors use it to schedule lessons, take payment, keep notes and track progress. Learners use it to book lessons, pay, and see how they're getting on.

We don't teach anyone to drive. Lessons are provided by independent instructors, and the agreement for a lesson is between the learner and their instructor.

Our progress tracking is not the DVA Logbook. Northern Ireland's Graduated Driver Licensing scheme requires a Programme of Training and Logbook that the DVA runs itself, and it is the DVA's system that allows a practical test to be booked. Anything recorded in DriveBuddy has no regulatory status and does not count towards any GDL requirement.

Our role under data protection law depends on the information in question. This isn't a technicality: it changes who you ask about what.

So: if you're a learner and you want to know what your instructor has written about you, or want it corrected, ask your instructor. If they can't help, contact us and we'll do what we can.

Payments are handled by Stripe, which is a controller in its own right for the identity and anti-fraud checks it carries out.

When you create an account: name, email address, phone number, password, date of birth, and whether you're a learner or an instructor.

Instructors also give us: business details, ADI or PDI registration details, and the identity and bank information Stripe needs to verify you and pay you. Stripe collects that directly; we don't see full bank details.

Learners also give us: your provisional driving licence number, which we record because you must hold a provisional licence before lessons can begin and your instructor needs to know you have one. We may also collect your address and lesson preferences.

Messages: the messages you exchange with your instructor or learner through DriveBuddy.

Automatically, when you use DriveBuddy: device type and operating system, app version, IP address, and how you use DriveBuddy: which screens, which features, when. On the web, analytics only run if you accept them. The mobile app doesn't currently run any analytics. When the app checks for updates, Expo receives your app version and basic device details.

From your phone, in the mobile app: a notification token, if you allow notifications, so we can send booking reminders and updates; your location, only if you turn it on and allow it in your phone's settings; photos from your camera or photo library, only if you choose to upload one and allow access; and sign-in details kept in your phone's secure storage so you stay signed in. We don't read your contacts, and we don't use your phone's advertising ID.

From your instructor, if you're a learner: lesson notes, progress assessments, GDL module entries, attendance and cancellations.

Payment information: we don't store your card number. Stripe processes it and we receive only the last four digits, card type, and whether the payment succeeded.

Health information. DriveBuddy isn't designed to hold health data and we don't ask for it. Cancellation reasons are selected from a fixed list rather than typed freely, so health information shouldn't reach us. If it does arrive some other way, we treat it as special category data and keep it no longer than necessary.

Where we rely on legitimate interests we've carried out a balancing assessment. You can ask us for a summary at support@drivebuddy.uk.

We don't make decisions about you by automated means alone, and we don't profile you in a way that produces legal or similarly significant effects.

We don't sell your information. We share it with:

Your instructor, or your learners. Instructors see their own learners' booking and progress information; learners see their instructor's name and availability.

Service providers who process data for us:

Each is bound by contract to process data only on our instructions, except Stripe, Apple and Google, which act as controllers for parts of what they do.

Others, where we have to: law enforcement or regulators where legally required; professional advisers; and a buyer or successor if the business is sold, in which case we'll tell you.

We use no crash reporting or advertising SDKs. If that changes, this policy and our app store declarations change with it, before the feature ships.

Your information is held in the United Kingdom and the European Economic Area. Supabase and Lovable host in London; Resend and PostHog operate in their EU regions.

The exceptions are Stripe, which processes payment data across the UK, EEA and United States, and Expo, Apple and Google, whose notification services run in the United States and other countries. Where information reaches the United States, we rely on the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as applicable. Push notifications carry as little personal information as we can manage: a booking reminder, not your full details.

On progress and PoT records specifically: because our tracking has no regulatory status, we have no legal obligation to retain it. That means we can honour a deletion request in full. We won't claim otherwise. Notes an instructor has written are the instructor's own records, so if you want them handled in a particular way, ask your instructor too.

Every DriveBuddy account starts on the most private settings available, whatever your age. Optional location sharing is off. Profile visibility is at its most restricted. You can open things up if you want to; we don't do it for you.

DriveBuddy isn't for anyone under 16. Learners aged 16 and 17 use DriveBuddy in their own right, and they're a core part of the GDL cohort rather than an edge case. The ICO's Children's Code applies to us in full. In addition to the defaults above, for under-18 accounts:

• We never send marketing: no email, no push notifications, no exceptions. Service messages about your own bookings still reach you.
• We collect less analytics data, and we don't profile you or personalise anything.
• We don't use design techniques intended to nudge you into sharing more than you need to.
• The payment method used for lessons must belong to someone aged 18 or over.

These apply in the mobile app exactly as they do on the web.

You can ask us to: give you a copy of your information; correct it; delete it; restrict how we use it; send it to another provider; or stop using it where we rely on legitimate interests. Where we rely on consent, you can withdraw it at any time, including by turning analytics or notifications off.

Email support@drivebuddy.uk. We'll respond within one month, and tell you if we need longer because the request is complex.

When you delete your account, we delete your data, not hide it. Retention periods in Section 8 apply only where we're required to keep records, such as payment records for tax purposes.

You can delete your DriveBuddy account at any time, in the app under Settings > Account > Delete account, or on the web: Delete your account.

If we don't act on your request, we'll tell you why, and we'll tell you what you can do next: complain to us, complain to the ICO, or seek a remedy through the courts.

Remember Section 3: for lesson notes written by your instructor, they're in charge, so start with them.

You have a legal right to complain directly to us about how we've handled your personal information, and we have a legal duty to deal with it properly.

Email support@drivebuddy.uk with "Data protection complaint" in the subject line.

We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

If you're not satisfied, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113. You can go to them at any time; you don't have to come to us first.

We don't currently send marketing messages, by email or push notification. If we start, it will be a separate opt-in, never bundled into accepting the terms, with an unsubscribe route on every message. We will not send marketing to under-18 learners at all.

Service messages aren't marketing: booking confirmations, lesson reminders, changes to your account, and anything we're required to tell you. You can't opt out of those while you hold an account, though you can switch off push notifications in your phone's settings.

Our website, web app and mobile app use cookies and similar technologies, including information stored on your phone. Our Cookie Policy explains which ones, what they do, and how to control them.

We protect your information with:

• Encryption in transit and at rest
• Sign-in details held in your phone's secure storage (iOS Keychain, Android Keystore) rather than in plain files
• Role-based access controls and row-level security, so our team and other users only reach what they need
• Authentication managed through our platform provider
• Logging of access to personal data
• Separation of live data from development environments
• Regular backups

If a breach happens that's likely to put your rights at risk, we'll report it to the ICO within 72 hours of becoming aware of it, and tell you directly where the risk to you is high. We have a written breach response procedure with a named owner.

We review this policy regularly and update it when our service or the law changes. Every version has a number and a date, and we record which version you accepted.

If we make significant changes we'll tell you, in the app or by email, and where the law requires it we'll ask you to accept the updated policy before you carry on using DriveBuddy.